grosse infection Résolu

Question

Bonjour,apres un scan avec antivir qui a trouvé environ 70 virus,voici que je viens de passer un coup de malewarebytes,et là le compteur a explosé,lol,donc 261 virus trouvé,ouahhhhh!!

voici le rapport,mais je pense qu'il y a encore un peu de boulot

Malwarebytes' Anti-Malware 1.42
Version de la base de données: 3325
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

09/12/2009 21:04:39
mbam-log-2009-12-09 (21-04-39).txt

Type de recherche: Examen complet (C:\|D:\|E:\|I:\|J:\|)
Eléments examinés: 272818
Temps écoulé: 2 hour(s), 57 minute(s), 12 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 179
Valeur(s) du Registre infectée(s): 6
Elément(s) de données du Registre infecté(s): 2
Dossier(s) infecté(s): 29
Fichier(s) infecté(s): 45

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\adpanel.panel1 (Adware.AdRotator) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\adpanel.panel1.1 (Adware.AdRotator) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\coresrv.coreservices (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\coresrv.coreservices.1 (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\coresrv.lfgax (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\coresrv.lfgax.1 (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\dc_ads.ads (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\dc_ads.ads.1 (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\hbcoresrv.dynamicprop (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\hbcoresrv.dynamicprop.1 (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\hbmain.commband (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\hbmain.commband.1 (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\hbr.hbmain (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\hbr.hbmain.1 (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\hostie.bho (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\hostie.bho.1 (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\hostol.mailanim (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\hostol.mailanim.1 (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\hostol.webmailsend (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\hostol.webmailsend.1 (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\iebrowsercmp.browsercmp (Adware.AdRotator) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\iebrowsercmp.browsercmp.1 (Adware.AdRotator) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\instie.hbinstobj (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\instie.hbinstobj.1 (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\oberontb.band (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{ad76633e-e50d-4844-9e7f-4dfbc7c18467} (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{ec1a2105-5621-440f-987d-27ef428131d9} (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{6f282b65-56bf-4bd1-a8b2-a4449a05863d} (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6f282b65-56bf-4bd1-a8b2-a4449a05863d} (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{6f282b65-56bf-4bd1-a8b2-a4449a05863d} (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6f282b65-56bf-4bd1-a8b2-a4449a05863d} (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\oberontb.band.1 (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\seekmo.desktopflash (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\seekmo.desktopflash.1 (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\seekmoax.clientdetector (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\seekmoax.clientdetector.1 (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\seekmoax.userprofiles (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\seekmoax.userprofiles.1 (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport.hbax (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport.hbax.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport.hbinfoband (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport.hbinfoband.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport.iebutton (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport.iebutton.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport.iebuttona (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport.iebuttona.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport.rprtctrl (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\shoppingreport.rprtctrl.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\srv.coreservices (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\srv.coreservices.1 (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT	oolbar.htmlmenuui (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT	oolbar.htmlmenuui.1 (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT	oolbar.toolbarctl (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT	oolbar.toolbarctl.1 (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\wallpaper.wallpapermanager (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\wallpaper.wallpapermanager.1 (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{00b77587-be1b-4201-b8e9-09fcf50ab771} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{067c6a37-72ea-4437-863a-5be20c246f3c} (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{1230cf51-6bc4-4a23-b3f1-c7cf0afed619} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{1a2af056-1fe1-47ca-993d-5d09d18e674e} (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{2b81f920-6660-4f76-93bf-b1c67bf5d1a0} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{2e623b96-b166-4c70-8169-820761794299} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{34e29700-0d13-46aa-b9a5-ace68e21a091} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{3661af2d-c27b-499c-9bcf-66c8502a3806} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{3f0915b8-b238-4c2d-ad1e-60db1e14d27a} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{49155dae-c471-40fa-98ee-b2b3cad115ce} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{4d783385-0dda-4188-a529-c97dc3d67cbd} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{4e8b851b-05b0-4baf-b24d-d0dfe88dded3} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{50c3e2b3-4fd7-4cb9-91f9-641a6e6b3689} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{5a4737a8-b92a-4e54-970e-c2891d98ce3f} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{62b0b239-f9ac-4a5b-bfae-62c7a23f7627} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{6e10479b-31e8-4a3b-81b1-ddaf39097f19} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{726f0ab9-b842-4ae4-90c7-230e233e6a99} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{8ad9ad05-36be-4e40-ba62-5422eb0d02fb} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{99123ac9-7dda-4c82-b252-44c2804bf392} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{ace99e77-aa2a-43c2-8c9d-caf2020fdf2b} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{aebf09e2-0c15-43c8-99bf-928c645d98a0} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{b247f5bf-bd9d-4ecd-8fc1-365f36a1fda1} (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{b9cc2b92-5611-453f-8381-8b6f72d9c0b8} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{bbbfb891-98ae-4678-86f3-bd5a2eed86c9} (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{bd5258af-20ae-4bd3-b748-b2851aca7335} (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{c1a6d8b8-93c3-4186-9dd1-13983f9f1d9b} (Adware.AdRotator) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{c4543e64-1498-410d-8e72-4744eea99ab9} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{d8560ac2-21b5-4c1a-bdd4-bd12bc83b082} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{e0fb1610-b25b-49f6-be20-751b2f230e6f} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{e420a65f-9984-4b8c-9fa9-1ed69d3b0a13} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{ea58c2ea-be26-49dd-9b9a-c8e4e5ca7791} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{fca28ac5-c1e1-4d67-a5ae-c44d6c374d9f} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{4a40e8fc-c7e4-4f57-9fa4-85dd77402897} (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{1d8282e6-bc4f-469b-aaed-7e4ff077ad93} (Adware.AdRotator) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{79f562e5-768c-4494-8e6c-824ada4a9c2c} (Adware.AdRotator) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{1e0004ec-5df0-48c7-a8f0-fbb0488a3d94} (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{1f158a1e-a687-4a11-9679-b3ac64b86a1c} (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{914a8f99-38e4-47ec-b875-2b0653516030} (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{e313f5dc-cfe7-4568-84a4-c76653547571} (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{100eb1fd-d03e-47fd-81f3-ee91287f9465} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{20ea9658-6bc3-4599-a87d-6371fe9295fc} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a16ad1e9-f69a-45af-9462-b1c286708842} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a7cddcdc-beeb-4685-a062-978f5e07ceee} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c9ccbb35-d123-4a31-affc-9b2933132116} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{85e0b171-04fa-11d1-b7da-00a0c90348a7} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{07aa283a-43d7-4cbe-a064-32a21112d94d} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{54a3f8b7-228e-4ed8-895b-de832b2c3959} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{5b2e150d-4c8a-40e4-8c36-dd9c02771c67} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{627d894a-8a77-416e-b522-432eaf2c818e} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{7138f250-5b72-48dd-adfb-9a83b429dd9e} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{8971cb48-9fca-445a-be77-e8e8a4cc9df7} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{93b0fa7b-50f6-41b4-ac7e-612a72ce8c3c} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{b0cb585f-3271-4e42-88d9-ae5c9330d554} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{b88e4484-3ff6-4ea9-815b-a54fe20d4387} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{bf1bf02c-5a86-4ecf-adac-472c54c4d21e} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{bfc08cff-c737-4433-bd5a-0ee7efcfee54} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{d2221ccb-f2bb-4858-aad4-57c754153603} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{ea0b6a1a-6a59-4a58-9c41-9966504898a5} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{733716e1-76d2-4003-ac39-845281c0ef85} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{3160f356-e8c3-4de2-a698-92eeeb3d3400} (Adware.AdRotator) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{995e885e-3ff5-4f66-a107-8bfb3a0f8f12} (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{fbb40fdf-b715-4342-ab82-244ecc66e979} (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{cdca70d8-c6a6-49ee-9bed-7429d6c477a2} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{d136987f-e1c4-4ccc-a220-893df03ec5df} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{e343edfc-1e6c-4cb5-aa29-e9c922641c80} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{08755390-f46d-4d09-968c-3430166b3189} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{087c4054-0a2b-4f35-b0db-bed3e21650f4} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{0923208c-e259-4ed5-a778-cb607da350ad} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{229d2451-a617-4b30-b5e8-8138694240cb} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{9720de03-5820-4059-b4a4-639d5e52bd09} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{c23fa5a4-1fea-419f-8b14-f7465df062bc} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{ccc6e232-aa4c-4813-a019-9c14b27776b6} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\Features\9ee2330ae5f4470cac801baac83818c9 (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\Products\568267acfc5644dab06f058006ddbae3 (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d8282e6-bc4f-469b-aaed-7e4ff077ad93} (Adware.AdRotator) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{79f562e5-768c-4494-8e6c-824ada4a9c2c} (Adware.AdRotator) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6fc3c36d-7635-4d43-ba62-0d9d2f2cd06e} (Adware.Fotomoto) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1a93c934-025b-4c3a-b38e-9654a7003239} (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{100eb1fd-d03e-47fd-81f3-ee91287f9465} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5428486-50a0-4a02-9d20-520b59a9f9b2} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{5ed7d3de-6dbe-4516-8712-01b1b64b7057} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{4ad44d3e-7316-4251-b754-9b10ec96af92} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{733716e1-76d2-4003-ac39-845281c0ef85} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{1d8282e6-bc4f-469b-aaed-7e4ff077ad93} (Adware.AdRotator) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{79f562e5-768c-4494-8e6c-824ada4a9c2c} (Adware.AdRotator) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{6fc3c36d-7635-4d43-ba62-0d9d2f2cd06e} (Adware.Fotomoto) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{1a93c934-025b-4c3a-b38e-9654a7003239} (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{100eb1fd-d03e-47fd-81f3-ee91287f9465} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{c5428486-50a0-4a02-9d20-520b59a9f9b2} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{5ed7d3de-6dbe-4516-8712-01b1b64b7057} (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{4ad44d3e-7316-4251-b754-9b10ec96af92} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{733716e1-76d2-4003-ac39-845281c0ef85} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{1a93c934-025b-4c3a-b38e-9654a7003239} (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{914a8f99-38e4-47ec-b875-2b0653516030} (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{eddbb5ee-bb64-4bfc-9dbe-e7c85941335b} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{733716e1-76d2-4003-ac39-845281c0ef85} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{1f158a1e-a687-4a11-9679-b3ac64b86a1c} (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{914a8f99-38e4-47ec-b875-2b0653516030} (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{e313f5dc-cfe7-4568-84a4-c76653547571} (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{54a3f8b7-228e-4ed8-895b-de832b2c3959} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\dcads (Adware.AdRotator) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\dcadssocial (Adware.AdRotator) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\superiorads (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\seekmo.desktopflash (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\seekmo.desktopflash.1 (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\seekmoax.clientdetector (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\seekmoax.clientdetector.1 (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\seekmoax.userprofiles (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\seekmoax.userprofiles.1 (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\antivirus2008y (Rogue.AntiVirus2008) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\fcn (Rogue.Residue) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\AdvRemoteDbg (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\seekmo (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\ShoppingReport (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\UpMedia (Adware.SmartShopper) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\antivirus2008y (Rogue.AntiVirus2008) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ShoppingReport (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\seekmo (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\ShoppingReport (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{98393bff-ae22-7d23-ce65-4a06a96b0188} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{98393bff-ae22-7d23-ce65-4a06a96b0188} (Trojan.BHO) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{6f282b65-56bf-4bd1-a8b2-a4449a05863d} (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{c5428486-50a0-4a02-9d20-520b59a9f9b2} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{07aa283a-43d7-4cbe-a064-32a21112d94d} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\antivirus2008y (Rogue.AntiVirus2008) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spa_start (Trojan.BHO) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
C:\Documents and Settings\All Users\Application Data\2ACA5CC3-0F83-453D-A079-1076FE1A8B65 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\patricia\Application Data\Antivirus2008y (Rogue.AntiVirus2008) -> Quarantined and deleted successfully.
C:\Documents and Settings\patricia\Application Data\Seekmo (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\SeekmoSA (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\patricia\Application Data\ShoppingReport (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\patricia\Application Data\ShoppingReport\cs (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\patricia\Application Data\ShoppingReport\cs\db (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\patricia\Application Data\ShoppingReport\cs\Documents and Settings (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\patricia\Application Data\ShoppingReport\cs\dwld (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\patricia\Application Data\ShoppingReport\cseport (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\patricia\Application Data\ShoppingReport\cses3 (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings	ony\Application Data\ShoppingReport (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings	ony\Application Data\ShoppingReport\cs (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings	ony\Application Data\ShoppingReport\cs\db (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings	ony\Application Data\ShoppingReport\cs\dwld (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings	ony\Application Data\ShoppingReport\cseport (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings	ony\Application Data\ShoppingReport\cses1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files\Seekmo (Adware.180Solutions) -> Quarantined and deleted successfully.
C:\Program Files\Seekmo\bin (Adware.180Solutions) -> Quarantined and deleted successfully.
C:\Program Files\Seekmo\bin\10.0.406.0 (Adware.180Solutions) -> Quarantined and deleted successfully.
C:\Program Files\Seekmo\bin\10.0.406.0\firefox (Adware.180Solutions) -> Quarantined and deleted successfully.
C:\Program Files\Seekmo\bin\10.0.406.0\firefox\extensions (Adware.180Solutions) -> Quarantined and deleted successfully.
C:\Program Files\Seekmo\bin\10.0.406.0\firefox\extensions\components (Adware.180Solutions) -> Quarantined and deleted successfully.
C:\Program Files\Seekmo\bin\10.0.406.0\firefox\extensions\plugins (Adware.180Solutions) -> Quarantined and deleted successfully.
C:\Program Files\ShoppingReport (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files\ShoppingReport\Bin (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files\ShoppingReport\Bin\2.0.26 (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files\ShoppingReport\cs (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Seekmo (Adware.Seekmo) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Documents and Settings\patricia\Local Settings\Application Data\vffmn_navps.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
C:\Documents and Settings\patricia\Local Settings\Application Data\vffmn_nav.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
C:\Documents and Settings\patricia\Local Settings\Application Data\vffmn.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
C:\Program Files\GamesBar\oberontb.dll (Adware.Gamesbar) -> Quarantined and deleted successfully.
C:\Documents and Settings\patricia\Application Data\Antivirus2008y\antvrs.exe (Rogue.AntiVirus2008) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\SeekmoSA\SeekmoSA.dat (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\SeekmoSA\SeekmoSAAbout.mht (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\SeekmoSA\SeekmoSAEULA.mht (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\patricia\Application Data\ShoppingReport\cs\Config.xml (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\patricia\Application Data\ShoppingReport\cs\db\Aliases.dbs (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\patricia\Application Data\ShoppingReport\cs\db\Sites.dbs (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\patricia\Application Data\ShoppingReport\cs\dwld\WhiteList.xip (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\patricia\Application Data\ShoppingReport\cseport\aggr_storage.xml (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\patricia\Application Data\ShoppingReport\cseport\send_storage.xml (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings\patricia\Application Data\ShoppingReport\cses3\WhiteList.dbs (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings	ony\Application Data\ShoppingReport\cs\Config.xml (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings	ony\Application Data\ShoppingReport\cs\db\Aliases.dbs (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings	ony\Application Data\ShoppingReport\cs\db\Sites.dbs (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings	ony\Application Data\ShoppingReport\cs\dwld\WhiteList.xip (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings	ony\Application Data\ShoppingReport\cseport\aggr_storage.xml (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings	ony\Application Data\ShoppingReport\cseport\send_storage.xml (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Documents and Settings	ony\Application Data\ShoppingReport\cses1\WhiteList.dbs (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files\Seekmo\bin\10.0.406.0\arrow.ico (Adware.180Solutions) -> Quarantined and deleted successfully.
C:\Program Files\Seekmo\bin\10.0.406.0\copyright.txt (Adware.180Solutions) -> Quarantined and deleted successfully.
C:\Program Files\Seekmo\bin\10.0.406.0\link.ico (Adware.180Solutions) -> Quarantined and deleted successfully.
C:\Program Files\Seekmo\bin\10.0.406.0\firefox\extensions\chrome.manifest (Adware.180Solutions) -> Quarantined and deleted successfully.
C:\Program Files\Seekmo\bin\10.0.406.0\firefox\extensions\install.rdf (Adware.180Solutions) -> Quarantined and deleted successfully.
C:\Program Files\Seekmo\bin\10.0.406.0\firefox\extensions\components
pclntax.xpt (Adware.180Solutions) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Seekmo\Reset Cursor.lnk (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Seekmo\Seekmo Customer Support Center.lnk (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Seekmo\Seekmo Uninstall Instructions.lnk (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\Documents and Settings\patricia\Application Data\urlredir.cfg (Adware.AdRotator) -> Quarantined and deleted successfully.
C:\Documents and Settings	ony\Application Data\urlredir.cfg (Adware.AdRotator) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\gemam_nav.dat (Adware.NaviPromo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\gqekkuq_nav.dat (Adware.NaviPromo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\gzqlsrp_nav.dat (Adware.NaviPromo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\gemam_navps.dat (Adware.NaviPromo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\gqekkuq_navps.dat (Adware.NaviPromo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\gzqlsrp_navps.dat (Adware.NaviPromo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\dcads-remove.exe (Adware.AdRotator) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\DcadsSocial-Uninstall.exe (Adware.AdRotator) -> Quarantined and deleted successfully.
C:\WINDOWS\system32
vs2.inf (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\superiorads-uninst.exe (Trojan.BHO) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\WhoisCL.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\wr.txt (Malware.Trace) -> Quarantined and deleted successfully.

jfkpresident · Answer

Bonsoir ;) Tu les collectionnent ? Treve de plaisanteries .. Télécharge random's system information tool (RSIT) par random/random et sauvegarde-le sur le Bureau. ==>Double-clique sur RSIT.exe afin de lancer RSIT. ==>Lis le contenu de l'écran Disclaimer puis clique sur Continue (si tu acceptes les conditions). ==>Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence. ==>Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront : log.txt (<Rend toi sur ce site: http://www.cijoint.fr/index.php ==>Clique sur "parcourir" et sélectionne ces fichiers ,un lien va etre créer . ==>Copie/colle ce lien dans ta prochaine réponse . Aide en images si besoin

mouton72 · Answer

slt,ce n'est pas mon pc,mais celui a des amis qui allaient sur le net sans antivirus activé,docn tou se comprends,mdr
sinon pour rsit j'y pensais justement,mais je le ferais demain apres-midi,là je vais me coucher.je te post le rapport demain,bonne fin de soirée.

mouton72 · Answer

salut,me revoilà,je fais de suite la manip citée plus haut.a tout de suite.

mouton72 · Answer

voilà les liens pour les 2 rapports.

http://www.cijoint.fr/cjlink.php?file=cj200912/cijMHKqD1P.txt

http://www.cijoint.fr/cjlink.php?file=cj200912/cijOk5Zf6G.txt
je reste sur le pc,des que tu as analysé fais signe stp.

jfkpresident · Answer

Ok ,tu va faire ceci dans l'ordre :

Particularitées si vous avez Windows Vista :

1) Désactivez l'UAC durant toute l'utilisation de Navilog1
2) Toujours lancer Navilog1 via clic-droit "exécuter en tant qu'administrateur"
******

Télécharge Navilog1 (par IL-MAFIOSO) sur ton bureau

http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe

Enregistrer la cible (du lien) sous... et enregistre-le sur ton bureau.
Ensuite double clique sur navilog1.exe pour lancer l'installation.
Une fois l'installation terminée, double-clique sur le raccourci Navilog1 présent sur le bureau.

Laisse-toi guider. Appuie sur une touche quand on te le demande.
Au menu principal, choisis 1 et valide.

Patiente le temps du scan. Il te sera peut-être demandé de redémarrer ton PC.
Laisse l'outil le faire automatiquement, sinon redémarre ton PC normalement s'il te le demande.

Patiente jusqu'au message "Scan terminé le......"
Appuie sur une touche comme demandé ; le bloc-notes va s'ouvrir.
Copie-colle l'intégralité dans ta réponse. Referme le bloc-notes.

PS : le rapport est, aussi, sauvegardé à la racine du disque dur C:\cleannavi.txt

=====================================

Télécharges ComboFix à partir d'un de ces liens :

http://download.bleepingcomputer.com/sUBs/ComboFix.exe
https://forospyware.com
http://www.geekstogo.com/forum/files/file/197-combofix-by-subs/

Et important, enregistre le sur le bureau.

Avant d'utiliser ComboFix :

? Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours.

? Désactive provisoirement et seulement le temps de l'utilisation de ComboFix,
la protection en temps réel de ton Antivirus et de tes Antispywares,
qui peuvent gêner fortement la procédure de recherche et de nettoyage de l'outil.


Une fois fait, sur ton bureau double-clic sur Combofix.exe.

- Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc.

/!\ Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes.

- En fin de scan il est possible que ComboFix ait besoin de redémarrer le pc pour finaliser la désinfection\recherche, laisses-le faire.

- Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt,.
est automatiquement sauvegardé et rangé à C:\Combofix.txt)

? Réactive la protection en temps réel de ton Antivirus et de tes Antispywares,
avant de te reconnecter à internet.

? Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.

mouton72 · Answer

voici le rapport navilog,par contre je le trouve un peu court,c'est normal?

Fix Navipromo version 4.0.5 commencé le 10/12/2009 17:34:04,48

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!

Outil exécuté depuis C:\Program Files
avilog1

Mise à jour le 10.11.2009 à 18h00 par IL-MAFIOSO

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : AMD Athlon(tm) XP 2800+ )
BIOS : Phoenix - AwardBIOS v6.00PG
USER : patricia ( Administrator )
BOOT : Normal boot

Antivirus : AntiVir Desktop 9.0.1.32 (Activated)


C:\ (Local Disk) - NTFS - Total:145 Go (Free:95 Go)
D:\ (CD or DVD)
E:\ (CD or DVD)
I:\ (USB)
J:\ (USB)


Recherche executée en mode normal 

Nettoyage exécuté au redémarrage de l'ordinateur


C:\WINDOWS\pack.epk supprimé !
C:\WINDOWS\system32\gemam.dat supprimé !
C:\WINDOWS\system32\gqekkuq.dat supprimé !
C:\WINDOWS\system32\gzqlsrp.dat supprimé !


Nettoyage contenu C:\WINDOWS\Temp effectué !
Nettoyage contenu C:\Documents and Settings\patricia\locals~1\Temp effectué !


*** Sauvegarde du Registre vers dossier Safebackup ***

sauvegarde du Registre réalisée avec succès !

*** Nettoyage Registre ***

Nettoyage Registre Ok

Certificat Egroup supprimé !
Certificat Electronic-Group supprimé !
Certificat Montorgueil supprimé !
Certificat OOO-Favorit supprimé !



*** Scan terminé 10/12/2009 17:47:12,14 ***

mouton72 · Answer

et voici le rapport combofix,là c'est autre chose,lol

ComboFix 09-12-09.04 - patricia 10/12/2009  17:58:12.1.1 - x86
Microsoft Windows XP Édition familiale  5.1.2600.3.1252.33.1036.18.255.100 [GMT 1:00]
Lancé depuis: c:\documents and settings\patricia\Bureau\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\recycler\S-1-5-21-659206414-3928594383-2263321713-1003
C:\Thumbs.db
c:\windows\system32\MabryObj.dll

.
(((((((((((((((((((((((((((((   Fichiers créés du 2009-11-10 au 2009-12-10  ))))))))))))))))))))))))))))))))))))
.

2009-12-09 12:36 . 2008-04-13 08:36	144384	------w-	c:\windows\system32\drivers\hdaudbus.sys
2009-12-09 12:36 . 2008-04-13 10:40	10240	------w-	c:\windows\system32\drivers\sffp_mmc.sys
2009-12-09 03:24 . 2009-12-09 03:23	411368	----a-w-	c:\windows\system32\deploytk.dll
2009-12-09 01:51 . 2009-12-09 01:51	--------	d-----w-	c:\documents and settings\patricia\Application Data\Malwarebytes
2009-12-09 01:51 . 2009-12-03 15:14	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-09 01:51 . 2009-12-09 01:51	--------	d-----w-	c:\documents and settings\All Users\Application Data\Malwarebytes
2009-12-09 01:51 . 2009-12-03 15:13	19160	----a-w-	c:\windows\system32\drivers\mbam.sys
2009-12-09 01:51 . 2009-12-09 01:51	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2009-12-08 20:31 . 2009-12-08 20:31	--------	d-----w-	c:\program files\CCleaner
2009-12-08 14:41 . 2009-12-10 14:47	56816	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2009-12-08 14:41 . 2009-03-30 08:32	96104	----a-w-	c:\windows\system32\drivers\avipbb.sys
2009-12-08 14:41 . 2009-02-13 10:28	22360	----a-w-	c:\windows\system32\drivers\avgntmgr.sys
2009-12-08 14:41 . 2009-02-13 10:17	45416	----a-w-	c:\windows\system32\drivers\avgntdd.sys
2009-12-08 14:40 . 2009-12-08 14:40	--------	d-----w-	c:\program files\Avira
2009-12-08 14:40 . 2009-12-08 14:40	--------	d-----w-	c:\documents and settings\All Users\Application Data\Avira
2009-12-03 18:17 . 2009-06-30 08:37	28552	----a-w-	c:\windows\system32\drivers\pavboot.sys

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-10 16:47 . 2009-12-10 16:33	--------	d-----w-	c:\program files\Navilog1
2009-12-10 16:14 . 2009-12-10 16:14	--------	d-----w-	c:\program files\SuperCopier2
2009-12-10 15:40 . 2004-10-25 16:16	--------	d-----w-	c:\program files\Fichiers communs\Adobe
2009-12-10 15:23 . 2009-12-10 15:23	--------	d-----w-	c:\documents and settings\patricia\Application Data\vlc
2009-12-10 15:06 . 2009-12-10 15:03	--------	d-----w-	c:\program files\trend micro
2009-12-10 14:44 . 2009-03-14 18:01	--------	d-----w-	c:\documents and settings\All Users\Application Data\Google Updater
2009-12-09 20:29 . 2002-09-30 11:49	81726	----a-w-	c:\windows\system32\perfc00C.dat
2009-12-09 20:29 . 2002-09-30 11:49	502364	----a-w-	c:\windows\system32\perfh00C.dat
2009-12-09 03:22 . 2007-10-10 11:58	--------	d-----w-	c:\program files\Java
2009-12-08 20:08 . 2006-05-05 11:57	--------	d-----w-	c:\documents and settings\patricia\Application Data\Shareaza
2009-12-05 08:26 . 2007-10-04 18:30	--------	d-----w-	c:\program files\Google
2009-11-22 13:57 . 2009-10-20 18:35	--------	d-----w-	c:\documents and settings\patricia\Application Data\Apple Computer
2009-10-20 18:53 . 2004-04-26 18:17	88576	-c--a-w-	c:\documents and settings\patricia\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-10-20 18:33 . 2009-10-20 18:32	--------	d-----w-	c:\program files\iTunes
2009-10-20 18:33 . 2009-10-20 18:32	--------	d-----w-	c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-10-20 18:32 . 2009-10-20 18:32	--------	d-----w-	c:\program files\iPod
2009-10-20 18:32 . 2009-10-20 18:26	--------	d-----w-	c:\program files\Fichiers communs\Apple
2009-10-20 18:32 . 2009-10-20 18:29	--------	d-----w-	c:\documents and settings\All Users\Application Data\Apple Computer
2009-10-20 18:31 . 2009-10-20 18:31	--------	d-----w-	c:\program files\Bonjour
2009-10-20 18:30 . 2009-10-20 18:29	--------	d-----w-	c:\program files\QuickTime
2009-10-20 18:27 . 2009-10-20 18:27	--------	d-----w-	c:\program files\Apple Software Update
2009-10-20 18:26 . 2009-10-20 18:26	--------	d-----w-	c:\documents and settings\All Users\Application Data\Apple
.

(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-03-14 39408]
"SuperCopier2.exe"="c:\program files\SuperCopier2\SuperCopier2.exe" [2009-08-16 955392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe -osboot" [X]
"fssui"="c:\program files\Windows Live\Family Safety\fsui.exe -autorun" [X]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-13 110592]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-12-09 149280]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-13 15360]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Activer le Poste de Travail Sans Fil Labtec.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Activer le Poste de Travail Sans Fil Labtec.lnk
backup=c:\windows\pss\Activer le Poste de Travail Sans Fil Labtec.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Bluetooth Manager.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Bluetooth Manager.lnk
backup=c:\windows\pss\Bluetooth Manager.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^EPSON Status Monitor 3 Environment Check 2.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\EPSON Status Monitor 3 Environment Check 2.lnk
backup=c:\windows\pss\EPSON Status Monitor 3 Environment Check 2.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^EPSON Status Monitor 3 Environment Check.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\EPSON Status Monitor 3 Environment Check.lnk
backup=c:\windows\pss\EPSON Status Monitor 3 Environment Check.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Reader.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Lancement rapide d'Adobe Reader.lnk
backup=c:\windows\pss\Lancement rapide d'Adobe Reader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Printkey2000.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Printkey2000.lnk
backup=c:\windows\pss\Printkey2000.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^WinZip Quick Pick.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\WinZip Quick Pick.lnk
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BigDogPath]
c:\windows\VM_STI.EXE VIMICRO USB PC Camera 301x [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eyurarydv]
c:\windows\system32\eyurarydv.exe eyurarydv [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NoTrace]
c:\program files\No Trace\NoTrace.exe -mini [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
c:\program files\QuickTime\QTTask.exe -atboottime [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Shareaza]
c:\program files\Shareaza\Shareaza.exe -tray [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\spa_start]
c:\windows\system32\sprt_ads.dll DllStart [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
c:\program files\Fichiers communs\Real\Update_OB\realsched.exe -osboot [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIModeChange]
2001-09-04 14:24	28672	----a-w-	c:\windows\system32\Ati2mdxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
2003-10-28 20:10	335872	----a-w-	c:\ati technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BJCFD]
2003-01-27 16:16	376912	----a-w-	c:\program files\BroadJump\Client Foundation\CFD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-13 18:34	15360	------w-	c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus Photo RX600]
2003-09-11 03:00	99840	----a-w-	c:\windows\system32\spool\drivers\w32x86\3\E_S4I0M2.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2009-09-21 14:36	305440	----a-w-	c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-13 18:34	1695232	----a-w-	c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sonic RecordNow!]
2003-09-11 03:00	99840	----a-w-	c:\windows\system32\spool\drivers\w32x86\3\E_S4I0M2.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
2003-08-14 22:34	57344	-c--a-w-	c:\windows\SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2007-07-12 02:00	132496	-c--a-w-	c:\program files\Java\jre1.6.0_02\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec NetDriver Monitor]
2006-08-22 20:24	111840	-c--a-w-	c:\progra~1\SYMNET~1\SNDMon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager]
2003-08-19 00:01	110592	-c--a-w-	c:\program files\Fichiers communs\Sonic\Update Manager\sgtray.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"=
"c:\WINDOWS\system32\[Emoticons-plus.com] Winkaa 2.0.exe"=
"c:\WINDOWS\system32\spool\drivers\w32x86\3\SAGENT4.EXE"=
"c:\Program Files\Windows Live\Messenger\msnmsgr.exe"=
"c:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"=
"c:\Program Files\Bonjour\mDNSResponder.exe"=
"c:\Program Files\iTunes\iTunes.exe"=
"c:\WINDOWS\PCHealth\HelpCtr\Binaries\helpctr.exe"=
"%windir%\Network Diagnostic\xpnetdiag.exe"=

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [03/12/2009 19:17 28552]
R1 Asapi;Asapi;c:\windows\system32\drivers\asapi.sys [17/03/2004 19:35 11264]
R1 kbfilter;Keyboard Filter Driver;c:\windows\system32\drivers\kbfilter.sys [23/04/2004 17:10 12964]
R1 vcsmpdrv;vcsmpdrv;c:\windows\system32\drivers\vcsmpdrv.sys [17/03/2004 19:39 49024]
R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [08/12/2009 15:41 108289]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [17/12/2008 16:16 54752]
R3 EPPSCSIx;Agfa EPPSCSI Driver;c:\windows\system32\drivers\EPPSCAN.sys [29/10/2004 12:04 95336]
S2 FILESpy;FILESpy;\??\c:\program files\Softwin\BitDefender9\filespy.sys --> c:\program files\Softwin\BitDefender9\filespy.sys [?]
.
------- Examen supplémentaire -------
.
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
uStart Page = hxxp://www.google.fr/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = 127.0.0.1
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} - hxxps://secure.gopetslive.com/dev/GoPetsWeb.cab
FF - ProfilePath - c:\documents and settings\patricia\Application Data\Mozilla\Firefox\Profiles\tkt43fh2.default\
FF - prefs.js: browser.search.selectedEngine - Live Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?mkt=fr-FR&FORM=MIMWA5&q=
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa2.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
.
- - - - ORPHELINS SUPPRIMES - - - -

HKLM-Run-StandardInstall - (no file)
HKLM-Run-Firevall Administrating - rndll.exe
HKU-Default-Run-Symantec NetDriver Warning - c:\progra~1\SYMNET~1\SNDWarn.exe
MSConfigStartUp-BDSwitchAgent - c:\progra~1\softwin\bitdef~1\bdswitch.exe
MSConfigStartUp-ccApp - c:\program files\Fichiers communs\Symantec Shared\ccApp.exe
MSConfigStartUp-Kernel - c:\windows\services.exe
MSConfigStartUp-MsnMsgr - c:\program files\MSN Messenger\MsnMsgr.Exe
MSConfigStartUp-Netcom - c:\program files\Netcom\Netcom.exe
MSConfigStartUp-Picasa Media Detector - c:\program files\Picasa2\PicasaMediaDetector.exe
MSConfigStartUp-SeekmoOE - c:\program files\Seekmo\bin\10.0.406.0\OEAddOn.exe
MSConfigStartUp-SeekmoSA - c:\program files\Seekmo\bin\10.0.406.0\SeekmoSA.exe
AddRemove-1500logi - c:\1500logi\1500logi\ACCSIM~1.EXE
AddRemove-ActiveScan 2.0 - c:\program files\Panda Security\ActiveScan 2.0\as2uninst.exe
AddRemove-LiveUpdate - c:\program files\Symantec\LiveUpdate\LSETUP.EXE
AddRemove-Smart Audio Converter_is1 - c:\documents and settings\patricia\Mes documents\My Music\SmartAudioConverter\unins000.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-10 18:16
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
Heure de fin: 2009-12-10  18:29:59
ComboFix-quarantined-files.txt  2009-12-10 17:29

Avant-CF: 104 862 711 808 octets libres
Après-CF: 104 995 950 592 octets libres

- - End Of File - - 5454F2954258018A0FBF0FD68788F5D5

jfkpresident · Answer

Il va falloir analyser un ou des fichier(s) suspect(s) !

Il se peut qu'il se trouvent dans les " dossiers cachés " du systeme.
Il faut donc les rendre visibles pour le scan.

Pour afficher les dossiers et fichiers cachés:

Panneau de configuration > Options des dossiers > onglet Affichage.

Coche Afficher les fichiers et dossiers cachés,
Décoche Masquer les extensions de fichiers connus
Décoche Masquer les fichiers protégés du Système.
Un message de mise en garde va apparaitre. Clique sur OK pour confirmer ton choix.
Les fichiers et dossiers cachés du système apparaitront alors dans l'explorateur Windows en transparence. 

Rends toi sur ce site :

https://www.virustotal.com/gui/

Clique sur parcourir et cherche ces fichiers : c:\windows\system32\drivers\pavboot.sys
                                                                  c:\windows\system32\drivers\sffp_mmc.sy­s       

Clique sur Send File.

Un rapport va s'élaborer ligne à ligne.

Attends la fin. Il doit comprendre la taille du fichier envoyé.

Sauvegarde le rapport avec le bloc-note.

Copie le dans ta réponse.

mouton72 · Answer

alors pour le premier fichier

Antivirus  	Version  	Dernière mise à jour  	Résultat
a-squared	4.5.0.43	2009.12.10	-
AhnLab-V3	5.0.0.2	2009.12.10	-
AntiVir	7.9.1.108	2009.12.10	-
Antiy-AVL	2.0.3.7	2009.12.10	-
Authentium	5.2.0.5	2009.12.02	-
Avast	4.8.1351.0	2009.12.10	-
AVG	8.5.0.426	2009.12.10	-
BitDefender	7.2	2009.12.10	-
CAT-QuickHeal	10.00	2009.12.10	-
ClamAV	0.94.1	2009.12.10	-
Comodo	3103	2009.12.01	-
DrWeb	5.0.0.12182	2009.12.10	-
eSafe	7.0.17.0	2009.12.10	-
eTrust-Vet	35.1.7168	2009.12.10	-
F-Prot	4.5.1.85	2009.12.10	-
F-Secure	9.0.15370.0	2009.12.10	-
Fortinet	4.0.14.0	2009.12.10	-
GData	19	2009.12.10	-
Ikarus	T3.1.1.74.0	2009.12.10	-
Jiangmin	13.0.900	2009.12.10	-
K7AntiVirus	7.10.917	2009.12.10	-
Kaspersky	7.0.0.125	2009.12.10	-
McAfee	5828	2009.12.10	-
McAfee+Artemis	5828	2009.12.10	-
McAfee-GW-Edition	6.8.5	2009.12.10	-
Microsoft	1.5302	2009.12.10	-
NOD32	4677	2009.12.10	-
Norman	6.04.03	2009.12.10	-
nProtect	2009.1.8.0	2009.12.10	-
Panda	10.0.2.2	2009.12.10	-
PCTools	7.0.3.5	2009.12.10	-
Prevx	3.0	2009.12.10	-
Rising	22.25.03.09	2009.12.10	-
Sophos	4.48.0	2009.12.10	-
Sunbelt	3.2.1858.2	2009.12.10	-
Symantec	1.4.4.12	2009.12.10	-
TheHacker	6.5.0.2.089	2009.12.10	-
TrendMicro	9.100.0.1001	2009.12.10	-
VBA32	3.12.12.0	2009.12.10	-
ViRobot	2009.12.10.2081	2009.12.10	-
VirusBuster	5.0.21.0	2009.12.09	-
Information additionnelle
File size: 28552 bytes
MD5...: 3adb8bd6154a3ef87496e8fce9c22493
SHA1..: 90212e5b5c714e7a0f27614c516b0e0316d7730e
SHA256: f87dc89a1d8613a92fa1b1454f4cacaf6730252c2ccacc424de87998b24d19c2
ssdeep: 768:UYMyRLCfOeTEMNgKlhFcRbpZoW7L+bVm:UYnLCWBRbv7is
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x4605
timedatestamp.....: 0x4a48aa64 (Mon Jun 29 11:49:56 2009)
machinetype.......: 0x14c (I386)

( 6 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x480 0x3d30 0x3d80 6.28 fc0244152da77bc3b9dfbff4e82524ce
.rdata 0x4200 0x224 0x280 3.63 776e04898c922c80549514e1be08db79
.data 0x4480 0x180 0x180 0.21 b26d6caa04f4b123fdc98b003a534973
INIT 0x4600 0x7bc 0x800 5.31 11defc6a960c00fcb75056c61e2711c9
.rsrc 0x4e00 0x300 0x300 3.24 c48713d5d89b7922c239ff2761129f2b
.reloc 0x5100 0x432 0x480 5.73 f4344bcdcbf0fdee142946b371a56d56

( 2 imports )
> ntoskrnl.exe: InitSafeBootMode, strncmp, PsGetVersion, ExAllocatePoolWithTag, IoGetCurrentProcess, memcpy, memset, ExFreePoolWithTag, IoDeleteDevice, ZwClose, ZwQueryValueKey, ZwOpenKey, RtlAppendUnicodeToString, RtlCopyUnicodeString, ZwSetValueKey, ZwCreateKey, RtlAppendUnicodeStringToString, RtlCompareUnicodeString, ObQueryNameString, ZwQuerySymbolicLinkObject, RtlFreeUnicodeString, ZwOpenSymbolicLinkObject, RtlAnsiStringToUnicodeString, RtlInitAnsiString, MmIsAddressValid, _stricmp, strncpy, PsSetCreateProcessNotifyRoutine, IofCallDriver, IofCompleteRequest, PsGetCurrentThreadId, ExQueueWorkItem, IoAttachDeviceToDeviceStack, RtlInitUnicodeString, ObfReferenceObject, ObfDereferenceObject, IoDetachDevice, RtlFreeAnsiString, RtlCompareString, sprintf, RtlUnicodeStringToAnsiString, IoGetDeviceObjectPointer, IoRegisterFsRegistrationChange, NtOpenProcessToken, RtlCopySid, RtlLengthSid, NtQueryInformationToken, NtQuerySecurityObject, NtSetSecurityObject, RtlSetOwnerSecurityDescriptor, RtlSetDaclSecurityDescriptor, RtlAddAccessAllowedAce, RtlCreateAcl, RtlCreateSecurityDescriptor, ZwDeleteKey, ZwReadFile, ZwWriteFile, ZwQueryInformationFile, wcsncpy, ZwSetInformationFile, ZwCreateFile, ZwDeleteFile, NtQueryDirectoryFile, _wcsicmp, KeTickCount, KeBugCheckEx, IoCreateDevice, IoCreateSymbolicLink, KeDelayExecutionThread, IoDeleteSymbolicLink, RtlUnwind
> HAL.dll: KfAcquireSpinLock, KfReleaseSpinLock, KeGetCurrentIrql

( 0 exports )
RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: Win32 Executable Generic (51.1%)
Win16/32 Executable Delphi generic (12.4%)
Clipper DOS Executable (12.1%)
Generic Win/DOS Executable (12.0%)
DOS Executable Generic (12.0%)
sigcheck:
publisher....: Panda Security, S.L.
copyright....: (c) Panda Security 2008
product......: n/a
description..: Panda Boot Driver
original name: pavboot.sys
internal name: pavboot
file version.: 1.0.11.0
comments.....: n/a
signers......: Panda Security S.L
VeriSign Class 3 Code Signing 2004 CA
Class 3 Public Primary Certification Authority
signing date.: 9:37 AM 6/30/2009
verified.....: -

mouton72 · Answer

et voici pour le deuxieme

Antivirus  	Version  	Dernière mise à jour  	Résultat
a-squared	4.5.0.43	2009.12.10	-
AhnLab-V3	5.0.0.2	2009.12.10	-
AntiVir	7.9.1.108	2009.12.10	-
Antiy-AVL	2.0.3.7	2009.12.10	-
Authentium	5.2.0.5	2009.12.02	-
Avast	4.8.1351.0	2009.12.10	-
AVG	8.5.0.426	2009.12.10	-
BitDefender	7.2	2009.12.10	-
CAT-QuickHeal	10.00	2009.12.10	-
ClamAV	0.94.1	2009.12.10	-
Comodo	3103	2009.12.01	-
DrWeb	5.0.0.12182	2009.12.10	-
eSafe	7.0.17.0	2009.12.10	-
eTrust-Vet	35.1.7168	2009.12.10	-
F-Prot	4.5.1.85	2009.12.10	-
F-Secure	9.0.15370.0	2009.12.10	-
Fortinet	4.0.14.0	2009.12.10	-
GData	19	2009.12.10	-
Ikarus	T3.1.1.74.0	2009.12.10	-
Jiangmin	13.0.900	2009.12.10	-
K7AntiVirus	7.10.917	2009.12.10	-
Kaspersky	7.0.0.125	2009.12.10	-
McAfee	5828	2009.12.10	-
McAfee+Artemis	5828	2009.12.10	-
McAfee-GW-Edition	6.8.5	2009.12.10	-
Microsoft	1.5302	2009.12.10	-
NOD32	4677	2009.12.10	-
Norman	6.04.03	2009.12.10	-
nProtect	2009.1.8.0	2009.12.10	-
Panda	10.0.2.2	2009.12.10	-
PCTools	7.0.3.5	2009.12.10	-
Prevx	3.0	2009.12.10	-
Rising	22.25.03.09	2009.12.10	-
Sophos	4.48.0	2009.12.10	-
Sunbelt	3.2.1858.2	2009.12.10	-
Symantec	1.4.4.12	2009.12.10	-
TheHacker	6.5.0.2.089	2009.12.10	-
TrendMicro	9.100.0.1001	2009.12.10	-
VBA32	3.12.12.0	2009.12.10	-
ViRobot	2009.12.10.2081	2009.12.10	-
VirusBuster	5.0.21.0	2009.12.09	-
Information additionnelle
File size: 10240 bytes
MD5...: d66d22d76878bf3483a6be30183fb648
SHA1..: 5499f41540a14a711f2cc276d9c07ab50b030ae7
SHA256: bbec0bf430f13a8387b8a49de5da5bef9493f5d674d7fa1c9155e0919bde6a55
ssdeep: 192:HaYAnLgrD7DUI0sM2SheAidtrS/HW2ZLWv:6Y2grPQISuAidtkW2ZLWv
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x1e16
timedatestamp.....: 0x480253af (Sun Apr 13 18:40:47 2008)
machinetype.......: 0x14c (I386)

( 7 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x300 0x82c 0x880 6.15 a65ecbabb7630ef151bd1d1828ab3a7f
.rdata 0xb80 0x294 0x300 2.75 90c737f0ac6164c5259c4358e1ab8bde
.data 0xe80 0x20c 0x280 0.10 bdc1304b6667dba03c2aaa10058a0d14
PAGE 0x1100 0xaac 0xb00 6.27 8c1b2591235a2fe5ce003b56245e643c
INIT 0x1c00 0x56a 0x580 5.92 a6391dae0c13f95eec5f082dec03246b
.rsrc 0x2180 0x410 0x480 3.16 f4060de35cd9ebae4f36705884276ba9
.reloc 0x2600 0x192 0x200 4.61 79efb19d8e55fed9f885858ca6d41101

( 1 imports )
> ntoskrnl.exe: ExFreePoolWithTag, ExAllocatePoolWithTag, _except_handler3, IofCompleteRequest, IofCallDriver, KeWaitForSingleObject, KeInitializeEvent, _allmul, _allshl, KeSetEvent, IoFreeIrp, IoDeleteDevice, IoAllocateMdl, IoAttachDeviceToDeviceStack, IoCreateDevice, PoStartNextPowerIrp, IoAllocateIrp, RtlCompareMemory, PoCallDriver, ZwQueryValueKey, RtlInitUnicodeString, ZwClose, ZwOpenKey, KeTickCount, KeBugCheckEx, MmBuildMdlForNonPagedPool, IoDetachDevice, IoFreeMdl, ObfDereferenceObject, IoBuildSynchronousFsdRequest, IoGetAttachedDeviceReference

( 0 exports )
RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: Generic Win/DOS Executable (49.9%)
DOS Executable Generic (49.8%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%)
packers (Kaspersky): PE_Patch
sigcheck:
publisher....: Microsoft Corporation
copyright....: (c) Microsoft Corporation. All rights reserved.
product......: Microsoft_ Windows_ Operating System
description..: Small Form Factor MMC Protocol Driver
original name: sffp_mmc.sys
internal name: sffp_mmc.sys
file version.: 6.0.4069.5512 (xpsp.080413-2108)
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned

mouton72 · Answer

tu es là jfk??

mouton72 · Answer

ouhhh ouhhh,la suite c'est quoi?

jfkpresident · Answer

Ouhhh ouhhh,la suite c'est quoi?

Tu n'as pas lu ma signature ??

> Ferme tout tes navigateurs (donc copie ou imprime les instructions avant)
- Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie/colle dedans les lignes suivantes :

           


File::
c:\windows\services.exe   
     


- Enregistre ce fichier sous le nom CFScript
- Fait un glisser/déposer de ce fichier CFScrïpt sur le fichier ComboFix.exe comme sur cette image. (Clique sur le fichier CFScript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFScript vienne recouvrir l'icône de Combofix. Relache la souris.) Combofix va démarrer.
- Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.
- Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!
- Ne touche à rien tant que le scan n'est pas terminé sinon le PC peut planter !
- Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
Note : Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt 

================================================

Télécharge Superantispyware (SAS) en cliquant sur ce lien :

https://www.superantispyware.com/superantispywarefreevspro.html

Choisis "enregistrer" et enregistre-le sur ton bureau.

Double-clique sur l'icône d'installation qui vient de se créer et suis les instructions.

Créé une icône sur le bureau.

Double-clique sur l'icône de SAS (une tête dans un cercle rouge barré) pour le lancer.

- Si l'outil te demande de mettre à jour le programme ("update the program definitions", clique sur yes.
- Sous Configuration and Preferences, clique sur le bouton "Preferences"
- Clique sur l'onglet "Scanning Control "
- Dans "Scanner Options ", assure toi que la case devant lles lignes suivantes est cochée :

Close browsers before scanning
Scan for tracking cookies
Terminate memory threats before quarantining
- Laisse les autres lignes décochées.

- Clique sur le bouton "Close" pour quitter l'écran du centre de contrôle.

- Dans la fenêtre principale, clique, dans "Scan for Harmful Software", sur "Scan your computer".

Dans la colonne de gauche, coche   C:\Fixed Drive.

Dans la colonne de droite, sous "Complete scan", clique sur "Perform Complete Scan"

Clique sur "next" pour lancer le scan. Patiente pendant la durée du scan.

A la fin du scan, une fenêtre de résultats s'ouvre . Clique sur OK.

Assure toi que toutes les lignes de la fenêtre blanche sont cochées et clique sur "Next".

Tout ce qui a été trouvé sera mis en quarantaine. S'il t'es demandé de redémarrer l'ordi ("reboot"), clique sur Yes.

Pour recopier les informations sur le forum, fais ceci :

- après le redémarrage de l'ordi, double-clique sur l'icône pour lancer SAS.
- Clique sur "Preferences" puis sur l'onglet "Statistics/Logs ".
- Dans "scanners logs", double-clique sur SUPERAntiSpyware Scan Log.

- Le rapport va s'ouvrir dans ton éditeur de texte par défaut.

- Copie son contenu dans ta réponse.

As tu Malware's Byte's anti-malware sur ton pc ?

mouton72 · Answer

voici le rapport combofix

ComboFix 09-12-09.04 - patricia 10/12/2009  21:19:41.2.1 - x86
Microsoft Windows XP Édition familiale  5.1.2600.3.1252.33.1036.18.255.100 [GMT 1:00]
Lancé depuis: c:\documents and settings\patricia\Bureau\ComboFix.exe
Commutateurs utilisés :: c:\documents and settings\patricia\Bureau\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

FILE ::
"c:\windows\services.exe"
.

(((((((((((((((((((((((((((((   Fichiers créés du 2009-11-10 au 2009-12-10  ))))))))))))))))))))))))))))))))))))
.

2009-12-10 18:16 . 2009-11-21 15:58	471552	------w-	c:\windows\system32\dllcache\aclayers.dll
2009-12-10 16:33 . 2009-12-10 16:47	--------	d-----w-	c:\program files\Navilog1
2009-12-10 16:14 . 2009-12-10 16:14	--------	d-----w-	c:\program files\SuperCopier2
2009-12-10 15:23 . 2009-12-10 15:23	--------	d-----w-	c:\documents and settings\patricia\Application Data\vlc
2009-12-10 15:03 . 2009-12-10 15:06	--------	d-----w-	c:\program files\trend micro
2009-12-10 15:02 . 2009-12-10 15:06	--------	d-----w-	C:\rsit
2009-12-09 12:36 . 2008-04-13 08:36	144384	------w-	c:\windows\system32\drivers\hdaudbus.sys
2009-12-09 12:36 . 2008-04-13 10:40	10240	------w-	c:\windows\system32\drivers\sffp_mmc.sys
2009-12-09 03:24 . 2009-12-09 03:23	411368	----a-w-	c:\windows\system32\deploytk.dll
2009-12-09 01:51 . 2009-12-09 01:51	--------	d-----w-	c:\documents and settings\patricia\Application Data\Malwarebytes
2009-12-09 01:51 . 2009-12-03 15:14	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-09 01:51 . 2009-12-09 01:51	--------	d-----w-	c:\documents and settings\All Users\Application Data\Malwarebytes
2009-12-09 01:51 . 2009-12-03 15:13	19160	----a-w-	c:\windows\system32\drivers\mbam.sys
2009-12-09 01:51 . 2009-12-09 01:51	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2009-12-08 20:31 . 2009-12-08 20:31	--------	d-----w-	c:\program files\CCleaner
2009-12-08 14:41 . 2009-12-10 14:47	56816	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2009-12-08 14:41 . 2009-03-30 08:32	96104	----a-w-	c:\windows\system32\drivers\avipbb.sys
2009-12-08 14:41 . 2009-02-13 10:28	22360	----a-w-	c:\windows\system32\drivers\avgntmgr.sys
2009-12-08 14:41 . 2009-02-13 10:17	45416	----a-w-	c:\windows\system32\drivers\avgntdd.sys
2009-12-08 14:40 . 2009-12-08 14:40	--------	d-----w-	c:\program files\Avira
2009-12-08 14:40 . 2009-12-08 14:40	--------	d-----w-	c:\documents and settings\All Users\Application Data\Avira
2009-12-03 18:17 . 2009-06-30 08:37	28552	----a-w-	c:\windows\system32\drivers\pavboot.sys

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-10 15:40 . 2004-10-25 16:16	--------	d-----w-	c:\program files\Fichiers communs\Adobe
2009-12-10 14:44 . 2009-03-14 18:01	--------	d-----w-	c:\documents and settings\All Users\Application Data\Google Updater
2009-12-09 20:29 . 2002-09-30 11:49	81726	----a-w-	c:\windows\system32\perfc00C.dat
2009-12-09 20:29 . 2002-09-30 11:49	502364	----a-w-	c:\windows\system32\perfh00C.dat
2009-12-09 12:51 . 2002-09-30 12:03	76487	----a-w-	c:\windows\PCHealth\HelpCtr\OfflineCache\index.dat
2009-12-09 03:22 . 2007-10-10 11:58	--------	d-----w-	c:\program files\Java
2009-12-08 20:08 . 2006-05-05 11:57	--------	d-----w-	c:\documents and settings\patricia\Application Data\Shareaza
2009-12-05 08:26 . 2007-10-04 18:30	--------	d-----w-	c:\program files\Google
2009-11-22 13:57 . 2009-10-20 18:35	--------	d-----w-	c:\documents and settings\patricia\Application Data\Apple Computer
2009-11-21 15:58 . 2002-09-30 11:48	471552	----a-w-	c:\windows\AppPatch\aclayers.dll
2009-10-29 07:42 . 2004-08-23 18:35	916480	----a-w-	c:\windows\system32\wininet.dll
2009-10-21 05:39 . 2004-08-19 23:09	75776	----a-w-	c:\windows\system32\strmfilt.dll
2009-10-21 05:39 . 2004-08-19 23:09	25088	----a-w-	c:\windows\system32\httpapi.dll
2009-10-20 18:53 . 2004-04-26 18:17	88576	-c--a-w-	c:\documents and settings\patricia\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-10-20 18:33 . 2009-10-20 18:32	--------	d-----w-	c:\program files\iTunes
2009-10-20 18:33 . 2009-10-20 18:32	--------	d-----w-	c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-10-20 18:32 . 2009-10-20 18:32	--------	d-----w-	c:\program files\iPod
2009-10-20 18:32 . 2009-10-20 18:26	--------	d-----w-	c:\program files\Fichiers communs\Apple
2009-10-20 18:32 . 2009-10-20 18:29	--------	d-----w-	c:\documents and settings\All Users\Application Data\Apple Computer
2009-10-20 18:31 . 2009-10-20 18:31	--------	d-----w-	c:\program files\Bonjour
2009-10-20 18:30 . 2009-10-20 18:29	--------	d-----w-	c:\program files\QuickTime
2009-10-20 18:27 . 2009-10-20 18:27	--------	d-----w-	c:\program files\Apple Software Update
2009-10-20 18:26 . 2009-10-20 18:26	--------	d-----w-	c:\documents and settings\All Users\Application Data\Apple
2009-10-20 16:20 . 2004-08-04 06:00	265728	------w-	c:\windows\system32\drivers\http.sys
2009-10-13 10:33 . 2002-09-30 11:49	271360	----a-w-	c:\windows\system32\oakley.dll
2009-10-12 13:39 . 2002-09-30 11:49	79872	----a-w-	c:\windows\system32\raschap.dll
2009-10-12 13:39 . 2002-09-30 11:49	150528	----a-w-	c:\windows\system32\rastls.dll
.

(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-03-14 39408]
"SuperCopier2.exe"="c:\program files\SuperCopier2\SuperCopier2.exe" [2009-08-16 955392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe -osboot" [X]
"fssui"="c:\program files\Windows Live\Family Safety\fsui.exe -autorun" [X]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-13 110592]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-12-09 149280]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-13 15360]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Activer le Poste de Travail Sans Fil Labtec.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Activer le Poste de Travail Sans Fil Labtec.lnk
backup=c:\windows\pss\Activer le Poste de Travail Sans Fil Labtec.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Bluetooth Manager.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Bluetooth Manager.lnk
backup=c:\windows\pss\Bluetooth Manager.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^EPSON Status Monitor 3 Environment Check 2.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\EPSON Status Monitor 3 Environment Check 2.lnk
backup=c:\windows\pss\EPSON Status Monitor 3 Environment Check 2.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^EPSON Status Monitor 3 Environment Check.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\EPSON Status Monitor 3 Environment Check.lnk
backup=c:\windows\pss\EPSON Status Monitor 3 Environment Check.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Reader.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Lancement rapide d'Adobe Reader.lnk
backup=c:\windows\pss\Lancement rapide d'Adobe Reader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Printkey2000.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Printkey2000.lnk
backup=c:\windows\pss\Printkey2000.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^WinZip Quick Pick.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\WinZip Quick Pick.lnk
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BigDogPath]
c:\windows\VM_STI.EXE VIMICRO USB PC Camera 301x [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eyurarydv]
c:\windows\system32\eyurarydv.exe eyurarydv [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NoTrace]
c:\program files\No Trace\NoTrace.exe -mini [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
c:\program files\QuickTime\QTTask.exe -atboottime [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Shareaza]
c:\program files\Shareaza\Shareaza.exe -tray [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\spa_start]
c:\windows\system32\sprt_ads.dll DllStart [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
c:\program files\Fichiers communs\Real\Update_OB\realsched.exe -osboot [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIModeChange]
2001-09-04 14:24	28672	----a-w-	c:\windows\system32\Ati2mdxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
2003-10-28 20:10	335872	----a-w-	c:\ati technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BJCFD]
2003-01-27 16:16	376912	----a-w-	c:\program files\BroadJump\Client Foundation\CFD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-13 18:34	15360	------w-	c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus Photo RX600]
2003-09-11 03:00	99840	----a-w-	c:\windows\system32\spool\drivers\w32x86\3\E_S4I0M2.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2009-09-21 14:36	305440	----a-w-	c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-13 18:34	1695232	----a-w-	c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sonic RecordNow!]
2003-09-11 03:00	99840	----a-w-	c:\windows\system32\spool\drivers\w32x86\3\E_S4I0M2.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
2003-08-14 22:34	57344	-c--a-w-	c:\windows\SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2007-07-12 02:00	132496	-c--a-w-	c:\program files\Java\jre1.6.0_02\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec NetDriver Monitor]
2006-08-22 20:24	111840	-c--a-w-	c:\progra~1\SYMNET~1\SNDMon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager]
2003-08-19 00:01	110592	-c--a-w-	c:\program files\Fichiers communs\Sonic\Update Manager\sgtray.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"=
"c:\WINDOWS\system32\[Emoticons-plus.com] Winkaa 2.0.exe"=
"c:\WINDOWS\system32\spool\drivers\w32x86\3\SAGENT4.EXE"=
"c:\Program Files\Windows Live\Messenger\msnmsgr.exe"=
"c:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"=
"c:\Program Files\Bonjour\mDNSResponder.exe"=
"c:\Program Files\iTunes\iTunes.exe"=
"c:\WINDOWS\PCHealth\HelpCtr\Binaries\helpctr.exe"=
"%windir%\Network Diagnostic\xpnetdiag.exe"=

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [03/12/2009 19:17 28552]
R1 Asapi;Asapi;c:\windows\system32\drivers\asapi.sys [17/03/2004 19:35 11264]
R1 kbfilter;Keyboard Filter Driver;c:\windows\system32\drivers\kbfilter.sys [23/04/2004 17:10 12964]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [17/12/2008 16:16 54752]
R3 EPPSCSIx;Agfa EPPSCSI Driver;c:\windows\system32\drivers\EPPSCAN.sys [29/10/2004 12:04 95336]
S2 FILESpy;FILESpy;\??\c:\program files\Softwin\BitDefender9\filespy.sys --> c:\program files\Softwin\BitDefender9\filespy.sys [?]
.
------- Examen supplémentaire -------
.
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
uStart Page = hxxp://www.google.fr/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = 127.0.0.1
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} - hxxps://secure.gopetslive.com/dev/GoPetsWeb.cab
FF - ProfilePath - c:\documents and settings\patricia\Application Data\Mozilla\Firefox\Profiles\tkt43fh2.default\
FF - prefs.js: browser.search.selectedEngine - Live Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?mkt=fr-FR&FORM=MIMWA5&q=
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa2.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-10 21:36
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'explorer.exe'(2140)
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Heure de fin: 2009-12-10  21:49:12
ComboFix-quarantined-files.txt  2009-12-10 20:49
ComboFix2.txt  2009-12-10 17:30

Avant-CF: 104 648 200 192 octets libres
Après-CF: 104 604 651 520 octets libres

- - End Of File - - 92494F2C169D6F37831FB295C2C45665

mouton72 · Answer

et voici pour super antispyware

SUPERAntiSpyware Scan Log
https://www.superantispyware.com/

Generated 12/11/2009 at 03:38 AM

Application Version : 4.31.1000

Core Rules Database Version : 4356
Trace Rules Database Version: 2202

Scan type       : Complete Scan
Total Scan Time : 05:30:40

Memory items scanned      : 459
Memory threats detected   : 0
Registry items scanned    : 6933
Registry threats detected : 8
File items scanned        : 66369
File threats detected     : 91

Adware.Tracking Cookie
	C:\Documents and Settings\patricia\Cookies\patricia@atdmt[1].txt
	C:\Documents and Settings\patricia\Cookies\patricia@serving-sys[3].txt
	C:\Documents and Settings\patricia\Cookies\patricia@specificclick[1].txt
	C:\Documents and Settings\patricia\Cookies\patricia@mediaplex[1].txt
	C:\Documents and Settings\patricia\Cookies\patricia@bs.serving-sys[1].txt
	C:\Documents and Settings\patricia\Cookies\patricia@msnportal.112.2o7[1].txt
	C:\Documents and Settings\patricia\Cookies\patricia@doubleclick[1].txt
	C:\Documents and Settings\patricia\Cookies\patricia@tradedoubler[3].txt
	C:\Documents and Settings\patricia\Cookies\patricia@adviva[1].txt
	C:\Documents and Settings\patricia\Cookies\patricia@atdmt[2].txt
	C:\Documents and Settings\Invité\Cookies\invité@247realmedia[1].txt
	C:\Documents and Settings\Invité\Cookies\invité@2o7[2].txt
	C:\Documents and Settings\Invité\Cookies\invité@ad.yieldmanager[2].txt
	C:\Documents and Settings\Invité\Cookies\invité@ad.zanox[1].txt
	C:\Documents and Settings\Invité\Cookies\invité@adrevolver[2].txt
	C:\Documents and Settings\Invité\Cookies\invité@adtech[2].txt
	C:\Documents and Settings\Invité\Cookies\invité@advertising[2].txt
	C:\Documents and Settings\Invité\Cookies\invité@atdmt[1].txt
	C:\Documents and Settings\Invité\Cookies\invité@bluestreak[2].txt
	C:\Documents and Settings\Invité\Cookies\invité@boursoramabanque.solution.weborama[2].txt
	C:\Documents and Settings\Invité\Cookies\invité@bs.serving-sys[2].txt
	C:\Documents and Settings\Invité\Cookies\invité@cetelem.solution.weborama[2].txt
	C:\Documents and Settings\Invité\Cookies\invité@cnam.solution.weborama[2].txt
	C:\Documents and Settings\Invité\Cookies\invité@consolidationwindowsfrie8.solution.weborama[2].txt
	C:\Documents and Settings\Invité\Cookies\invité@doubleclick[1].txt
	C:\Documents and Settings\Invité\Cookies\invité@exoclick[2].txt
	C:\Documents and Settings\Invité\Cookies\invité@fleshfinder[2].txt
	C:\Documents and Settings\Invité\Cookies\invité@himedia.individuad[2].txt
	C:\Documents and Settings\Invité\Cookies\invité@ie8audience.solution.weborama[1].txt
	C:\Documents and Settings\Invité\Cookies\invité@media.adrevolver[1].txt
	C:\Documents and Settings\Invité\Cookies\invité@mediaplex[1].txt
	C:\Documents and Settings\Invité\Cookies\invité@microsoftinternetexplorer.112.2o7[1].txt
	C:\Documents and Settings\Invité\Cookies\invité@msnportal.112.2o7[1].txt
	C:\Documents and Settings\Invité\Cookies\invité@mypornmotion[1].txt
	C:\Documents and Settings\Invité\Cookies\invité@serving-sys[2].txt
	C:\Documents and Settings\Invité\Cookies\invité@smartadserver[1].txt
	C:\Documents and Settings\Invité\Cookies\invité@statse.webtrendslive[1].txt
	C:\Documents and Settings\Invité\Cookies\invité@tradedoubler[1].txt
	C:\Documents and Settings\Invité\Cookies\invité@virginmobile.solution.weborama[2].txt
	C:\Documents and Settings\Invité\Cookies\invité@weborama[1].txt
	C:\Documents and Settings\Invité\Cookies\invité@www.pornattitude[2].txt
	C:\Documents and Settings\Invité\Cookies\invité@xiti[1].txt
	C:\Documents and Settings\Invité\Cookies\invité@zanox[1].txt
	C:\Documents and Settings\Invité\Cookies\invité@zedo[1].txt
	C:\Documents and Settings\patricia\Cookies\patricia@atwola[2].txt
	C:\Documents and Settings\patricia\Cookies\patricia@atwola[3].txt
	C:\Documents and Settings\patricia\Cookies\patricia@bluestreak[1].txt
	C:\Documents and Settings\patricia\Cookies\patricia@bluestreak[2].txt
	C:\Documents and Settings\patricia\Cookies\patricia@bs.serving-sys[2].txt
	C:\Documents and Settings\patricia\Cookies\patricia@eas4.emediate[2].txt
	C:\Documents and Settings\patricia\Cookies\patricia@kelpromo.solution.weborama[2].txt
	C:\Documents and Settings\patricia\Cookies\patricia@questionmarket[1].txt
	C:\Documents and Settings\patricia\Cookies\patricia@serving-sys[2].txt
	C:\Documents and Settings\patricia\Cookies\patricia@smartadserver[2].txt
	C:\Documents and Settings\patricia\Cookies\patricia@smartadserver[3].txt
	C:\Documents and Settings\patricia\Cookies\patricia@statse.webtrendslive[2].txt
	C:\Documents and Settings\patricia\Cookies\patricia@tacoda[1].txt
	C:\Documents and Settings\patricia\Cookies\patricia@tacoda[3].txt
	C:\Documents and Settings\patricia\Cookies\patricia@tradedoubler[2].txt
	C:\Documents and Settings	ony\Cookies	ony@247realmedia[2].txt
	C:\Documents and Settings	ony\Cookies	ony@2o7[2].txt
	C:\Documents and Settings	ony\Cookies	ony@ad.yieldmanager[1].txt
	C:\Documents and Settings	ony\Cookies	ony@ad.zanox[1].txt
	C:\Documents and Settings	ony\Cookies	ony@adrevolver[2].txt
	C:\Documents and Settings	ony\Cookies	ony@adserver.aol[2].txt
	C:\Documents and Settings	ony\Cookies	ony@adtech[2].txt
	C:\Documents and Settings	ony\Cookies	ony@advertising[2].txt
	C:\Documents and Settings	ony\Cookies	ony@advertstream[2].txt
	C:\Documents and Settings	ony\Cookies	ony@atdmt[1].txt
	C:\Documents and Settings	ony\Cookies	ony@bluestreak[1].txt
	C:\Documents and Settings	ony\Cookies	ony@cdiscount[2].txt
	C:\Documents and Settings	ony\Cookies	ony@consolidationwindowsfrie8.solution.weborama[2].txt
	C:\Documents and Settings	ony\Cookies	ony@doubleclick[1].txt
	C:\Documents and Settings	ony\Cookies	ony@fastclick[1].txt
	C:\Documents and Settings	ony\Cookies	ony@fl01.ct2.comclick[2].txt
	C:\Documents and Settings	ony\Cookies	ony@fr.at.atwola[1].txt
	C:\Documents and Settings	ony\Cookies	ony@ie8audience.solution.weborama[1].txt
	C:\Documents and Settings	ony\Cookies	ony@media.adrevolver[1].txt
	C:\Documents and Settings	ony\Cookies	ony@microsoftinternetexplorer.112.2o7[1].txt
	C:\Documents and Settings	ony\Cookies	ony@msnportal.112.2o7[1].txt
	C:\Documents and Settings	ony\Cookies	ony@smartadserver[2].txt
	C:\Documents and Settings	ony\Cookies	ony@statcounter[1].txt
	C:\Documents and Settings	ony\Cookies	ony@tradedoubler[2].txt
	C:\Documents and Settings	ony\Cookies	ony@weba.cdiscount[1].txt
	C:\Documents and Settings	ony\Cookies	ony@weborama[2].txt
	C:\Documents and Settings	ony\Cookies	ony@windowslivemessenger.solution.weborama[1].txt
	C:\Documents and Settings	ony\Cookies	ony@ww57.smartadserver[2].txt
	C:\Documents and Settings	ony\Cookies	ony@www.cdiscount[1].txt
	C:\Documents and Settings	ony\Cookies	ony@www.smartadserver[2].txt
	C:\Documents and Settings	ony\Cookies	ony@www3.smartadserver[1].txt
	C:\Documents and Settings	ony\Cookies	ony@xiti[1].txt

Registry Cleaner Trial
	HKCR\Install.Install
	HKCR\Install.Install\CLSID
	HKCR\Install.Install\CurVer
	HKCR\Install.Install.1
	HKCR\Install.Install.1\CLSID

Adware.180solutions/Seekmo
	HKCR\AppId\SeekmoSA_df.exe
	HKCR\AppId\SeekmoSA_df.exe#AppID

Adware.UpMedia/SearchTool
	HKU\S-1-5-21-925099772-242501028-509977922-1008\Software\UptownInstaller



pour malewarebytes oui je l'ai,d'ailleurs j'en ai passé un scan complet avant et il a trouvé 261 fichiers infectés.

gen-hackman · Answer

salut jfk ^^

salut mouton , j'ai cru que tu t'y etais encore mis dedans ....!!   lol

jfkpresident · Answer

Salut Gen ;)

Télécharge Toolbar-S&D (Team IDN) sur ton Bureau.
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cpVobGk5bHnxrhQ4yaoEUDJvOYNnEGyYjgqHZz5GqZLfutR3fMFPlsC3-CGIilfupPAguYATNyua3csodN_frdMK8sSzUpit10Yac-QJCOkMqJKkbdKcP6ySs8trWPgoNVIq4TGGWCe6o0txXQv-ZueJF9vZzw3RXsGwFYIqN2lvF2LPdQzS8mE1d5kWOVOz6EMzQuE5-lClSJM869uq3oc7-t7yg%3D%3D&attredirects=3

* Lance l'installation du programme en exécutant le fichier téléchargé.
* Double-clique maintenant sur le raccourci de Toolbar-S&D.
* Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.
* Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche.
* Poste le rapport généré. (C:\TB.txt)

mouton72 · Answer

salut a toi gen-hackman,c'est encore des amis qui sont pas au courant qu'il faut un antivirus avant d'aller sur le net,alors le resultat est là!!! mdr
slt jfk,me revoilà apres une dure journée de boulot,je te post le rapport toolbar-s&d


   -----------\  ToolBar S&D 1.2.9   XP/Vista

   Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
   X86-based PC ( Uniprocessor Free : AMD Athlon(tm) XP 2800+ )
   BIOS : Phoenix - AwardBIOS v6.00PG
   USER : patricia ( Administrator )
   BOOT : Normal boot
   Antivirus : AntiVir Desktop 9.0.1.32 (Activated)
   C:\ (Local Disk) - NTFS - Total:145 Go (Free:97 Go)
   D:\ (CD or DVD)
   E:\ (CD or DVD)
   I:\ (USB)
   J:\ (USB)

   "C:\ToolBar SD" ( MAJ : 22-08-2009|18:42 )
   Option : [1] ( 11/12/2009|12:57 )

   -----------\  Recherche de Fichiers / Dossiers ...

   C:\Program Files\Dcads Games Collection
   C:\Program Files\Dcads Games Collection\BattlesOfHelicopters.exe
   C:\Program Files\Dcads Games Collection\BobAndBill.exe
   C:\Program Files\Dcads Games Collection\CrazyBlocks.exe
   C:\Program Files\Dcads Games Collection\Lines.exe
   C:\Program Files\Dcads Games Collection\uninstall.exe
   C:\Program Files\Dcads Games Collection\VideoPool.exe
   C:\DOCUME~1\patricia\MENUDM~1\PROGRA~1\Dcads Games Collection
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-06-11-19-04-49
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-06-19-17-46-20
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-06-22-19-37-57
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-07-02-13-29-02
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-07-26-20-19-50
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-08-08-14-18-07
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-08-20-19-44-53
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-08-21-19-58-12
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-08-27-20-56-16
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-13-55-25
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-14-33-54
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-05-06-17-02
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-19-15-44-43
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-27-16-10-17
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-30-19-06-19
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-10-03-20-34-44
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-10-11-19-49-34
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-10-20-19-08-26
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-10-24-20-18-14
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-10-26-09-26-05
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-10-28-20-26-17
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-10-28-20-33-09
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-11-01-11-01-57
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-11-05-12-27-19
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-11-05-20-27-15
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\about.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\action.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\adventures_of_robinson_crusoe16x16.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\alabama_smith16x16.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\arcade.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\blood_ties16x16.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\buy.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\cards.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\deals.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\download.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\dream_chronicles16x16.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\dream_chronicles_216x16.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\escape_rosecliff_island16x16.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\feedback.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\help.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\herods_lost_tomb16x16.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\highlight.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\jigsaw.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\kids.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\laura_jones16x16.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\mahjong.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\mygames.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\mystery_of_unicorn_castle16x16.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\my_kingdom_for_the_princess16x16.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar
ewGames.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\oberonconfig.xm_
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\obSearchHistory.dat
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\partner.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\party_down16x16.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\popup_off.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\popup_on.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\pure_hidden16x16.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\puzzle.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBaranch_rush16x16.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\search.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\secrets-of-great-art16x16.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\sendafriend.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\sports.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\sprill16x16.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar	rial.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\uninstall.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\update.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-07-26-20-19-50\about.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-07-26-20-19-50\feedback.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-07-26-20-19-50\help.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-07-26-20-19-50\highlight.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-07-26-20-19-50\partner.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-07-26-20-19-50\popup_off.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-07-26-20-19-50\popup_on.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-07-26-20-19-50\search.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-07-26-20-19-50\sendafriend.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-07-26-20-19-50\uninstall.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-07-26-20-19-50\update.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-13-55-25\about.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-13-55-25\action.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-13-55-25\AliceGreenfingers16x16.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-13-55-25\arcade.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-13-55-25\Azada16x16.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-13-55-25\battleship16x16.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-13-55-25\ChickRush_deluxe16x16.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-13-55-25\Chromadrome_216x16.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-13-55-25\chroma_crash16x16.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-13-55-25\death_nile16x16.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-13-55-25\download.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-13-55-25\feedback.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-13-55-25\help.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-13-55-25\highlight.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-13-55-25\mahjong_quest_216x16.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-13-55-25\MCF_raven16x16.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-13-55-25
ewGames.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-13-55-25\partner.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-13-55-25\popup_off.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-13-55-25\popup_on.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-13-55-25\search.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-13-55-25\sendafriend.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-13-55-25\snapshot_adventures16x16.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-13-55-25	he_apprentice_LA16x16.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-13-55-25	urbo_pizza16x16.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-13-55-25\uninstall.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-13-55-25\update.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-14-33-54\about.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-14-33-54\Azada16x16.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-14-33-54\battleship16x16.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-14-33-54\ChickRush_deluxe16x16.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-14-33-54\Chromadrome_216x16.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-14-33-54\chroma_crash16x16.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-14-33-54\death_nile16x16.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-14-33-54\download.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-14-33-54\feedback.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-14-33-54\help.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-14-33-54\highlight.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-14-33-54\mahjong_quest_216x16.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-14-33-54
ewGames.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-14-33-54\partner.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-14-33-54\popup_off.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-14-33-54\popup_on.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-14-33-54\search.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-14-33-54\sendafriend.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-14-33-54\snapshot_adventures16x16.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-14-33-54	he_apprentice_LA16x16.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-14-33-54\uninstall.gif
   C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-14-33-54\update.gif
   C:\Program Files\GamesBar
   C:\Program Files\GamesBar\Localization-French.ini
   C:\Program Files\GamesBar\Localization2-French.ini
   C:\Program Files\GamesBar\OBGet.exe
   C:\Program Files\GamesBar\search.bin
   C:\Program Files\GamesBar\uninst.exe
   C:\DOCUME~1\ALLUSE~1\MENUDÉ~1\PROGRA~1\GamesBar
   C:\WINDOWS\iun6002.exe

   -----------\  Extensions

   (patricia) - {20a82645-c095-46ed-80e3-08825760534b} => chrome_user


   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Local Page"="C:\WINDOWS\system32\blank.htm"
   "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
   "SearchMigratedDefaultURL"="https://search.yahoo.com/web{searchTerms}&ei=utf-8&fr=b1ie7"
   "Start Page"="https://www.google.fr/?gws_rd=ssl"
   "Url"="http://www.microsoft.com/athome/community/rss.xml"
   "Url"="http://rss.msn.com/en-us/?feedoutput=rss&ocid=iehrs&unsub=true"
   "Url"="http://www.microsoft.com/atwork/community/rss.xml"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Local Page"="C:\WINDOWS\system32\blank.htm"
   "Start Page"="https://www.msn.com/fr-fr/?ocid=iehp"


   --------------------\  Recherche d'autres infections


   Aucune autre infection trouvée  !


   1 - "C:\ToolBar SD\TB_1.txt" - 11/12/2009|12:59 - Option : [1]

   -----------\  Fin du rapport a 12:59:09,15

jfkpresident · Answer

Relance Toolbar-S&D en double-cliquant sur le raccourci. Tape sur "2" puis valide en appuyant sur "Entrée".
! Ne ferme pas la fenêtre lors de la suppression !
Un rapport sera généré, poste son contenu ici.

Ensuite recolle moi un nouveau log RSIT .

mouton72 · Answer

ok,de suite chef lol

mouton72 · Answer

voici voici


   -----------\  ToolBar S&D 1.2.9   XP/Vista

   Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
   X86-based PC ( Uniprocessor Free : AMD Athlon(tm) XP 2800+ )
   BIOS : Phoenix - AwardBIOS v6.00PG
   USER : patricia ( Administrator )
   BOOT : Normal boot
   Antivirus : AntiVir Desktop 9.0.1.32 (Activated)
   C:\ (Local Disk) - NTFS - Total:145 Go (Free:97 Go)
   D:\ (CD or DVD)
   E:\ (CD or DVD)
   I:\ (USB)
   J:\ (USB)

   "C:\ToolBar SD" ( MAJ : 22-08-2009|18:42 )
   Option : [2] ( 11/12/2009|18:04 )

   -----------\ SUPPRESSION

   Supprime! - C:\Program Files\Dcads Games Collection\BattlesOfHelicopters.exe
   Supprime! - C:\Program Files\Dcads Games Collection\BobAndBill.exe
   Supprime! - C:\Program Files\Dcads Games Collection\CrazyBlocks.exe
   Supprime! - C:\Program Files\Dcads Games Collection\Lines.exe
   Supprime! - C:\Program Files\Dcads Games Collection\uninstall.exe
   Supprime! - C:\Program Files\Dcads Games Collection\VideoPool.exe
   Supprime! - C:\DOCUME~1\patricia\MENUDM~1\PROGRA~1\Dcads Games Collection
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-06-11-19-04-49
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-06-19-17-46-20
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-06-22-19-37-57
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-07-02-13-29-02
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-07-26-20-19-50
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-08-08-14-18-07
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-08-20-19-44-53
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-08-21-19-58-12
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-08-27-20-56-16
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-13-55-25
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-02-14-33-54
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-05-06-17-02
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-19-15-44-43
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-27-16-10-17
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-09-30-19-06-19
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-10-03-20-34-44
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-10-11-19-49-34
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-10-20-19-08-26
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-10-24-20-18-14
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-10-26-09-26-05
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-10-28-20-26-17
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-10-28-20-33-09
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-11-01-11-01-57
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-11-05-12-27-19
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\07-11-05-20-27-15
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\about.gif
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\action.gif
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\adventures_of_robinson_crusoe16x16.gif
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\alabama_smith16x16.gif
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\arcade.gif
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\blood_ties16x16.gif
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\buy.gif
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\cards.gif
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\deals.gif
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\download.gif
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\dream_chronicles16x16.gif
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\dream_chronicles_216x16.gif
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\escape_rosecliff_island16x16.gif
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\feedback.gif
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\help.gif
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\herods_lost_tomb16x16.gif
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\highlight.gif
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\jigsaw.gif
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\kids.gif
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\laura_jones16x16.gif
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\mahjong.gif
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\mygames.gif
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\mystery_of_unicorn_castle16x16.gif
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\my_kingdom_for_the_princess16x16.gif
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar
ewGames.gif
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\oberonconfig.xm_
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\obSearchHistory.dat
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\partner.gif
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\party_down16x16.gif
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\popup_off.gif
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\popup_on.gif
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\pure_hidden16x16.gif
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\puzzle.gif
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBaranch_rush16x16.gif
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\search.gif
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\secrets-of-great-art16x16.gif
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\sendafriend.gif
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\sports.gif
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\sprill16x16.gif
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar	rial.gif
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\uninstall.gif
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar\update.gif
   Supprime! - C:\Program Files\GamesBar\Localization-French.ini
   Supprime! - C:\Program Files\GamesBar\Localization2-French.ini
   Supprime! - C:\Program Files\GamesBar\OBGet.exe
   Supprime! - C:\Program Files\GamesBar\search.bin
   Supprime! - C:\Program Files\GamesBar\uninst.exe
   Supprime! - C:\DOCUME~1\ALLUSE~1\MENUDÉ~1\PROGRA~1\GamesBar
   Supprime! - C:\WINDOWS\iun6002.exe
   Supprime! - C:\Program Files\Dcads Games Collection
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\GamesBar
   Supprime! - C:\Program Files\GamesBar

   -----------\  Recherche de Fichiers / Dossiers ...


   -----------\  Extensions

   (patricia) - {20a82645-c095-46ed-80e3-08825760534b} => chrome_user


   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Local Page"="C:\WINDOWS\system32\blank.htm"
   "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
   "SearchMigratedDefaultURL"="https://search.yahoo.com/web{searchTerms}&ei=utf-8&fr=b1ie7"
   "Start Page"="https://www.google.fr/?gws_rd=ssl"
   "Url"="http://www.microsoft.com/athome/community/rss.xml"
   "Url"="http://rss.msn.com/en-us/?feedoutput=rss&ocid=iehrs&unsub=true"
   "Url"="http://www.microsoft.com/atwork/community/rss.xml"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Local Page"="C:\WINDOWS\system32\blank.htm"
   "Start Page"="https://www.msn.com/fr-fr/"


   --------------------\  Recherche d'autres infections


   Aucune autre infection trouvée  !


   1 - "C:\ToolBar SD\TB_1.txt" - 11/12/2009|12:59 - Option : [1]
   2 - "C:\ToolBar SD\TB_2.txt" - 11/12/2009|18:10 - Option : [2]

   -----------\  Fin du rapport a 18:10:21,46

mouton72 · Answer

bon je vais debrancher ce pc pour remettre le mien,je vais quand meme me connecter sur le forum pour voir ce que tu dis par rapport a mon dernier post,si le pc est ok ou si il y a encore des petites manip a faire.deja merci pour tous tes conseils.

jfkpresident · Answer

Je t'ai également demandé un nouveau log RSIT ..........^^

mouton72 · Answer

desolé,je viens de le voir,bon là le pc est eteins,je ferais ça demain matin,mais il reste encore beaucoup de taf ou pas?

jfkpresident · Answer

mais il reste encore beaucoup de taf ou pas?

Je te dirais ça quand le log sera posté ...C'est d'ailleurs pour cette raison que je t'en demande un de plus -;)

mouton72 · Answer

slt jfk,me voilà reveillé,je te metsle rapport rsit

Logfile of random's system information tool 1.06 (written by random/random)
Run by patricia at 2009-12-12 09:40:49
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 100 GB (67%) free of 149 GB
Total RAM: 255 MB (45% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:41:15, on 12/12/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Google\Update\1.2.183.13\GoogleCrashHandler.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\SuperCopier2\SuperCopier2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Documents and Settings\patricia\Bureau\RSIT.exe
C:\Program Files	rend micro\patricia.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - Default URLSearchHook is missing
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_5_7_0.dll (file missing)
O2 - BHO: Shareaza Web Download Hook - {0EEDB912-C5FA-486F-8334-57288578C627} - C:\Program Files\Shareaza\Plugins\RazaWebHook.dll (file missing)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Windows Live Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_5_7_0.dll (file missing)
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe" -osboot
O4 - HKLM\..\Run: [fssui] "C:\Program Files\Windows Live\Family Safety\fsui.exe" -autorun
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: {0246ECA8-996F-11D1-BE2F-00A0C9037DFE} (TDServer Control) - http://encyclo.voila.fr/JS/tdserver.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/PhtPkMSN.cab
O16 - DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
O23 - Service: Service Google Update (gupdate1c9a4cfa00fc686) (gupdate1c9a4cfa00fc686) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H+H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

gen-hackman · Answer

hello : Total RAM: 255 MB (45% free)

mouton72 · Answer

salut gen,oui je sais bien que la RAM est vraiment un peu juste,je leur ai justement dit d'acheter une barette de 1G?des qu'ils l'ont je leur installe,là le pc rame vraiment de trop.
sinon là j'attends que jfk me dise si c'est ok ou pas.

gen-hackman · Answer

mets 2 Go

mouton72 · Answer

carrement??
je leur dirais alors,deja ils auront 1G,je leur dirait d'en racheter une seconde.

gen-hackman · Answer

moi j ai 3 Go sur XP^^


tu me diras , on peut pas mettre plus (32 bits)

mouton72 · Answer

avec 3Go ton pc doit tourner comme une formule 1,moi sur le mien j'ai 1go et je trouve qu'il marche bien.mais je vais bientot passer a seven,alors quelques modifs de mon pc vont s'imposer un peu,dont la RAM

gen-hackman · Answer

lol

mouton72 · Answer

pour jfk:
cet apres midi je ne suis pas dispo,mais laisse moi quand meme un message pour me dire ce qu'il en est,et ce soir je me mettrais dessus.bon apres-midi

jfkpresident · Answer

Pour ce qui est de la RAM ,il faut voir avec la carte mere ce qu'elle supporte ... ?

Télécharge OTM de OldTimer sur ton Bureau en cliquant sur ce lien :

http://www.geekstogo.com/forum/files/file/402-otm-oldtimers-move-it/

Double-clique sur OTMoveIt3.exe pour le lancer.

Vérifie que la case devant "Unregister Dll's and Ocx's est bien cochée.

Copie la liste qui se trouve en gras ci-dessous,

et colle-la dans le cadre de gauche de OTMoveIt : "Paste instructions for item to be moved".


:processes
explorer.exe

:files
C:\WINDOWS\system32\sprt_ads.dll DllStart 
:services

:commands
[purity]
[emptytemp]
[start explorer]
[reboot]



Clique sur "MoveIt!" pour lancer la suppression.

Le résultat apparaitra dans le cadre "Results".

Clique sur "Exit" pour fermer.

Poste le rapport situé dans C:\_OTMoveIt\MovedFiles sous le nom xxxxxx_xxxxxxxxxx.log .

Il te sera peut-être demander de redémarrer le pc pour achever la suppression. Si c'est le cas accepte par Yes.

==========================================

Télécharge Navilog1 (par IL-MAFIOSO) sur ton bureau

http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe

Enregistrer la cible (du lien) sous... et enregistre-le sur ton bureau.
Ensuite double clique sur navilog1.exe pour lancer l'installation.
Une fois l'installation terminée, double-clique sur le raccourci Navilog1 présent sur le bureau.

Laisse-toi guider. Appuie sur une touche quand on te le demande.
Au menu principal, choisis 1 et valide.

Patiente le temps du scan. Il te sera peut-être demandé de redémarrer ton PC.
Laisse l'outil le faire automatiquement, sinon redémarre ton PC normalement s'il te le demande.

Patiente jusqu'au message "Scan terminé le......"
Appuie sur une touche comme demandé ; le bloc-notes va s'ouvrir.
Copie-colle l'intégralité dans ta réponse. Referme le bloc-notes.

PS : le rapport est, aussi, sauvegardé à la racine du disque dur C:\cleannavi.txt

gen-hackman · Answer

?

mouton72 · Answer

pourkoi gen tu mets un point d'interrogation??

mouton72 · Answer

voici pour otm

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== FILES ==========
File/Folder C:\WINDOWS\system32\sprt_ads.dll DllStart not found.
========== SERVICES/DRIVERS ==========
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes
 
User: Documents and Settings
 
User: Invité
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 78991 bytes
 
User: justine
 
User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 111826 bytes
 
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: patricia
->Temp folder emptied: 4662 bytes
->Temporary Internet Files folder emptied: 14946942 bytes
->Java cache emptied: 13960070 bytes
->FireFox cache emptied: 43401019 bytes
 
User: Propriétaire
 
User: tiffany
 
User: tony
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 78991 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 235705 bytes
%systemroot%\System32 .tmp files removed: 3072 bytes
Windows Temp folder emptied: 16384 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 42275 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 69,57 mb
 
 
OTM by OldTimer - Version 3.1.2.2 log created on 12122009_210008

Files moved on Reboot...

Registry entries deleted on Reboot...

mouton72 · Answer

et voici pour navilog

Fix Navipromo version 4.0.5 commencé le 12/12/2009 21:22:34,67

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!

Outil exécuté depuis C:\Program Files
avilog1

Mise à jour le 10.11.2009 à 18h00 par IL-MAFIOSO

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : AMD Athlon(tm) XP 2800+ )
BIOS : Phoenix - AwardBIOS v6.00PG
USER : patricia ( Administrator )
BOOT : Normal boot

Antivirus : AntiVir Desktop 9.0.1.32 (Activated)


C:\ (Local Disk) - NTFS - Total:145 Go (Free:97 Go)
D:\ (CD or DVD)
E:\ (CD or DVD)
I:\ (USB)
J:\ (USB)


Recherche executée en mode normal 


[b]Aucune Infection Navipromo/Egdaccess trouvée[/b]



*** Scan terminé 12/12/2009 21:23:19,00 ***

jfkpresident · Answer

Pourkoi gen tu mets un point d'interrogation??

Gen se demandait surement pourquoi je faisais passer Navilog ....A cause de ceci : eyurarydv  mais en oubliant que combofix avait déja été passé .....:(

Fais un scan en ligne Kaspersky avec Internet Explorer.
- Clique sur Démarrer Online-Scanner

- Clique maintenant sur J'accepte.
- Valide l'installation d'un ou de plusieurs ActiveX si c'est nécessaire.
- Patiente pendant l'installation des Mises à jour.
- Choisis par la suite l'analyse du Poste de travail.
- Sauvegarde puis colle le rapport généré en fin d'analyse.

AIDE : Configurer le contrôle des ActiveX

NOTE : Si tu reçois le message "La licence de Kaspersky On-line Scanner est périmée", va dans Ajout/Suppression de programmes puis désinstalle On-Line Scanner, reconnecte toi sur le site de Kaspersky pour retenter le scan en ligne.

mouton72 · Answer

je ne peux pas faire le scan en ligne,leur service est en cours de réactualisation!!

jfkpresident · Answer

Essaye celui ci : https://www.eset.com/

gen-hackman · Answer

oui et le point d'interrogation etait aussi pour le nom que tu as mis a la dll ^^ dans le script XD

jfkpresident · Answer

Oui et le point d'interrogation etait aussi pour le nom que tu as mis a la dll ^^ dans le script XD 

Oupss...Oui le copier/coller n'était pas parfait :( J'avais meme pas fait gaffe ...

mouton72 · Answer

bonsoir,me revoilà,desolé pour mon absence.
bon je viens de faire le scan en ligne de nod32,il a trouvé une infection mais je ne vois pas si il est possible de voir le rapport!!!

mouton72 · Answer

bon il faut que je rammenne le pc chez ses proprio,en tout cas il fonctionne bien pour le moment,je prendrais des nouvelles pour savoir si il n'y a plus de soucis ,merci pour ton coup de main jfk.
a bientot.au fait pour supprimer tous les outils de desinfection c'est tools cleaner je crois?

jfkpresident · Answer

Pour supprimer toutes les traces des logiciels qui ont servi à traiter les infections spécifiques : 

· Télécharge ToolsCleaner de A.Roshtein sur ton Bureau.
http://pc-system.fr/
· Clique sur Recherche et laisse le scan se terminer.
· Clique, sur Suppression pour finaliser.
· Tu peux, si tu le souhaites, te servir des Options facultatives.
· Clique sur Quitter, pour que le rapport puisse se créer.
· Poste moi le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur( C:\).

mouton72 · Answer

slt,je viens de voir ton message mais j'ai deja ramené le pc,en tout cas j'ai bien tout verifier,plus aucun programme de desinfections ne restent.j'ai aussi verifier toutes mises a jour,etc...
je te remercies beaucoup de ton aide precieuse.

jfkpresident · Answer

je te remercies beaucoup de ton aide precieuse.

De rien ,tu peux mettre en "résolu" .

@+

Grosse infection

49 réponses

Discussions similaires

Newsletters