Problème virus

############################## | UsbFix V6.075 |

User : White (Administrateurs) # MONTANA
Update on 19/01/2010 by El Desaparecido , C_XX & Chimay8
Start at: 15:39:09 | 20/01/2010
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com

Intel(R) Core(TM)2 CPU T5200 @ 1.60GHz
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 8.0.6001.18702
Windows Firewall Status : Disabled
AV : avast! antivirus 4.8.1368 [VPS 100120-0] 4.8.1368 [ Enabled | Updated ]
FW : Norton Internet Worm Protection[ (!) Disabled ]2006
FW : ZoneAlarm Firewall[ Enabled ]7.0.483.000

C:\ -> Disque fixe local # 102,6 Go (13,38 Go free) # NTFS
D:\ -> Disque fixe local # 8,17 Go (1,33 Go free) [PRESARIO_RP] # NTFS
E:\ -> Disque CD-ROM
F:\ -> Disque amovible # 245,6 Mo (20,2 Mo free) # FAT

############################## | Active processes |

C:\WINDOWS\System32\smss.exe 948
C:\WINDOWS\system32\csrss.exe 1000
C:\WINDOWS\system32\winlogon.exe 1024
C:\WINDOWS\system32\services.exe 1068
C:\WINDOWS\system32\lsass.exe 1080
C:\WINDOWS\system32\svchost.exe 1244
C:\WINDOWS\system32\svchost.exe 1320
C:\WINDOWS\System32\svchost.exe 1360
C:\WINDOWS\system32\svchost.exe 1400
C:\WINDOWS\system32\svchost.exe 1488
C:\WINDOWS\system32\svchost.exe 1548
C:\WINDOWS\system32\ZoneLabs\vsmon.exe 1656
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe 460
C:\Program Files\Alwil Software\Avast4\ashServ.exe 564
C:\WINDOWS\Explorer.EXE 720
C:\WINDOWS\system32\spoolsv.exe 1544
C:\WINDOWS\system32\svchost.exe 1744
C:\WINDOWS\system32\msdtc.exe 1800
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe 1884
C:\Program Files\Bonjour\mDNSResponder.exe 1900
C:\WINDOWS\eHome\ehRecvr.exe 1868
C:\WINDOWS\eHome\ehSched.exe 1220
C:\Program Files\FolderSize\FolderSizeSvc.exe 236
C:\WINDOWS\System32\svchost.exe 256
C:\WINDOWS\eHome\ehRec.exe 764
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe 824
C:\Program Files\PostgreSQL\8.3\bin\pg_ctl.exe 1872
C:\WINDOWS\system32\svchost.exe 2112
C:\Program Files\PostgreSQL\8.3\bin\postgres.exe 2276
C:\WINDOWS\system32\svchost.exe 2316
C:\WINDOWS\ehome\mcrdsvc.exe 2448
C:\Program Files\Alwil Software\Avast4\setup\avast.setup 2488
C:\WINDOWS\system32\mqsvc.exe 2504
C:\Program Files\Windows Media Player\wmpnetwk.exe 2684
C:\Program Files\PostgreSQL\8.3\bin\postgres.exe 2692
C:\WINDOWS\system32\wuauclt.exe 2720
C:\Program Files\PostgreSQL\8.3\bin\postgres.exe 2824
C:\Program Files\PostgreSQL\8.3\bin\postgres.exe 2840
C:\Program Files\PostgreSQL\8.3\bin\postgres.exe 2848
C:\Program Files\PostgreSQL\8.3\bin\postgres.exe 2860
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe 2936
C:\WINDOWS\system32\mqtgsvc.exe 3064
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe 3164
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe 3284
C:\WINDOWS\system32\dllhost.exe 3420
C:\WINDOWS\system32\wbem\wmiprvse.exe 3428
C:\WINDOWS\System32\alg.exe 3824

################## | Files # Infected Folders |

Deleted ! C:\Recycler\S-1-5-21-3897304816-3976979405-3766308848-1005
Deleted ! C:\Recycler\S-1-5-21-541084180-722766645-3241532592-1005
Deleted ! D:\Recycler\S-1-5-21-541084180-722766645-3241532592-1005
Deleted ! F:\adober.exe

################## | Registry # Infected Keys |

################## | Registry # Mountpoints2 |

Deleted ! HKCU\...\Explorer\MountPoints2\{807bbb87-a462-11de-a40b-0018de5c0cba}\Shell\AutoRun\Command

################## | Listing of the present files |

[12/01/2009 23:12|--a------|2091] C:\AD-report-Clean-12.01.2009.log
[14/01/2010 21:24|--a------|6491] C:\Ad-Report-CLEAN[1].log
[12/01/2009 22:31|--a------|1876] C:\AD-report-Scan-12.01.2009.log
[29/12/2009 15:13|--a------|3951] C:\Ad-Report-SCAN[1].log
[06/01/2010 18:49|--a------|3994] C:\Ad-Report-SCAN[2].log
[08/01/2010 14:12|--a------|4037] C:\Ad-Report-SCAN[3].log
[19/10/2009 20:08|-rahs----|209] C:\boot.ini
[25/03/2006 05:00|-rahs----|4952] C:\Bootfont.bin
[12/01/2009 22:10|--a------|4235] C:\cleannavi.txt
[12/01/2009 19:26|--a------|4104] C:\fixnavi.txt
[?|?|?] C:\hiberfil.sys
[22/03/2009 22:55|--a------|5417] C:\hlw.exe
[22/03/2009 22:56|--a------|5417] C:\hlws.exe
[20/01/2010 14:52|--a------|1141] C:\hpqp.ini
[06/04/2008 18:42|-rahs----|0] C:\IO.SYS
[06/04/2008 18:42|-rahs----|0] C:\MSDOS.SYS
[25/03/2006 05:00|-rahs----|47564] C:\ntdetect.com
[04/10/2008 18:34|-rahs----|252240] C:\ntldr
[29/02/2004 16:44|--a------|52576] C:\orange.bmp
[?|?|?] C:\pagefile.sys
[24/03/2009 13:07|--a------|5057] C:\pert.exe
[15/11/2007 00:01|--a------|4102] C:\PokerStars.log.0
[08/01/2008 17:46|--a------|192767] C:\rapport.txt
[28/11/2008 02:16|--a------|212480] C:\sarko.dll
[03/02/2008 19:28|--a------|90] C:\Setup.log
[13/01/2010 12:15|--a------|5535] C:\updatedatfix.log
[20/01/2010 15:46|--a------|4941] C:\UsbFix.txt
[20/01/2010 12:40|--a------|44] C:\XP_TV.ini
[22/05/2006 06:17|--a------|719917056] D:\Forrest Gump.avi
[27/10/2008 13:02|--a------|727472128] D:\Juno (2007).avi
[27/03/2004 15:43|--a------|728008752] D:\La Cite de dieu.AVI
[12/11/2008 02:14|--a------|734863360] D:\La Fille Seule de Benoit Jacquot avec Virginie Ledoyen, Benoit Magimel, Aladin Reibel 1995.avi
[21/04/2009 14:50|--a------|733978624] D:\La terre vue du ciel Le Film Photos comment‚es de Yann Arthus-Bertrand et mise en Musique.avi
[06/01/2008 08:40|--a------|732182190] D:\Le Samourai (1967) Alain Delon Jean-Pierre Melville.avi
[09/04/2009 00:31|--a------|733966336] D:\Les anges exterminateurs de J-Cl-Brisseau (2006).avi
[07/10/2008 17:57|--a------|727287808] D:\Les Tontons Flingueurs - Excellente qualit‚.avi
[25/04/2009 05:00|--a------|735257898] D:\Million Dollar Baby de Clint Eastwood vostfr.avi
[01/10/2007 19:08|--a------|731009024] D:\ratatouille.avi
[24/11/2009 19:28|--a------|287767] F:\freakonomics.rtf
[26/11/2009 12:12|--a------|33231] F:\reverse factoeing flowchart.docx
[26/11/2009 13:41|--a------|57979] F:\partieanthony.docx
[27/11/2009 16:58|--ah-----|4096] F:\._.Trashes
[23/06/2009 13:41|---hs----|348160] F:\msvcr71.dll
[24/11/2009 19:44|--a------|1090560] F:\Dossier Final Merch NHU.doc
[27/11/2009 17:17|--ah-----|4136] F:\._Dossier Final Merch NHU.doc
[12/10/2009 18:05|--a------|39424] F:\Probl‚matique_du_M‚moire_2009-2010.doc
[03/12/2009 20:50|--a------|71680] F:\CAS DE NEGOCIATION INTERNATIONALE VA IPAG.doc
[27/11/2009 17:21|--a------|42867] F:\plan masse merch.xlsx
[27/11/2009 17:21|--ah-----|4096] F:\._plan masse merch.xlsx
[07/12/2009 14:59|--a------|10495] F:\EMA Tomate.docx
[27/11/2009 18:42|--a------|48364] F:\plans merchandising lin‚aires.xlsx
[27/11/2009 18:42|--ah-----|4096] F:\._plans merchandising lin‚aires.xlsx
[09/12/2009 17:32|--a------|361472] F:\IPAG__INTERNATIONAL_NEGOTIATION.ppt
[09/12/2009 17:33|--ah-----|4096] F:\._IPAG__INTERNATIONAL_NEGOTIATION.ppt
[10/11/2009 12:19|--a------|43520] F:\Lalogisti...doc
[09/12/2009 17:38|--ah-----|4096] F:\._CAS NEGO GREG ANTHO.doc
[10/12/2009 19:04|--a------|10707] F:\Sales spitch.docx
[09/12/2009 23:49|--a------|74752] F:\CAS NEGO GREG ANTHO.doc
[10/12/2009 19:04|--a------|13171] F:\Commercial purposal n 45235.docx
[14/12/2009 17:47|--a------|4011577] F:\FONCTION_ACHAT-_APPROVISIONNEMENT[1].pdf
[15/12/2009 00:31|--a------|377344] F:\pptanglaisTF.ppt
[08/12/2009 14:32|--a------|44544] F:\Marketing direct et promotion des ventes.doc
[16/12/2009 16:55|--ah-----|4096] F:\._Marketing direct et promotion des ventes.doc
[17/12/2009 12:10|--a------|91865] F:\M‚moire instruments financiers internationaux.docx
[17/12/2009 12:02|--ah-----|4096] F:\._M‚moire instruments financiers internationaux.docx
[28/12/2009 22:50|--a------|11047] F:\r‚siliation bail.docx

################## | Vaccination |

# C:\autorun.inf -> Folder created by UsbFix.
# D:\autorun.inf -> Folder created by UsbFix.
# F:\autorun.inf -> Folder created by UsbFix.

################## | Upload |

Please send the file : C:\DOCUME~1\White\Bureau\UsbFix_Upload_Me_MONTANA.zip : https://www.ionos.fr/?affiliate_id=77097
Thank you for your contribution .

################## | ! End of report # UsbFix V6.075 ! |

Ok, :

/!\ Utilisateur de vista et windows 7 : ne pas oublier de désactiver Le contrôle des comptes utilisateurs
https://www.commentcamarche.net/faq/8343-vista-desactiver-l-uac

>Usbfix<

>Télécharge USBFIX de Chiquitine29, C_xx ici :

http://pagesperso-orange.fr/NosTools/Chiquitine29/UsbFix.exe

>/!\ Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) susceptible d'avoir été infectées sans les ouvrir

> Double clic sur le raccourci UsbFix présent sur le bureau .

>Choisir l'option 2 (Supression) et laisser travailler l'outil

Ensuite poste le rapport UsbFix.txt qui apparaîtra.

• Note : Le rapport UsbFix.txt est sauvegardé a la racine du disque. ( C:\UsbFix.txt )

• Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.

• Tuto : http://pagesperso-orange.fr/NosTools/usbfix.html

re,

voici l'ancien topic

c bon j'ai retéléchargé le logiciel, voici le rapport:

Logfile of random's system information tool 1.06 (written by random/random)
Run by White at 2010-01-15 14:31:47
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 16 GB (15%) free of 105 GB
Total RAM: 1014 MB (27% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:32:02, on 15/01/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\FolderSize\FolderSizeSvc.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\X'nBeep 1.1\XnBeep.exe
C:\WINDOWS\system32\mqsvc.exe
C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Internet Explorer\iexplore.exe
c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\White\Bureau\RSIT.exe
C:\Program Files\HijackThis\White.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.microsoft.com/fwlink/?linkid=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {00000000-6E41-4FD3-8538-502F5495E5FC} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Mega Manager IE Click Monitor - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Program Files\Megaupload\Mega Manager\MegaIEMn.dll (file missing)
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: MEDIADICO Familial - {CEDDA62B-5FBE-4AB2-AE2E-5E069F444444} - C:\Program Files\MEDIADICO\MDToolbar\MdToolbar.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [X'nBeep] C:\Program Files\X'nBeep 1.1\XnBeep.exe
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-21-541084180-722766645-3241532592-1006\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'postgres')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: adsl TV.LNK = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Liens de téléchargement avec Mega Manager... - C:\Program Files\Megaupload\Mega Manager\mm_file.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Program Files\PokerStars.NET\PokerStarsUpdate.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/...
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} -
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {87AF076E-D86D-4E87-ADDD-F05804E1F150} - https://www.virginmega.fr/DownloadManager/Release/Prod/DownMan.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Folder Size (FolderSize) - Brio - C:\Program Files\FolderSize\FolderSizeSvc.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: PostgreSQL Database Server 8.3 (pgsql-8.3) - PostgreSQL Global Development Group - C:\Program Files\PostgreSQL\8.3\bin\pg_ctl.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

dsl mais RSIT ne fct pas "application WIN32 non valide

Ok,

Supprimes ces cracks ( vecteur d'infections ) :

C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\ZlobKeyGenerator.zip
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\ZlobKeyGenerator1.zip
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\ZlobKeyGenerator2.zip
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\ZlobKeyGenerator3.zip
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\ZlobKeyGenerator4.zip

Puis :

>Telecharge RSIT ici et enregistre-le sur ton bureau :

http://images.malwareremoval.com/random/RSIT.exe

>Double-clique sur RSIT.exe qui se trouve sur le bureau

>Le programme se lance, choisi "1month" et clique sur "continue"

>Laisse faire l'outil et poste le rapport qui s'affiche.

>Voici un tuto d'aide :

https://forum.pcastuces.com/randoms_system_information_tool_rsit-f31s31.htm

Voici le scan ad remover:

.
======= RAPPORT D'AD-REMOVER 1.1.4.6_F | UNIQUEMENT XP/VISTA/7 =======
.
Mit à jour par C_XX le 26.12.2009 à 20:47
Contact: AdRemover.contact@gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Lancé à: 21:11:08, 14/01/2010 | Mode Normal | Option: CLEAN
Exécuté de: C:\Program Files\Ad-Remover\
Système d'exploitation: Microsoft® Windows XP™ Service Pack 3 v5.1.2600
Nom du PC: MONTANA | Utilisateur actuel: White

Bonnes fêtes de fin d'année à vous tous :)
.
============== ÉLÉMENT(S) NEUTRALISÉ(S) ==============
.
Service: WinSvc

C:\WINDOWS\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
C:\DOCUME~1\White\APPLIC~1\Microsoft\Internet Explorer\Quick Launch\Titan Poker.lnk
C:\DOCUME~1\White\LOCALS~1\Temp\AskSearch
C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job
C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\Titan Poker
C:\Program Files\Ask.com
C:\Program Files\PartyGaming
C:\Program Files\Winsudate
C:\Documents and Settings\White\Local Settings\Application Data\AskToolbar
C:\DOCUME~1\White\Bureau\Music\Installation de PartyPoker.lnk
C:\DOCUME~1\White\Bureau\Music\PartyPoker.lnk

(!) -- Fichiers temporaires supprimés.

.
HKCU\software\appdatalow\AskBarDis
HKCU\software\appdatalow\AskHomepage
HKCU\software\appdatalow\AskToolbarInfo
HKCU\software\Ask.com
HKCU\software\AskToolbar
HKCU\software\fcn
HKCU\software\Grand Virtual
HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
HKCU\software\microsoft\internet explorer\searchscopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440}
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\WinUsr
HKCU\software\PartyGaming
HKCU\software\Titan Poker
HKLM\Software\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
HKLM\software\classes\appid\GenericAskToolbar.DLL
HKLM\Software\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
HKLM\Software\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
HKLM\software\classes\GenericAskToolbar.ToolbarWnd
HKLM\software\classes\GenericAskToolbar.ToolbarWnd.1
HKLM\software\classes\installer\Products\A28B4D68DEBAA244EB686953B7074FEF
HKLM\Software\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
HKLM\Software\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
HKLM\Software\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
HKLM\Software\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
HKLM\Software\Microsoft\Internet Explorer\Extensions\{49783ED4-258D-4f9f-BE11-137C18D3E543}
HKLM\Software\Microsoft\Internet Explorer\Extensions\{B7FE5D70-9AA2-40F1-9C6B-12A255F085E1}
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
HKLM\Software\Microsoft\Internet Explorer\Toolbar\\{D4027C7F-154A-4066-A1AD-4243D8127440}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\741B4ADF27276464790022C965AB6DA8
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\7DE196B10195F5647A2B21B761F3DE01
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\9D4F5849367142E4685ED8C25E44C5ED
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\A5875B04372C19545BEB90D4D606C472
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\A876D9E80B896EC44A8620248CC79296
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\B66FFAB725B92594C986DE826A867888
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
HKLM\software\Titan Poker
HKLM\SYSTEM\ControlSet003\Services\winsvc
.
============== Scan additionnel ==============
.
.
* Internet Explorer Version 8.0.6001.18702 *
.
[HKEY_CURRENT_USER\..\Internet Explorer\Main]
.
Do404Search: 01000000
Local Page: C:\WINDOWS\system32\blank.htm
Show_ToolBar: yes
Start Page: hxxp://fr.msn.com/
Enable Browser Extensions: yes
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Use Search Asst: no
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Start Page Redirect Cache: hxxp://fr.msn.com/?ocid=iehp
Start Page Redirect Cache_TIMESTAMP: 5cf020e88f67ca01
Start Page Redirect Cache AcceptLangs: fr
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]
.
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Delete_Temp_Files_On_Exit: yes
Local Page: C:\WINDOWS\system32\blank.htm
Start Page: hxxp://fr.msn.com/
Search bar: hxxp://search.msn.com/spbasic.htm
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]
.
Tabs: res://ieframe.dll/tabswelcome.htm
.
============== Suspect (Cracks, Serials, ...) ==============
.
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\ZlobKeyGenerator.zip
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\ZlobKeyGenerator1.zip
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\ZlobKeyGenerator2.zip
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\ZlobKeyGenerator3.zip
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\ZlobKeyGenerator4.zip
.
===================================
.
2091 Octet(s) - C:\AD-report-Clean-12.01.2009.log
5945 Octet(s) - C:\Ad-Report-CLEAN[1].log
1876 Octet(s) - C:\AD-report-Scan-12.01.2009.log
3951 Octet(s) - C:\Ad-Report-SCAN[1].log
3994 Octet(s) - C:\Ad-Report-SCAN[2].log
4037 Octet(s) - C:\Ad-Report-SCAN[3].log
.
2 Fichier(s) - C:\DOCUME~1\White\LOCALS~1\Temp
2 Fichier(s) - C:\WINDOWS\Temp
8 Fichier(s) - C:\WINDOWS\Prefetch
.
22 Fichier(s) - C:\Program Files\Ad-Remover\BACKUP
454 Fichier(s) - C:\Program Files\Ad-Remover\QUARANTINE
.
Fin à: 21:24:32 | 14/01/2010 - CLEAN[1]
.
============== E.O.F ==============
.

ok je vais faire ca

Bonjour, :

1-Relance Ad-Remover :

Pour les ordinateurs équipés de Windows Vista et Windows 7, la désactivation du Contrôle des comptes utilisateurs est obligatoire
sous peine de ne pas pouvoir faire fonctionner correctement l'outil.
Tuto : https://www.commentcamarche.net/faq/8343-vista-desactiver-l-uac

>Ad-Remover<

>Désactive ton antivirus le temps de la manip
>Déconnecte-toi d'Internet et ferme toutes applications en cours
>Double-clique sur le programme d'installation, installe-le dans son emplacement par défaut (C:\Program Files).
>Au menu principal, choisis l'option L ( Nettoyage )
>Poste le rapport généré (C:\Ad-Report-CLEAN.log).
>N'oublie pas de réactiver ton anti-virus