Avast est bloque

Salut isa31360

Bien de rien, je te donne quelques consignes de sécurité :

- Windows Update parfaitement à jour http://www.windowsupdate.com/windowsupdate/v6/default.aspx (catégories critique, Services Pack et Services Release)
- pare-feu bien paramétré, je te conseil ZoneAlarm :
https://www.malekal.com/tutoriel-zonealarm-firewall/
- antivirus bien paramétré et mis à jour régulièrement (quotidiennement s'il le faut) avec un scan complet régulier (journalier s'il le faut).
- une attitude prudente vis à vis de la navigation (pas de sites douteux : cracks, warez, sexe...) et vis à vis de la messagerie (fichiers joints aux messages doivent être scannés avant d'être ouverts)
- pas de téléchargement illégal, qui est le principal facteur d’infection (µTorrent, BitTorrent, eMule, Limewire, etc..) http://forum.malekal.com/ftopic893.php
- une attitude vigilante (être à l'affût d'un fonctionnement inhabituel de son système)
- nettoyage hebdomadaire du système (suppression des fichiers inutiles, nettoyage de la base de registre, scandisk, defrag)
- scan hebdomadaire antispyware, je conseil MalwareByte's Anti-Malware :
https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
- un contrôle régulier de la console JAVA pour s'assurer qu'elle est à jour :
https://www.java.com/en/download/uninstalltool.jsp
- faire régulièrement un scan de vulnérabilités afin de vérifier que tes logiciels soit à jour sans failles de sécurités :
https://www.malekal.com/tester-la-vulnerabilite-de-son-systeme-2/

De bonne lecture si tu veux en savoir plus sur la sécurité et le fonctionnement de Windows :
http://www.malekal.com/menu_windows_general.php
http://www.malekal.com/menu_windows_securite.php

Si tu considères ton problème comme résolu, tu pourras mettre en résolu :
https://www.commentcamarche.net/infos/25917-marquer-un-fil-de-discussion-comme-etant-resolu/

Bonne journée/soirée et bon surf

@++ :)

[ Rapport ToolsCleaner version 2.3.11 (par A.Rothstein & dj QUIOU) ]

--> Recherche:

C:\Rsit: trouvé !
C:\Ad-remover: trouvé !
C:\Documents and Settings\vande\Mes documents\VIRUS\Rsit.exe: trouvé !
C:\Program Files\trend micro\HijackThis.exe: trouvé !
C:\Program Files\trend micro\hijackthis.log: trouvé !

---------------------------------
--> Suppression:

C:\Program Files\trend micro\HijackThis.exe: supprimé !
C:\Documents and Settings\vande\Mes documents\VIRUS\Rsit.exe: supprimé !
C:\Program Files\trend micro\hijackthis.log: supprimé !
C:\Rsit: supprimé !
C:\Ad-remover: supprimé !

tout a été effectué et vérifié et apparemment c'est OK ; merci encore

Salut isa31360

Non pas nécessaire un scan a chaque démarrage, pour des raisons de sécurité et surtout pour garder ton PC propre, on va désactiver la restauration système sur tous les lecteurs :

- Clique droit sur le Poste de travail sur le bureau, dans propriété tu cliques sur l'onglet Restauration système

- Coche la case désactiver la restauration et applique

Redémarre l’ordinateur et réactive la restauration système.

Tutoriel XP : http://www.libellules.ch/desactiver_restauration.php

-----

On va faire un ménage des outils téléchargés pour la désinfection, télécharge Tools Cleaner sur le bureau :

http://pc-system.fr/

- Double clique sur ToolsCleaner2.exe sur le bureau
- Clique sur Recherche et laisse le scan agir.
- Clique sur Suppression pour finaliser.
- Tu peux, si tu le souhaites, te servir des Options facultatives.
- Clique sur Quitter pour obtenir le rapport.
- Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).
- Si des outils restes après le passage de Tools Cleaner, tu pourras les supprimer manuellement ainsi que tous les rapports qui on été généré lors de la désinfection.

-----

Important de mettre à jour Windows et tes logiciels :
Mettre Windows(catégories critique, Services Pack et Services Release) à jour : http://www.windowsupdate.com/windowsupdate/v6/default.aspx

Faire un scan de vulnérabilités afin de vérifier que tes logiciels soit à jour sans failles de sécurités et mettre à jour :
https://www.malekal.com/tester-la-vulnerabilite-de-son-systeme-2/

Faire un ménage des fichiers inutiles et de la base de registre :
https://www.malekal.com/tutoriel-ccleaner/

Dis moi quand cela est fais où si tu as des soucis et on passe à la résolution du sujet par la suite.

@++ :)

encore merci pour ton aide précieuse ; enfin débarassée de ses virus ! ouf ! sinon pour l'instant je n'ai pas d'autres problèmes mais une question : est ce que je dois faire un scan à chaque allumage de mon ordi ?
Merci encore

Salut isa31360

Ton rapport est propre, as-tu d'autre souci?

@++ :)

Salut isa31360

Le scan effectué n'est pas complet et effectué en mode normal.

Mettre à jour Antivir, faire un scan en mode sans échec et poste le rapport après avoir démarré en mode normal.

Aide : https://www.malekal.com/avira-free-security-antivirus-gratuit/

@++ :)

Salut isa31360

Désactive la restauration système sur tous les lecteurs :

- Clique droit sur le Poste de travail sur le bureau, dans propriété tu cliques sur l'onglet Restauration système

- Coche la case désactiver la restauration et applique

Redémarre l’ordinateur et réactive la restauration système.

Tutoriel XP : http://www.libellules.ch/desactiver_restauration.php

Tutoriel Vista : https://www.commentcamarche.net/faq/13214-vista-desactiver-reactiver-la-restauration-systeme-de-vista

Refais un scan avec Antivir pour vérification

@++ :)

Salut isa31360

Je te conseil Antivir en français, voir ce lien :
http://forum.malekal.com/ftopic3528.php

On va vérifier si rien de caché :
Faire un scan avec Nod32 en ligne (il faut utiliser Internet Explorer) ici :

https://www.eset.com/int/home/online-scanner/

(coche toutes les cases à chaque fois)
A la fin, colle le rapport : C:\Program Files\EsetOnlineScanner\log.txt

@++ :)

salut dédétraqué,
Entre nos échanges et en continuant la dernière procédure du 26 janvier 2010 , j'ai réussi à désinstaller la version d'AVAST que j'avais et installée la dernière (version 5 gratuite) ; et finalement AVAST m'a tout supprimé ;
merci en tout cas pour ton aide précieuse et je voudrai avoir un avis de spécialiste : que penses tu de la dernière version d'AVAST gratuit ? dois-je prendre et acheter (ça m'arrange pas) la version PRO ?
bonne soirée

Salut isa31360

Connais-tu ce dossier : C:\FyK

Double clique sur le raccourci d'HijackThis sur ton Bureau, clique sur Do a scan system only coche la case devant la(les) ligne(s) suivante(s) si présente(s)
Si pas de raccourci sur le bureau, il ce trouve ici :
C:\Program Files\trend micro\vande.exe

O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\RunOnce: [Iminent.Notifier Install] "C:\DOCUME~1\vande\LOCALS~1\Temp\NotifierSetup.exe" /s
O4 - HKUS\S-1-5-21-746137067-329068152-1177238915-1004\..\RunOnce: [Iminent.Notifier Install] "C:\DOCUME~1\vande\LOCALS~1\Temp\NotifierSetup.exe" /s (User '?')
O4 - HKUS\S-1-5-18\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" (User '?')
O4 - HKUS\.DEFAULT\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" (User 'Default user')
O4 - Global Startup: BTTray.lnk = ?

- Ferme les fenêtres en cours sauf HijackThis, clique sur Fix checked

- Quitte HijackThis

-----

Télécharge OTM (de Old_Timer) sur le bureau :

http://www.geekstogo.com/forum/files/file/402-otm-oldtimers-move-it/

Double-clique sur OTM.exe sur le bureau

- Copie le texte qui se trouve en gras ci-dessous et colle le dans le cadre de gauche de OTM nommé Paste Instructions for Items to be Moved

:processes

:services
fcachdll32

:reg
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpywareCleaner]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Documents and Settings\vande\Local Settings\Temp\~tmp\mdnk24\mdm.exe"=-
"C:\Documents and Settings\vande\Local Settings\Temp\~tmp\mdnk25\mdm.exe"=-

:files
C:\WINDOWS\system32\fcachdll32.dll
C:\Documents and Settings\vande\Local Settings\Temp\~tmp

:commands
[purity]
[emptytemp]
[reboot]

- Clique sur MoveIt! pour lancer la suppression.
- Ferme OTM

Ton PC va redémarrer pour finir la suppression, si il ne le fais pas lui-même, redémarre le.

Poste le rapport de OTMoveIt qui se trouve dans C:\_OTM\MovedFiles.

@++ :)

Bonjour dédétraqué,
voici la dernière vérification faite :

Logfile of random's system information tool 1.06 (written by random/random)
Run by vande at 2010-01-26 18:09:31
WIN_XP Service Pack 3
System drive C: has 11 GB (29%) free of 38 GB
Total RAM: 503 MB (56% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:09:51, on 26/01/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\PDF Complete\pdfsvc.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Documents and Settings\vande\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\vande\Bureau\VIRUS\RSIT.exe
C:\Program Files\trend micro\vande.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.microsoft.com/fwlink/?linkid=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Alice ADSL
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: myBabylon English Toolbar - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - C:\Program Files\myBabylon_English\tbmyB1.dll
O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SetRefresh] C:\Program Files\COMPAQ\SetRefresh\\SetRefresh.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\RunOnce: [Iminent.Notifier Install] "C:\DOCUME~1\vande\LOCALS~1\Temp\NotifierSetup.exe" /s
O4 - HKUS\S-1-5-21-746137067-329068152-1177238915-1004\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '?')
O4 - HKUS\S-1-5-21-746137067-329068152-1177238915-1004\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" (User '?')
O4 - HKUS\S-1-5-21-746137067-329068152-1177238915-1004\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (User '?')
O4 - HKUS\S-1-5-21-746137067-329068152-1177238915-1004\..\RunOnce: [Iminent.Notifier Install] "C:\DOCUME~1\vande\LOCALS~1\Temp\NotifierSetup.exe" /s (User '?')
O4 - HKUS\S-1-5-18\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" (User '?')
O4 - HKUS\.DEFAULT\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" (User 'Default user')
O4 - S-1-5-21-746137067-329068152-1177238915-1004 Startup: Notification de cadeaux MSN.lnk = C:\Documents and Settings\vande\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe (User '?')
O4 - Startup: Notification de cadeaux MSN.lnk = C:\Documents and Settings\vande\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Event Reminder.lnk = C:\Program Files\Broderbund\PrintMaster\PMremind.exe
O8 - Extra context menu item: Barre RoboForm - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Enregistrer le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: Envoyer au périphérique &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Envoyer à Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
O8 - Extra context menu item: Personnaliser le menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Remplir le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: Translate with &Babylon - res://C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
O9 - Extra button: Remplir - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Remplir le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Enregistrer - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Enregistrer le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://wanadoofr.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx2.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: PDF Document Manager (pdfcDispatcher) - PDF Complete Inc - C:\Program Files\PDF Complete\pdfsvc.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe

Salut isa31360

Un ptite dernière vérification :
Refais un scan avec RSIT et poste le rapport log.txt seulement à la fin de l’analyse

Le rapport est dans le dossier ici C:\rsit

@++ :)

.
======= RAPPORT D'AD-REMOVER 1.1.4.6_I | UNIQUEMENT XP/VISTA/7 =======
.
Mis à jour par C_XX le 24.01.2010 à 14:33
Contact: AdRemover.contact@gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Lancé à: 13:07:12, 25/01/2010 | Mode Normal | Option: CLEAN
Exécuté de: C:\Ad-Remover\
Système d'exploitation: Microsoft® Windows XP™ Service Pack 3 v5.1.2600
Nom du PC: VANDE-08D1ADFE6 | Utilisateur actuel: vande
.
============== ÉLÉMENT(S) NEUTRALISÉ(S) ==============
.

C:\WINDOWS\Installer\{CFA9C824-A778-47EB-90CD-BB4DB82CF348}
C:\WINDOWS\Installer\{E1B94435-241E-4519-B1C3-C4DD9EB352A2}
C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\IMBooster
C:\Program Files\EoRezo
C:\Program Files\Iminent
C:\Program Files\SweetIM
C:\DOCUME~1\vande\APPLIC~1\EoRezo
C:\DOCUME~1\vande\APPLIC~1\ItsLabel
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Iminent
C:\DOCUME~1\ALLUSE~1\APPLIC~1\SweetIM
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Trymedia
C:\Documents and Settings\vande\Local Settings\Application Data\Iminent
C:\Windows\Installer\184a670.msi
C:\Windows\Installer\33893c.msi

(!) -- Fichiers temporaires supprimés.

.
HKCU\software\EoRezo
HKCU\software\Iminent
HKCU\software\microsoft\internet explorer\searchscopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{4B3803EA-5230-4DC3-A7FC-33638F3D3542}
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{BC4FFE41-DE9F-46FA-B455-AAD49B9F9938}
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1A0AADCD-3A72-4B5F-900F-E3BB5A838E2A}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BC4FFE41-DE9F-46fa-B455-AAD49B9F9938}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
HKCU\software\SWEETIE
HKCU\software\SweetIM
HKLM\software\AskBarDis
HKLM\Software\Classes\CLSID\{696E3174-4F6C-4777-7834-654C4A705677}
HKLM\Software\Classes\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}
HKLM\Software\Classes\CLSID\{84FF7BD6-B47F-46F8-9130-01B2696B36CB}
HKLM\Software\Classes\CLSID\{A4A0CB15-8465-4F58-A7E5-73084EA2A064}
HKLM\Software\Classes\CLSID\{A6E9BAAF-53CD-4575-967B-2AF710A7D21F}
HKLM\software\classes\IminentBHONavigationError.CHelperBHO
HKLM\software\classes\IminentBHONavigationError.CHelperBHO.1
HKLM\software\classes\IminentLinkToContent.LinkToContent
HKLM\software\classes\IminentLinkToContent.LinkToContent.1
HKLM\software\classes\installer\Products\428C9AFC877ABE7409DCBBD48BC23F84
HKLM\software\classes\installer\Products\53449B1EE14291541B3C4CDDE93B252A
HKLM\software\classes\installer\Products\C73660D04266C3348A703CD454AD1B48
HKLM\Software\Classes\Interface\{0CA97EEE-C8C4-4B10-A332-10AF1FBEB534}
HKLM\Software\Classes\Interface\{12FB9C3D-0875-4CAA-B3B1-9DCCCE749DE5}
HKLM\software\classes\MediaPlayer.GraphicsUtils
HKLM\software\classes\MediaPlayer.GraphicsUtils.1
HKLM\software\classes\MgMediaPlayer.GifAnimator
HKLM\software\classes\MgMediaPlayer.GifAnimator.1
HKLM\Software\Classes\TypeLib\{2C6674DB-EFB5-464A-A715-3E770B9C8A94}
HKLM\Software\Classes\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}
HKLM\Software\Classes\TypeLib\{587D1093-12E0-4B0E-9426-AF9DC5ABB77D}
HKLM\Software\Classes\TypeLib\{77860007-19AE-4C29-B26D-AEA48F3A05C5}
HKLM\software\iAvatars.com
HKLM\software\Iminent
HKLM\software\Loader
HKLM\software\microsoft\internet explorer\searchscopes\{EEE6C360-6118-11DC-9C72-001320C79847}
HKLM\software\microsoft\shared tools\msconfig\startupreg\EoEngine
HKLM\software\microsoft\shared tools\msconfig\startupreg\SoftwareHelper
HKLM\software\microsoft\shared tools\msconfig\startupreg\SweetIM
HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\SearchTheWeb
HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\SweetIM.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{84FF7BD6-B47F-46F8-9130-01B2696B36CB}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A6E9BAAF-53CD-4575-967B-2AF710A7D21F}
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\07D5290CDBDAE4242926B8E6CA650501
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\08E33F7B61DEFF24BB9673ED7D467636
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\0E3D8A5B48622A445A7DF73FEFF32C3F
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\0FF2AEFF45EEA0A48A4B33C1973B6094
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\1AC67655DD68F8240B2860F2D511EBD8
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\34EDDB1BFB3A2D448845F3EFD0F15A43
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\4318DF19719275242801CBE292063A4C
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\45FC115D1FEAEF849A4E1610D6EC8BF0
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\46A5861A389ADB844AF89E31BC9DF0A1
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\49B0E1A6FF50BBE4289E4E23DE6EA0C7
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\4CCCAC049F34D0540AAC13011398BEDB
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\5C4389D0BFB302C479DE4178BD5D9EBA
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\5D19F074C042AD34BAB463D4175A062E
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\5D2B09BDEF4FE54418E6F3373CDBC7AC
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\61B65D3397A1FBF4CB1571B5E4F6B5B0
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\68E8A05C60DD9254591DBD16C94EDDBF
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\697E782CF574CC34CBB9566440BA12BC
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\6AE27A8613CF7EA4782F2886F67295E5
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\7CE172051F585E04187BCB97570BFA74
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\86A901BA5265452499DCBF719C378EE3
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\88ABD1CD5C40EC84789A7F6EF86DAC5E
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\980289C22F80A7C4BB9323DC61255E4E
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\9A4B7EF3789F871419D9302583B20C15
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\A6C53B0F76C44004A8F36716213017DB
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\B59F2D8189784CC46A4597F2842480B0
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\BD746FB95FB8E5B45BF66BE54D5FD91F
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\CCF399FCD6D2D3F46BF02A1378654FC9
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\D149C1355C98DE24E82CEFBD996FE06A
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\DB59FDB786388EA4D897F3EE715683AC
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\DB8DAD19CFBCC2049A4477183787E8C5
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\E337925F629CF4C4FB08F3D9674DD839
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\EC65F200D112357449C8B1BC3CFA03D0
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\F327D0C73C0973644A21E8CC852267A0
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\FA96423FE2B98E248A3B23548D1E22D9
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Products\428C9AFC877ABE7409DCBBD48BC23F84
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Products\53449B1EE14291541B3C4CDDE93B252A
HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Products\C73660D04266C3348A703CD454AD1B48
HKLM\Software\Microsoft\Windows\CurrentVersion\Run-disabled\\IMBooster
HKLM\Software\Microsoft\Windows\CurrentVersion\Run-disabled\\Iminent.Notifier
HKLM\Software\Microsoft\Windows\CurrentVersion\Run-disabled\\SoftwareHelper
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\IMBooster
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\Iminent.Notifier
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\SoftwareHelper
HKLM\software\microsoft\windows\currentversion\uninstall\{0D06637C-6624-433C-A807-C34D45DAB184}
HKLM\software\microsoft\windows\currentversion\uninstall\{CFA9C824-A778-47EB-90CD-BB4DB82CF348}
HKLM\software\microsoft\windows\currentversion\uninstall\{E1B94435-241E-4519-B1C3-C4DD9EB352A2}
HKLM\software\microsoft\windows\currentversion\uninstall\IMBooster
HKLM\software\microsoft\windows\currentversion\uninstall\SearchTheWeb
HKLM\software\SweetIM
HKLM\software\Trymedia Systems
HKU\.default\software\GamesBar
HKU\.default\software\Iminent
.
============== Scan additionnel ==============
.
.
* Internet Explorer Version 8.0.6001.18702 *
.
[HKEY_CURRENT_USER\..\Internet Explorer\Main]
.
Start Page: hxxp://fr.msn.com/
Do404Search: 01000000
Local Page: C:\WINDOWS\system32\blank.htm
Show_ToolBar: yes
Search Bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
SearchAssistant:
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Use Search Asst: no
Enable Browser Extensions: yes
Start Page Redirect Cache: hxxp://fr.msn.com/?ocid=iehp
Start Page Redirect Cache_TIMESTAMP: c8489f6502dbc901
Start Page Redirect Cache AcceptLangs: fr
Default_page_url: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]
.
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Delete_Temp_Files_On_Exit: yes
Local Page: C:\WINDOWS\system32\blank.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://fr.msn.com/
Search bar: hxxp://search.msn.com/spbasic.htm
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]
.
Tabs: res://ieframe.dll/tabswelcome.htm
.
============== Suspect (Cracks, Serials, ...) ==============
.
C:\Documents and Settings\vande\Mes documents\jeux\JEUX\Call of Atlantis Game 2008 Cracked.zip
C:\Documents and Settings\vande\Mes documents\jeux\JEUX\ok\Amazonia\CRACK\Amazonia.exe
C:\Documents and Settings\vande\Mes documents\jeux\JEUX\ok\The Rise of Atlantis Deluxe\Base\Crack\the rise of atlantis.exe
.
===================================
.
11485 Octet(s) - C:\Ad-Report-CLEAN[1].log
.
468 Fichier(s) - C:\DOCUME~1\vande\LOCALS~1\Temp
2 Fichier(s) - C:\WINDOWS\Temp
9 Fichier(s) - C:\WINDOWS\Prefetch
.
16 Fichier(s) - C:\Ad-Remover\BACKUP
596 Fichier(s) - C:\Ad-Remover\QUARANTINE
.
Fin à: 13:13:55 | 25/01/2010 - CLEAN[1]
.
============== E.O.F ==============
.

Salut isa31360

[*]Télécharge AD-Remover (de Cyrildu17 / C_XX) sur ton Bureau.
http://pagesperso-orange.fr/NosTools/C_XX/AD-R.exe

Déconnecte-toi et ferme toutes applications en cours

[*]Double-clique sur le programme d'installation, installe-le dans son emplacement par défaut (C:\Program files).
[*]Double-clique sur l'icône AD-Remover située sur ton Bureau
[*]Au menu principal, choisis l'option L.
[*]Poste le rapport qui apparaît à la fin.

(Le rapport est sauvegardé aussi sous C:\Ad-report(date).log)

(CTRL+A pour tout sélectionner, CTRL+C pour copier et CTRL+V pour coller)

Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus comme une infection, ne pas en tenir compte, il s'agit d'un faux positif, continue la procédure

Aide : https://kerio.probb.fr/t3786-tuto-ad-remover

@++ :)

Logfile of random's system information tool 1.06 (written by random/random)
Run by vande at 2010-01-24 22:20:05
WIN_XP Service Pack 3
System drive C: has 11 GB (29%) free of 38 GB
Total RAM: 503 MB (30% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:20:15, on 24/01/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\oodag.exe
C:\Program Files\PDF Complete\pdfsvc.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Iminent\IMBooster\IMBooster.exe
C:\Program Files\Iminent\SearchTheWeb\Iminent.Notifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Documents and Settings\vande\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\vande\Bureau\VIRUS\RSIT.exe
C:\Program Files\trend micro\vande.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2fwww.msn.fr%2fdajo%3f
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60266
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60266
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://portail.free.fr/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60266
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Alice ADSL
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: CHelperBHO - {84FF7BD6-B47F-46F8-9130-01B2696B36CB} - C:\Program Files\Iminent\SearchTheWeb\Iminent.BHO.NavigationError.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Iminent.LinkToContent - {A6E9BAAF-53CD-4575-967B-2AF710A7D21F} - C:\Program Files\Iminent\IMBooster\Iminent.LinkToContent.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: myBabylon English Toolbar - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - C:\Program Files\myBabylon_English\tbmyB1.dll
O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SetRefresh] C:\Program Files\COMPAQ\SetRefresh\\SetRefresh.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SoftwareHelper] C:\Documents and Settings\vande\Application Data\eoRezo\SoftwareUpdate\SoftwareUpdateHP.exe
O4 - HKLM\..\Run: [IMBooster] C:\Program Files\Iminent\IMBooster\IMBooster.exe /warmup
O4 - HKLM\..\Run: [Iminent.Notifier] C:\Program Files\Iminent\SearchTheWeb\Iminent.Notifier.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\RunOnce: [Iminent.Notifier Install] "C:\DOCUME~1\vande\LOCALS~1\Temp\NotifierSetup.exe" /s
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User '?')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User '?')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User '?')
O4 - HKUS\S-1-5-21-746137067-329068152-1177238915-1004\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '?')
O4 - HKUS\S-1-5-21-746137067-329068152-1177238915-1004\..\RunOnce: [Iminent.Notifier Install] "C:\DOCUME~1\vande\LOCALS~1\Temp\NotifierSetup.exe" /s (User '?')
O4 - HKUS\S-1-5-18\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" (User '?')
O4 - HKUS\.DEFAULT\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" (User 'Default user')
O4 - S-1-5-21-746137067-329068152-1177238915-1004 Startup: Notification de cadeaux MSN.lnk = C:\Documents and Settings\vande\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe (User '?')
O4 - Startup: Notification de cadeaux MSN.lnk = C:\Documents and Settings\vande\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Event Reminder.lnk = C:\Program Files\Broderbund\PrintMaster\PMremind.exe
O8 - Extra context menu item: Barre RoboForm - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Enregistrer le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: Envoyer au périphérique &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Envoyer à Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
O8 - Extra context menu item: Personnaliser le menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Remplir le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: Translate with &Babylon - res://C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
O9 - Extra button: Remplir - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Remplir le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Enregistrer - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Enregistrer le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://wanadoofr.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx2.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: PDF Document Manager (pdfcDispatcher) - PDF Complete Inc - C:\Program Files\PDF Complete\pdfsvc.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe

Salut isa31360

Refais un scan avec RSIT et poste le rapport log.txt seulement à la fin de l’analyse

Le rapport est dans le dossier ici C:\rsit

@++ :)

Malwarebytes' Anti-Malware 1.44
Version de la base de données: 3628
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

24/01/2010 21:15:16
mbam-log-2010-01-24 (21-15-16).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 180632
Temps écoulé: 42 minute(s), 53 second(s)

Processus mémoire infecté(s): 2
Module(s) mémoire infecté(s): 1
Clé(s) du Registre infectée(s): 9
Valeur(s) du Registre infectée(s): 2
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 6
Fichier(s) infecté(s): 22

Processus mémoire infecté(s):
C:\Program Files\Winsudate\gibusr.exe (Adware.Gibmedia) -> Unloaded process successfully.
C:\Program Files\Winsudate\gibsvc.exe (Adware.Gibmedia) -> Unloaded process successfully.

Module(s) mémoire infecté(s):
C:\WINDOWS\system32\fcachdll32.dll (Trojan.Agent) -> Delete on reboot.

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\winsvc (Adware.Gibmedia) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1a93c934-025b-4c3a-b38e-9654a7003239} (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6f282b65-56bf-4bd1-a8b2-a4449a05863d} (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{18cb1a7b-94cd-4582-8022-ada16851e44b} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{2756bad7-2f9f-47ef-ae6d-8d39cceb396f} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{6f282b65-56bf-4bd1-a8b2-a4449a05863d} (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\SoftLand Ltd (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\EoRezo (Rogue.Eorezo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\asc3550p (Rootkit.Agent) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winusr (Adware.Gibmedia) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\forceclassiccontrolpanel (Hijack.ControlPanelStyle) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSMHelp (Hijack.Help) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
C:\Documents and Settings\All Users\Application Data\SoftLand Ltd (Rogue.XPantiVirus) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\SoftLand Ltd\Antivirus 2008 XP (Rogue.XPantiVirus) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\SoftLand Ltd\Antivirus 2008 XP\LOG (Rogue.XPantiVirus) -> Quarantined and deleted successfully.
C:\Program Files\NetPumper (Adware.NetPumper) -> Quarantined and deleted successfully.
C:\Program Files\WinZix (Trojan.Swizzor) -> Quarantined and deleted successfully.
C:\Program Files\Winsudate (Adware.Gibmedia) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\WINDOWS\system32\config\55008270.Evt (Rootkit.Agent.H) -> Quarantined and deleted successfully.
C:\Program Files\Winsudate\gibusr.exe (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\Program Files\Winsudate\gibsvc.exe (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\Program Files\Winsudate\gibcom.dll (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\Program Files\Winsudate\gibidl.dll (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\Program Files\Winsudate\gibupt.exe (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{22D57294-E232-45EC-AC32-79DBB1FB27D5}\RP1\A0000013.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{22D57294-E232-45EC-AC32-79DBB1FB27D5}\RP1\A0000043.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{22D57294-E232-45EC-AC32-79DBB1FB27D5}\RP1\A0000061.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{22D57294-E232-45EC-AC32-79DBB1FB27D5}\RP1\A0000067.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{22D57294-E232-45EC-AC32-79DBB1FB27D5}\RP1\A0000068.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{22D57294-E232-45EC-AC32-79DBB1FB27D5}\RP1\A0000074.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{22D57294-E232-45EC-AC32-79DBB1FB27D5}\RP1\A0000075.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{22D57294-E232-45EC-AC32-79DBB1FB27D5}\RP1\A0000076.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{22D57294-E232-45EC-AC32-79DBB1FB27D5}\RP1\A0000077.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{22D57294-E232-45EC-AC32-79DBB1FB27D5}\RP1\A0000099.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{22D57294-E232-45EC-AC32-79DBB1FB27D5}\RP1\A0000102.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{22D57294-E232-45EC-AC32-79DBB1FB27D5}\RP1\A0000171.exe (Worm.Bagle) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\fcachdll32.dll (Trojan.Agent) -> Delete on reboot.
C:\Documents and Settings\All Users\Application Data\SoftLand Ltd\Antivirus 2008 XP\LOG\20080819144551515.log (Rogue.XPantiVirus) -> Quarantined and deleted successfully.
C:\Documents and Settings\vande\Local Settings\Temporary Internet Files\Step 1 - INF.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\PDFCreator_Toolbar_Uninstaller_4781.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

Salut isa31360

-Télécharge et installe MalwareByte's Anti-Malware
http://www.malwarebytes.org/mbam/program/mbam-setup.exe

- Mets le à jour

---

- Redémarre en mode sans échec :

Au redémarrage de ton PC tapote sur la touche F8 ou F5, sur l'écran suivant déplace toi avec les flèches de direction et choisis Mode sans échec. Choisis ta session habituelle et non la session Administrateur

---

- Double clique sur le raccourci de MalwareByte's Anti-Malware qui est sur le bureau.
- Sélectionne Exécuter un examen complet si ce n'est pas déjà fait
- clique sur Rechercher

- Une fois le scan terminé, une fenêtre s'ouvre, clique sur sur OK

- Si MalwareByte's n'a rien détecté, clique sur OK Un rapport va apparaître ferme-le.

- Si MalwareByte's a détecté des infections, clique sur Afficher les résultats ensuite sur Supprimer la sélection

- Enregistre le rapport sur ton Bureau comme cela il sera plus facile à retrouver, poste ensuite ce rapport.

Note : Si MalwareByte's a besoin de redémarrer pour terminer la suppression, accepte en cliquant sur OK

Tutoriel pour MalwareByte's ici :
https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

@++ :)

Merci beaucoup de m'aider :-)
############################## | FindyKill V5.027 |

# User : vande (Administrateurs) # VANDE-08D1ADFE6
# Update on 21/01/2010 by El Desaparecido
# Start at: 19:27:19 | 24/01/2010
# Website : http://pagesperso-orange.fr/NosTools/index.html
# Contact : FindyKill.Contact@gmail.com

#
#
# Internet Explorer 8.0.6001.18702
# Windows Firewall Status : Enabled

############################## | Processus actifs |

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\SCardSvr.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\oodag.exe
C:\Program Files\PDF Complete\pdfsvc.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Winsudate\gibsvc.exe

################## | C: |

################## | C:\WINDOWS |

Supprimé ! C:\WINDOWS\ban_list.txt
Supprimé ! C:\WINDOWS\system32\ban_list.txt
Supprimé ! C:\WINDOWS\mdelk.exe
Supprimé ! C:\WINDOWS\system32\mdelk.exe
Supprimé ! C:\WINDOWS\wintems.exe
Supprimé ! C:\WINDOWS\system32\wintems.exe

################## | C:\WINDOWS\Prefetch |

Supprimé ! C:\WINDOWS\Prefetch\208828.EXE-2B6E9C31.pf
Supprimé ! C:\WINDOWS\Prefetch\230843.EXE-2760EC90.pf
Supprimé ! C:\WINDOWS\Prefetch\239328.EXE-0EBB7AF2.pf
Supprimé ! C:\WINDOWS\Prefetch\3930968.EXE-00EEA43F.pf
Supprimé ! C:\WINDOWS\Prefetch\3948421.EXE-0FF2863B.pf
Supprimé ! C:\WINDOWS\Prefetch\3956796.EXE-00243193.pf
Supprimé ! C:\WINDOWS\Prefetch\FLEC006.EXE-033D4DFF.pf
Supprimé ! C:\WINDOWS\Prefetch\MDELK.EXE-087EF2B4.pf
Supprimé ! C:\WINDOWS\Prefetch\WINTEMS.EXE-127B61D4.pf
Supprimé ! C:\WINDOWS\Prefetch\WINUPGRO.EXE-07F071F5.pf
Supprimé ! C:\WINDOWS\Prefetch\WINUPGRO.EXE-2D513C93.pf

################## | C:\WINDOWS\system32 |

Supprimé ! C:\WINDOWS\system32\srosa2.sys
Supprimé ! C:\WINDOWS\system32\wfsintwq.sys

################## | C:\WINDOWS\system32\drivers |

Supprimé ! C:\WINDOWS\system32\drivers\downld\126187.exe
Supprimé ! C:\WINDOWS\system32\drivers\downld\164890.exe
Supprimé ! C:\WINDOWS\system32\drivers\downld\196515.exe
Supprimé ! C:\WINDOWS\system32\drivers\downld\202140.exe
Supprimé ! C:\WINDOWS\system32\drivers\downld\209218.exe
Supprimé ! C:\WINDOWS\system32\drivers\downld\257859.exe
Supprimé ! C:\WINDOWS\system32\drivers\downld\303031.exe
Supprimé ! C:\WINDOWS\system32\drivers\downld\308296.exe
Supprimé ! C:\WINDOWS\system32\drivers\downld\320031.exe
Supprimé ! C:\WINDOWS\system32\drivers\downld

################## | C:\Documents and Settings\vande\Application Data |

Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3928406.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3928640.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3928953.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3929156.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3929359.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3930171.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3930968.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3947265.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3947500.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3947734.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3948421.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3955531.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3956171.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3956796.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3958250.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3961890.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3962500.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3962765.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3963000.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3963484.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3963921.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3964531.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3965250.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3965500.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3965750.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3966171.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3966609.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3966843.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3967062.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3967265.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3967468.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3968093.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3968750.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3969078.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3969343.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3969656.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3969968.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3970390.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3970828.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3971640.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3972343.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3972687.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3972968.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3976890.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3978578.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3978921.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3979484.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3979875.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3980250.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3980593.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3980812.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3985171.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3985468.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3985671.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3985859.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3986546.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3987234.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3987890.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3988546.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3988765.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3988984.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3989250.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3992484.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3993765.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3995000.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3995218.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3996500.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3997187.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3997843.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3998453.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3999109.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3999359.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\3999578.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\4000015.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\4000437.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\4000625.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\4000812.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\4001046.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\4001281.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\4001515.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld\4001765.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\downld
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers\winupgro.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\drivers
Supprimé ! C:\Documents and Settings\vande\Application Data\m\data.oct
Supprimé ! C:\Documents and Settings\vande\Application Data\m\flec006.exe
Supprimé ! C:\Documents and Settings\vande\Application Data\m\list.oct
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\1-Box Cafe 3.1.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\3DMark03 2003 v3.2.0.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Active Media Player ScreenSaver v1.26.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Agree Rip DVD to AVI WMV MPEG MP4 Ripper 4.0-key.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\AGUTA PAD Submitter 1.0 keygen.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Anarchie Pro 3.8 for Mac.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Army Builder v2.1.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\AVBSoft BeCrossword v1.0.6 Retail for PocketPC WM5 WM6 by RLYEH.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\BabaUhr v1.0.0.75 GERMAN WinAll by LAXiTY.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Blue Ad Robo 1.0.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Bluefox MP4 to iPod Converter 2.11.09.0527-key.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Boxing Luigi Retail JAVA by RLYEH.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Bricks (1984) (Vincent Bly) FULL!.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Bumper Wars v1.0 [ENGLISH] No-CD Fixed EXE.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Calendar Maker 4.1 for Mac.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Campaign 2000 Enterprise 5.0.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\CDH Media Wizard 2.15 (Serial).zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Chant SpeechKit v4.0.108.0 Incl Keygen by CROSSFiRE.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Chaos Legion PLUS 5 TRAINER by PiZZA.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Charge Meter 4.0.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Cheetah CD Burner 4.14.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Chief Architect v8.05 by UrsusA.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Clean Space v8.61.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Craigslist Notifier 1.2.6.0.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\DesktopX Enhanced 3.1 (Serial).zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Dtop Blizzard Screensaver 1.0.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Easy Mail Objects 4.5.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Easypass Password Generator v2.0.9.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\FlashFXP 1.0 Build 58 (Serial).zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Fortres 101.5.0.1025.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\ForwardMail for System Administrators 3.58.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\GD WinTools.net Professional v9.7.1 by yaser999.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\GolfDog 2.1.0.2.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Hang 2000.1.0.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Haushaltbuchfuehrung 4.1.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\HTML2JPG Enterprise 1.03 (Serial).zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\iBiz 2.4.4 for Mac (Serial).zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Ideal Administration v3.2 US.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\IntelliJ IDEA v5.0.2.3542 MacOSX Incl Keygenerator by TMG.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Japanese Mosaic Puzzles JMPuzzles 1.6.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\JGSScan 2.6.1.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\MavicaZAM! 1.0.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\MaxPump XStream v2.0.204 DoNgLe cRACkED WE ArE bAcK rEad NfO GERMANBUNTSPECHTZ.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Microsoft SQL Server 2000 by AmoK.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Mobile Basic 2.1 build 13213.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Money Password 12.0.9123-key.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\MSG Data Manager v1.5.4.504 by BRD.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\My Schedule 1.75 (crack).zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\MySQL Front v3.1 B11.14.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\NCSS Statistical And Data Analysis v2005.10.24 by diGERATi.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Need for Speed ProStreet v1.1 +1 TRAINER.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\No1 CD Ripper v1.72.60.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\OmniGroup All Products February 2009 for Mac OS X by FFF.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Phone Number v2.2 for PalmOS.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Photo Album Downloader for Yahoo v2.6.1.6 GERMAN Cracked by HERETiC.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Photoshop Interface Assistant v1.8 Incl Keygen And Patch by EXPLOSiON.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Pic Organizer 1.2.0.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Power Translator 97 (Serial).zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Rarlab WinRAR v3.70 Beta 7 Incl DOSRAR Cracked by F4CG.czip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Rarlab WinRAR v3.70 Beta 7 Incl DOSRAR Cracked by F4CG.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Real War Rogue State v1.0 [ENGLISH] No-CD 2.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\reg organizer 2.0 cracked exe by REVENGE.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Registry Genius v2.0 Regged by CFF.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\RemInder 4.01.0012.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Second Menu Java Applet.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Shadow Force SaveGame.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Ship Simulator 2006 by Lz0.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Smart Organizer v1.50 GENERiC Crack by FFF.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Snappy Fax 2000.2.10.2.3.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\SoftReg 4.0 X for Mac.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\SoftSpin Services Mini-Dictionary v1.0 Retail for SymbianOS7 S80 by RLYEH.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\SplitConcat 1.6 for Mac.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\SpongeBob SquarePants Nighty Nightmare UNLOCKER.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Strata VideoShop 4.5 for Mac.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Super Flexible File Synchronizer v3.20.511 by BRD.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\TaskInfo v6.0.1.130 WinAll Cracked by DVT.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Tchart Development GPS Speed Sentry v1.51 Retail for Pocket PC ARM XScale by RLYEH.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\TCPKeyHook v1.4 for Delphi v4 - 5 - 6 - 7.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\The JMaker SlideOnDemandShift v2005.09.14 Incl Keygen by Lz0.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Tiger Woods PGA TOUR 2003 Universal Keygen and Key Changer.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Timer Cafe v3.8.5.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\TrayThis 3.0 build 0631 beta1 (Serial).zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\TweakNow RegCleaner Professional v3.8.1 by ROGUE.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Understand for C Plus Plus v1.4.363b SOLARIS Incl Keygen by Lz0.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Understand for Jovial v1.4.356b LINUX by Lz0.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Understand for Jovial v1.4.380 LINUX Incl Keygen by Lz0.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Viking Invasion v1.0 +1 TRAINER 1.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\VisSie 1.91.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Vokabelmeister 2004.1.7.1 (Serial).zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Web Resume Writer 2.0.15 (Serial).zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Webcam Zone Trigger v1.5 Cracked by F4CG.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\WebZIP 4.0.0 Build 585 (Serial).zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Winm8 4.001.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Wondershare Audio Converter 4.2.0.57 (crack).zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Workgroup Mail 5.0.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\XIII v1.01 [ENGLISH] Fixed Files.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared\Zambo Security 1.0.zip
Supprimé ! C:\Documents and Settings\vande\Application Data\m\shared
Supprimé ! C:\Documents and Settings\vande\Application Data\m\srvlist.oct
Supprimé ! C:\Documents and Settings\vande\Application Data\m

################## | Références de comparaison Bagle MD5 : |

File : C:\Documents and Settings\vande\Application Data\drivers\winupgro.exe
-> Crc32 : 544d99ec | Md5 : 2b9af2fc18d624ddd47f9a7d391f2298

################## | Autres suppressions ... |

Supprimé ! "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
-> Size : 844800 | Crc32 : 544d99ec | Md5 : 2b9af2fc18d624ddd47f9a7d391f2298

################## | Temporary Internet Files |

Supprimé ! C:\Documents and Settings\vande\Local Settings\Temporary Internet Files\Content.IE5\C5EV2TBH\servernames[1].htm
Supprimé ! C:\Documents and Settings\vande\Local Settings\Temporary Internet Files\Content.IE5\CCUYUYSL\mxd[1].jpg
Supprimé ! C:\Documents and Settings\vande\Local Settings\Temporary Internet Files\Content.IE5\IZE28YV0\mxd[1].jpg
Supprimé ! C:\Documents and Settings\vande\Local Settings\Temporary Internet Files\Content.IE5\W425TAUJ\mxd[1].jpg

################## | Registre |

Supprimé ! [HKLM\SYSTEM\ControlSet001\Services\sK9Ou0s]
Supprimé ! [HKLM\SYSTEM\ControlSet003\Services\sK9Ou0s]
Supprimé ! [HKLM\SYSTEM\ControlSet001\Services\srosa]
Supprimé ! [HKLM\SYSTEM\ControlSet003\Services\srosa]
Supprimé ! [HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_SK9OU0S]
Supprimé ! [HKLM\SYSTEM\ControlSet003\Enum\Root\LEGACY_SK9OU0S]
Supprimé ! [HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA]
Supprimé ! [HKCU\Software\bisoft]
Supprimé ! [HKCU\Software\DateTime4]
Supprimé ! [HKCU\Software\MuleAppData]
Supprimé ! [HKCU\Software\WS35]
Supprimé ! [HKCU\Software\WS4001]
Supprimé ! [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] "drvsyskit"
Supprimé ! [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] "eMuleAutoStart"
Supprimé ! [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] "german.exe"
Supprimé ! [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] "mule_st_key"
Supprimé ! [HKCU\Software\Local AppWizard-Generated Applications\winupgro]

################## | Crack > Keygen > Serial |

################## | Etat |

# Mode sans echec restauré !
# Affichage des fichiers cachés restauré !
# Ndisuio -> Start = 3 ( Good = 3 | Bad = 4 )
# EapHost -> Start = 2 ( Good = 2 | Bad = 4 )
# Ip6Fw -> Start = 2 ( Good = 2 | Bad = 4 )
# SharedAccess -> Start = 2 ( Good = 2 | Bad = 4 )
# wuauserv -> Start = 2 ( Good = 2 | Bad = 4 )
# wscsvc -> Start = 2 ( Good = 2 | Bad = 4 )

################## | PEH |

Corrompu : C:\448855acc758dc087ee9d9ae59\mrtstub.exe
[Offset = 000000EC - Valeur = 0x0001]

Corrompu : C:\Documents and Settings\vande\Mes documents\My Downloads\Spybot - Search & Destroy\blindman.exe
[Offset = 00000104 - Valeur = 0x0001]

Corrompu : C:\Documents and Settings\vande\Mes documents\My Downloads\Spybot - Search & Destroy\SpybotSD.exe
[Offset = 00000104 - Valeur = 0x0001]

Corrompu : C:\Documents and Settings\vande\Mes documents\My Downloads\Spybot - Search & Destroy\TeaTimer.exe
[Offset = 00000104 - Valeur = 0x0001]

Corrompu : C:\Documents and Settings\vande\Mes documents\My Downloads\Spybot - Search & Destroy\Update.exe
[Offset = 00000104 - Valeur = 0x0001]

Corrompu : C:\Program Files\Alwil Software\Avast4\ashAvast.exe
[Offset = 0000011C - Valeur = 0x0001]

Corrompu : C:\Program Files\Alwil Software\Avast4\ashChest.exe
[Offset = 0000010C - Valeur = 0x0001]

Corrompu : C:\Program Files\Alwil Software\Avast4\ashDisp.exe
[Offset = 00000124 - Valeur = 0x0001]

Corrompu : C:\Program Files\Alwil Software\Avast4\ashLogV.exe
[Offset = 0000010C - Valeur = 0x0001]

Corrompu : C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
[Offset = 0000010C - Valeur = 0x0001]

Corrompu : C:\Program Files\Alwil Software\Avast4\ashPopWz.exe
[Offset = 0000011C - Valeur = 0x0001]

Corrompu : C:\Program Files\Alwil Software\Avast4\ashQuick.exe
[Offset = 0000011C - Valeur = 0x0001]

Corrompu : C:\Program Files\Alwil Software\Avast4\ashServ.exe
[Offset = 00000124 - Valeur = 0x0001]

Corrompu : C:\Program Files\Alwil Software\Avast4\ashSimp2.exe
[Offset = 0000011C - Valeur = 0x0001]

Corrompu : C:\Program Files\Alwil Software\Avast4\ashSimpl.exe
[Offset = 00000124 - Valeur = 0x0001]

Corrompu : C:\Program Files\Alwil Software\Avast4\ashSkPcc.exe
[Offset = 00000104 - Valeur = 0x0001]

Corrompu : C:\Program Files\Alwil Software\Avast4\ashSkPck.exe
[Offset = 00000114 - Valeur = 0x0001]

Corrompu : C:\Program Files\Alwil Software\Avast4\ashUpd.exe
[Offset = 00000104 - Valeur = 0x0001]

Corrompu : C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
[Offset = 00000114 - Valeur = 0x0001]

Corrompu : C:\Program Files\Alwil Software\Avast4\aswRegSvr.exe
[Offset = 000000D4 - Valeur = 0x0001]

Corrompu : C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
[Offset = 00000114 - Valeur = 0x0001]

Corrompu : C:\Program Files\Alwil Software\Avast4\sched.exe
[Offset = 000000FC - Valeur = 0x0001]

Corrompu : C:\Program Files\Alwil Software\Avast4\VisthLic.exe
[Offset = 0000010C - Valeur = 0x0001]

Corrompu : C:\Program Files\Alwil Software\Avast4\VisthUpd.exe
[Offset = 000000F4 - Valeur = 0x0001]

Corrompu : C:\Program Files\Glary Utilities\uninstaller.exe
[Offset = 00000104 - Valeur = 0x0001]

Corrompu : C:\Program Files\Spybot - Search & Destroy\blindman.exe
[Offset = 00000104 - Valeur = 0x0001]

Corrompu : C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
[Offset = 00000104 - Valeur = 0x0001]

Corrompu : C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
[Offset = 00000104 - Valeur = 0x0001]

Corrompu : C:\Program Files\Spybot - Search & Destroy\Update.exe
[Offset = 00000104 - Valeur = 0x0001]

################## | ! Fin du rapport # FindyKill V5.027 ! |

Salut isa31360

Sur le bureau, relance FindyKill en double-cliquant sur le raccourci.
Au menu principal, choisis l'option 2 : (Suppression)

Il y aura 2 redémarrages du PC.
Laisse-le travailler jusqu'à l’apparition de : "Nettoyage effectué".
Un rapport va s'ouvrir. Copie/colle-le dans ta réponse.

PS : le rapport est aussi conservé à la racine du disque dur C:\FindyKill.txt.

@++ :)