Win32.agent.fbx trojan

Je pourrais supprimer tout les logiciels que j'ai installé pour résoudre mon souci sauf Ccleaner ?

Ok, tu peux supprimer JavaRa.

-+-+-+-+-> Purger la restauration système <-+-+-+-+-

[x] La restauration système est un endroit que windows utilise pour créer des sauvegardes. En cas de soucis, tu peux utiliser ces sauvegardes pour revenir à un état antérieur au problème.

[x] Après une désinfection, il faut purger la restauration système pour supprimer toutes traces de malwares y résidant.

[x] Tutoriels :

- Windows XP
- Windows Vista
- Windows 7

Après ça, tu pourras mettre ton post en "résolu".

JavaRa 1.15 Removal Log.

Report follows after line.

------------------------------------

The JavaRa removal process was started on Sat Jun 19 19:00:10 2010

Found and removed: C:\Program Files\Java\jre1.6.0_07

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0000-0002-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0000-0004-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0014-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBC}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBC}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBC}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0003-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0010-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0012-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0001-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0007-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0008-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0010-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0011-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0012-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0014-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0015-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0016-ABCDEFFEDCBB}

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_02

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_03

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_04

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2.0_01

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0015-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0016-ABCDEFFEDCBA}

Found and removed: SOFTWARE\JavaSoft\Java Plug-in\1.6.0_07

Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.6.0_07

Found and removed: SOFTWARE\Microsoft\Active Setup\Installed Components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ACBB9B2318A96D117A58000B0D610007

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D610007

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0160070}

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.6.0_07\bin\

------------------------------------

Finished reporting.

Je n'ai pa recu de rapport Java c'est normal ?

Internet Explorer 8 me dit qu'il n'a pas les modules complémentaires, comment faire pour les installer ?

C'est ok. On finalise :

-+-+-+-+-> Mise à jour du PC <-+-+-+-+-

[x] Il est important d'avoir les dernières mises à jour sur ton PC. En effet, celles ci corrigent des failles de sécurité qui peuvent parfois être exploitée par un programme malveillant.

1ère étape : Java

[o] Télécharge JavaRa puis décompresse le sur ton bureau.
[o] Ouvre le dossier JavaRa puis exécute JavaRa.exe.
[o] Clique sur "Search For Updates".
[o] Sélectionne "Update Using jucheck.exe" puis clique sur "Search".
[o] Autorise le processus à se connecter s'il te le demande, clique sur "install" et suis la procédure d'installation.
[o] Une fois l'installation terminée, revient à l'écran de JavaRa et clique sur "Remove Older Versions".
[o] Clique sur " Oui " pour confirmer. Laisse l'outil travailler, puis clique sur " Ok " et une nouvelle fois sur " Ok ".
[o] Un rapport s'ouvrira, copie/colle son contenu dans ton prochain message.

2ème étape : Internet Explorer

[x] Même si tu n'utilises pas Internet Explorer pour naviguer, il est important de le mettre à jour !
[o] Télécharge Internet Explorer 8 puis installe le.

3ème étape : Mise à jour du système

Tu as le SP1 de vista, il faut le mettre à jour :

[o] Windows Vista SP2

Il est important de faire toutes les mises à jour windows update.

4ème étape : Mise à jour des logiciels

[o] Il est également important de garder tes logiciels à jour. Pour ce faire, il existe un petit utilitaire, Update Checker.
[o] Télécharge le
[o] Un tutoriel pour son utilisation est disponible ici.

-+-+-+-+-> OtCleanIt <-+-+-+-+-

[x] Nous allons supprimer les traces des différents outils de désinfection que je t'ai fais utiliser.

[x] Télécharge OtCleanIt sur ton bureau.

[x] Lance le ( sous vista/7 -> Clic droit puis " Exécuter en tant qu'administrateur " ).

[x] Clique sur " CleanUp!" puis sur " Yes ".

[x] Tu seras invité à redémarrer ton PC. Au redémarrage, les différents fix auront été supprimé ainsi qu'OtCleanIt.

Note : Un tutoriel en images est disponible ici.

-+-+-+-+-> Optimisation <-+-+-+-+-

1ère étape : Suppression des fichiers inutiles

[o] Télécharge CCleaner
[o] Installe le, puis lance le.
[o] Va dans l'onglet "Options" puis " Avancé " et décoche " Effacer uniquement les fichiers[...] ".
[o] Cliques sur l'onglet " Nettoyeur " puis cliques sur " Analyser ". A la fin de l'analyse, clique sur " Nettoyer ".
[o] Rends toi à l'onglet " Registre " puis cliques sur " Chercher les erreurs ". Cliques ensuite sur " Corriger les erreurs séléctionnées ".
[o] Accepte la sauvegarde puis enregistre la dans tes documents ( tu pourras la supprimer si aucun problème n'apparaît après la suppression )
[o] Cliques ensuite sur " Corriger toutes les erreurs sélectionnées " puis sur " Fermer "
[o] Tu peux renouveller ces opérations tous les jours.

2ème étape : Défragmentation

[x] Au fur et à mesure que tu installes des logiciels, copies des fichiers etc.. le disque dur se fragmente et les accès en lecture/écriture sont plus longs.
[o] Télécharge Defraggler.
[o] Un tutoriel pour son utilisation est disponible ici.

https://www.cjoint.com/?gtn33hSFjS

Fix Navipromo version 4.0.8 commencé le 19/06/2010 13:47:49,40

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!

Outil exécuté depuis C:\navilog1

Mise à jour le 09.03.2010 à 18h00 par IL-MAFIOSO

Microsoft® Windows Vista(TM) Édition Familiale Premium ( v6.0.6001 ) Service Pack 1
X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 Duo CPU P7350 @ 2.00GHz )
BIOS : Default System BIOS
USER : jess ( Administrator )
BOOT : Normal boot

C:\ (Local Disk) - NTFS - Total:220 Go (Free:125 Go)
D:\ (CD or DVD) - UDF - Total:4 Go (Free:0 Go)

Recherche executée en mode normal

[b]Aucune Infection Navipromo/Egdaccess trouvée[/b]

*** Scan terminé 19/06/2010 13:48:32,22 ***

Le rapport navilog n'est pas complet, il n'y a que le début. Peux-tu le reposter en entier?

Refais un rapport ZHPDiag, on a viré tout les restes d'infections sur ton PC.

Alors c'est grave docteur ?

======= RAPPORT D'AD-REMOVER 2.0.0.1,C | UNIQUEMENT XP/VISTA/7 =======

Mis à jour par C_XX le 17/06/10 à 18:00
Contact: AdRemover.contact@gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html

C:\Program Files\Ad-Remover\main.exe (CLEAN [2]) -> Lancé à 01:50:31 le 19/06/2010, Mode normal

Microsoft® Windows Vista(TM) Édition Familiale Premium Service Pack 1 (X86)
jess, PC-DE-JESS (Packard Bell BV EasyNote_ST85-M-006FR)

============== ACTION(S) ==============

0,Fichier supprimé: C:\Users\jess\AppData\Local\ulciqgv_navps.dat

(!) -- Fichiers temporaires supprimés.

============== SCAN ADDITIONNEL ==============

** Mozilla Firefox Version [3.5.9 (fr)] **

-- C:\Users\jess\AppData\Roaming\Mozilla\FireFox\Profiles\dd0tx0hm.default\Prefs.js --
browser.download.lastDir, C:\\Users\\jess\\Desktop
browser.search.selectedEngine, Google
browser.startup.homepage, www.google.fr
browser.startup.homepage_override.mstone, rv:1.9.1.9
keyword.URL, hxxp://radiobar.toolbarhome.com/search.aspx?srch=ku&q=

========================================

** Internet Explorer Version [7.0.6001.18000] **

[HKCU\Software\Microsoft\Internet Explorer\Main]
AutoHide: yes
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Do404Search: 0x01000000
Enable Browser Extensions: yes
Local Page: C:\Windows\system32\blank.htm
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Show_ToolBar: yes
Start Page: hxxp://fr.msn.com/
Use Search Asst: no

[HKLM\Software\Microsoft\Internet Explorer\Main]
AutoHide: yes
Default_Page_URL: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Delete_Temp_Files_On_Exit: yes
Local Page: C:\Windows\system32\blank.htm
Search bar: hxxp://search.msn.com/spbasic.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://fr.msn.com/

[HKLM\Software\Microsoft\Internet Explorer\ABOUTURLS]
Tabs: res://ieframe.dll/tabswelcome.htm
Blank: res://mshtml.dll/blank.htm

========================================

C:\Program Files\Ad-Remover\Quarantine: 11 Fichier(s)
C:\Program Files\Ad-Remover\Backup: 18 Fichier(s)

C:\Ad-Report-CLEAN[1].txt - 19/06/2010 (3454 Octet(s))
C:\Ad-Report-CLEAN[2].txt - 19/06/2010 (2401 Octet(s))

Fin à: 01:54:18, 19/06/2010

============== E.O.F ==============

Navilog:
Fix Navipromo version 4.0.8 commencé le 19/06/2010 1:34:27,98

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!

Outil exécuté depuis C:\navilog1

Mise à jour le 09.03.2010 à 18h00 par IL-MAFIOSO

Microsoft® Windows Vista(TM) Édition Familiale Premium ( v6.0.6001 ) Service Pack 1
X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 Duo CPU P7350 @ 2.00GHz )
BIOS : Default System BIOS
USER : jess ( Administrator )
BOOT : Normal boot

C:\ (Local Disk) - NTFS - Total:220 Go (Free:112 Go)
D:\ (CD or DVD) - UDF - Total:4 Go (Free:0 Go)

scan lop S&D:
--------------------\\ Lop S&D 4.2.5-0 XP/Vista

Microsoft® Windows Vista(TM) Édition Familiale Premium ( v6.0.6001 ) Service Pack 1
X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 Duo CPU P7350 @ 2.00GHz )
BIOS : Default System BIOS
USER : jess ( Administrator )
BOOT : Normal boot
C:\ (Local Disk) - NTFS - Total:220 Go (Free:112 Go)
D:\ (CD or DVD) - UDF - Total:4 Go (Free:0 Go)

"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
Option : [2] ( 19/06/2010| 1:25 )

[ UAC => 0 ]

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ SUPPRESSION

Supprime! - C:\Users\jess\AppData\Local\Temp\nsf6F4B.tmp
Supprime! - C:\Users\jess\AppData\Local\Temp\nsq6825.tmp
Supprime! - C:\Users\jess\AppData\Local\Temp\nsrF385.tmp
Supprime! - C:\Users\jess\AppData\Roaming\MICROS~1\Windows\Cookies\jess@advertstream[1].txt
Supprime! - C:\Users\jess\AppData\Roaming\MICROS~1\Windows\Cookies\jess@d2.advertserve[1].txt
Supprime! - C:\Users\jess\AppData\Roaming\MICROS~1\Windows\Cookies\jess@advertising[1].txt
Supprime! - C:\Users\jess\AppData\Roaming\MICROS~1\Windows\Cookies\jess@2xmoinscher[1].txt
Supprime! - C:\Users\jess\AppData\Roaming\MICROS~1\Windows\Cookies\jess@cc.2xmoinscher[1].txt
Supprime! - C:\Program Files\Circle Developement
-
[ Fichier Hosts ] .. Restaure!

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

--------------------\\ Listing des dossiers dans Local

[05/11/2008|15:41] C:\Users\jess\AppData\Local\Adobe
[17/10/2008|11:37] C:\Users\jess\AppData\Local\Ahead
[31/10/2008|11:10] C:\Users\jess\AppData\Local\Apple
[21/05/2010|10:38] C:\Users\jess\AppData\Local\Apple Computer
[23/09/2008|17:24] C:\Users\jess\AppData\Local\Application Data
[23/09/2008|17:31] C:\Users\jess\AppData\Local\ATI
[28/09/2008|17:52] C:\Users\jess\AppData\Local\BVRP Software
[24/09/2009|17:01] C:\Users\jess\AppData\Local\d3d9caps.dat
[03/01/2010|21:30] C:\Users\jess\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[18/04/2010|16:56] C:\Users\jess\AppData\Local\GDIPFONTCACHEV1.DAT
[06/01/2010|21:09] C:\Users\jess\AppData\Local\Google
[23/09/2008|17:24] C:\Users\jess\AppData\Local\Historique
[19/06/2010|01:18] C:\Users\jess\AppData\Local\IconCache.db
[17/06/2009|19:54] C:\Users\jess\AppData\Local\Microsoft
[31/05/2009|11:15] C:\Users\jess\AppData\Local\Microsoft Games
[17/11/2009|11:16] C:\Users\jess\AppData\Local\Mozilla
[12/02/2010|13:24] C:\Users\jess\AppData\Local\oeygq.bat
[23/09/2008|17:32] C:\Users\jess\AppData\Local\Packard Bell
[19/06/2010|01:25] C:\Users\jess\AppData\Local\Temp
[23/09/2008|17:24] C:\Users\jess\AppData\Local\Temporary Internet Files
[12/02/2010|17:26] C:\Users\jess\AppData\Local\ulciqgv.dat
[10/02/2010|18:14] C:\Users\jess\AppData\Local\ulciqgv_nav.dat
[12/02/2010|17:26] C:\Users\jess\AppData\Local\ulciqgv_navps.dat
[26/09/2008|22:39] C:\Users\jess\AppData\Local\VirtualStore

--------------------\\ Tâches planifiées dans C:\Windows\tasks

[19/06/2010 01:00][--a------] C:\Windows\tasks\Extension de garantie-jess.job
[19/06/2010 01:00][--a------] C:\Windows\tasks\Recovery DVD Creator-jess.job
[19/06/2010 01:19][--ah-----] C:\Windows\tasks\SA.DAT
[19/06/2010 01:18][--a------] C:\Windows\tasks\SCHEDLGU.TXT

--------------------\\ Listing des dossiers dans C:\ProgramData

[02/10/2009|19:03] C:\ProgramData\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[04/09/2009|01:14] C:\ProgramData\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[22/01/2010|11:51] C:\ProgramData\Adobe
[04/09/2009|01:09] C:\ProgramData\Apple
[31/10/2008|11:12] C:\ProgramData\Apple Computer
[02/11/2006|15:02] C:\ProgramData\Application Data
[28/07/2008|12:40] C:\ProgramData\ATI
[23/09/2008|17:24] C:\ProgramData\Bureau
[19/01/2009|21:04] C:\ProgramData\BVRP Software
[02/11/2006|15:02] C:\ProgramData\Desktop
[02/11/2006|15:02] C:\ProgramData\Documents
[22/01/2010|11:51] C:\ProgramData\Electronic Arts
[01/01/2009|17:42] C:\ProgramData\eMule
[23/09/2008|17:24] C:\ProgramData\Favoris
[02/11/2006|15:02] C:\ProgramData\Favorites
[22/10/2008|13:37] C:\ProgramData\FLEXnet
[22/02/2009|17:49] C:\ProgramData\Google
[19/06/2010|01:21] C:\ProgramData\Kaspersky Lab
[04/01/2010|00:41] C:\ProgramData\Kaspersky Lab Setup Files
[19/11/2009|17:23] C:\ProgramData\McAfee
[17/11/2009|14:02] C:\ProgramData\McAfee Security Scan
[23/09/2008|17:24] C:\ProgramData\Menu D'marrer
[03/09/2009|19:30] C:\ProgramData\Messenger Plus!
[06/06/2010|20:34] C:\ProgramData\Microsoft
[23/09/2008|17:57] C:\ProgramData\Microsoft Help
[23/09/2008|17:24] C:\ProgramData\ModSles
[28/07/2008|12:52] C:\ProgramData\Nero
[29/09/2008|00:25] C:\ProgramData\SimCity Societies
[19/10/2008|22:32] C:\ProgramData\Skype
[18/06/2010|19:54] C:\ProgramData\Spybot - Search & Destroy
[02/11/2006|15:02] C:\ProgramData\Start Menu
[23/09/2008|17:36] C:\ProgramData\Symantec
[24/02/2009|16:47] C:\ProgramData\Tarma Installer
[02/11/2006|15:02] C:\ProgramData\Templates
[28/09/2008|01:29] C:\ProgramData\WLInstaller

--------------------\\ Listing des dossiers dans C:\Program Files

[26/05/2009|15:38] C:\Program Files\Adobe
[28/09/2008|00:49] C:\Program Files\Alwil Software
[31/10/2008|11:10] C:\Program Files\Apple Software Update
[26/04/2009|19:55] C:\Program Files\Ask Search Assistant
[28/07/2008|12:29] C:\Program Files\ATI
[28/07/2008|12:32] C:\Program Files\ATI Technologies
[28/07/2008|12:28] C:\Program Files\ATK Hotkey
[25/11/2008|17:12] C:\Program Files\Avanquest update
[15/06/2009|11:19] C:\Program Files\Bonjour
[22/01/2010|11:50] C:\Program Files\Common Files
[15/06/2010|18:00] C:\Program Files\Electronic Arts
[23/09/2008|17:24] C:\Program Files\Fichiers communs [C:\Program Files\Common Files]
[22/02/2009|19:34] C:\Program Files\Google
[28/07/2008|12:44] C:\Program Files\HDReg
[15/06/2010|18:00] C:\Program Files\InstallShield Installation Information
[28/07/2008|12:27] C:\Program Files\Intel
[14/06/2010|15:36] C:\Program Files\Internet Explorer
[16/11/2009|13:37] C:\Program Files\iPod
[16/11/2009|13:38] C:\Program Files\iTunes
[26/05/2009|15:27] C:\Program Files\Java
[05/01/2010|18:34] C:\Program Files\Kaspersky Lab
[24/06/2009|23:44] C:\Program Files\LimeWire
[26/04/2009|19:55] C:\Program Files\Messenger Plus! Live
[19/06/2009|14:27] C:\Program Files\MessengerDiscovery 2
[29/11/2009|21:15] C:\Program Files\Microsoft
[10/03/2009|19:01] C:\Program Files\Microsoft Games
[18/04/2010|16:45] C:\Program Files\Microsoft Office
[29/11/2009|21:18] C:\Program Files\Microsoft Office Outlook Connector
[08/06/2010|10:41] C:\Program Files\Microsoft Silverlight
[12/01/2009|14:48] C:\Program Files\Microsoft SQL Server Compact Edition
[29/11/2009|21:17] C:\Program Files\Microsoft Sync Framework
[20/11/2008|19:49] C:\Program Files\Microsoft Visual Studio
[24/11/2008|12:38] C:\Program Files\Microsoft Works
[04/06/2009|19:33] C:\Program Files\Microsoft WSE
[20/11/2008|19:48] C:\Program Files\Microsoft.NET
[14/03/2010|19:36] C:\Program Files\Movie Maker
[19/06/2010|01:23] C:\Program Files\Mozilla Firefox
[02/11/2006|14:37] C:\Program Files\MSBuild
[28/09/2008|00:24] C:\Program Files\MSXML 4.0
[28/07/2008|12:52] C:\Program Files\Nero
[28/07/2008|12:54] C:\Program Files\NeroInstall.bak
[06/08/2009|10:43] C:\Program Files\Packard Bell
[28/07/2008|12:29] C:\Program Files\Packardbell
[08/02/2010|21:57] C:\Program Files\QuickTime
[28/07/2008|12:35] C:\Program Files\Realtek
[02/11/2006|14:37] C:\Program Files\Reference Assemblies
[17/06/2009|20:37] C:\Program Files\RentASoft
[16/11/2009|13:41] C:\Program Files\Safari
[28/07/2008|12:45] C:\Program Files\Seagate
[18/06/2010|19:06] C:\Program Files\Spybot - Search & Destroy
[28/09/2008|02:15] C:\Program Files\Sun
[28/07/2008|12:37] C:\Program Files\Synaptics
[28/05/2009|13:35] C:\Program Files\SystemRequirementsLab
[02/11/2006|15:01] C:\Program Files\Uninstall Information
[11/06/2010|16:44] C:\Program Files\uTorrent
[07/10/2008|20:22] C:\Program Files\VideoLAN
[28/07/2008|21:58] C:\Program Files\Windows Calendar
[28/07/2008|21:58] C:\Program Files\Windows Collaboration
[28/07/2008|21:58] C:\Program Files\Windows Defender
[28/07/2008|21:58] C:\Program Files\Windows Journal
[29/11/2009|21:18] C:\Program Files\Windows Live
[12/01/2009|14:46] C:\Program Files\Windows Live SkyDrive
[14/06/2010|15:36] C:\Program Files\Windows Mail
[02/11/2009|11:50] C:\Program Files\Windows Media Player
[23/09/2008|17:24] C:\Program Files\Windows NT
[28/07/2008|21:58] C:\Program Files\Windows Photo Gallery
[28/07/2008|21:58] C:\Program Files\Windows Sidebar
[13/11/2008|12:51] C:\Program Files\WinRAR
[28/07/2008|12:38] C:\Program Files\X10 Hardware
[24/02/2009|16:47] C:\Program Files\Yontoo Layers Client for Internet Explorer
[19/06/2010|00:32] C:\Program Files\ZHPDiag

--------------------\\ Listing des dossiers dans C:\Program Files\Common Files

[26/05/2009|15:38] C:\Program Files\Common Files\Adobe
[22/01/2010|11:50] C:\Program Files\Common Files\Adobe AIR
[16/11/2009|13:37] C:\Program Files\Common Files\Apple
[20/11/2008|19:49] C:\Program Files\Common Files\DESIGNER
[28/07/2008|12:32] C:\Program Files\Common Files\InstallShield
[28/09/2008|02:13] C:\Program Files\Common Files\Java
[28/07/2008|12:25] C:\Program Files\Common Files\Macrovision Shared
[22/02/2009|19:28] C:\Program Files\Common Files\microsoft shared
[28/09/2008|17:43] C:\Program Files\Common Files\Motorola Shared
[28/07/2008|12:53] C:\Program Files\Common Files\Nero
[02/11/2006|13:18] C:\Program Files\Common Files\Services
[02/11/2006|13:18] C:\Program Files\Common Files\SpeechEngines
[23/09/2008|17:37] C:\Program Files\Common Files\Symantec Shared
[29/11/2009|21:18] C:\Program Files\Common Files\System
[09/01/2009|17:25] C:\Program Files\Common Files\Windows Live
[28/09/2008|01:33] C:\Program Files\Common Files\WindowsLiveInstaller
[28/07/2008|12:37] C:\Program Files\Common Files\X10

--------------------\\ Process

( 77 Processes )

... OK !

--------------------\\ Recherche avec S_Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Recherche de Fichiers / Dossiers Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Verification du Registre

..... OK !

--------------------\\ Verification du fichier Hosts

Fichier Hosts PROPRE

--------------------\\ Recherche de fichiers avec Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-06-19 01:26:00
Windows 6.0.6001 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden files ...
C:\Users\jess\AppData\Local\Microsoft\Windows\GameExplorer\{DFEF49D9-FC95-4301-99B9-2FB91C6ABA06}\PlayTasks\1\Les Sims(TM) 2 : Boit@Look.lnk 1242 bytes hidden from API
scan completed successfully
hidden processes: 0
hidden files: 28

--------------------\\ Recherche d'autres infections

C:\Users\jess\AppData\Local\ulciqgv.dat
C:\Users\jess\AppData\Local\ulciqgv_nav.dat
C:\Users\jess\AppData\Local\ulciqgv_navps.dat
[b]==> EGDACCESS <==/b

[F:1435][D:866]-> C:\Users\jess\AppData\Local\Temp
[F:913][D:1]-> C:\Users\jess\AppData\Roaming\MICROS~1\Windows\Cookies
[F:411][D:4]-> C:\Users\jess\AppData\Local\MICROS~1\Windows\TEMPOR~1\content.IE5
[F:1115][D:87]-> C:\$Recycle.Bin

1 - "C:\Lop SD\LopR_1.txt" - 19/06/2010| 1:29 - Option : [2]

--------------------\\ Fin du rapport a 1:29:41
[ UAC => 1 ]

Ok on commence la désinfection :

-+-+-+-+-> Lop S&D <-+-+-+-+-

/!\ Utilisateurs de Vista/Seven, désactivez l'UAC. /!\

[x] Télécharge Lop S&D sur ton bureau.

[x] Lance le puis choisis l'option F ( Français ). Choisis ensuite l'option 2.

[x] Patiente pendant le scan puis copie/colle le contenu du rapport qui s'ouvrira dans ta pochaine réponse.

[x] Note : Le rapport est également sauvegardé sous C:\LopR.txt.

-+-+-+-+-> Navilog <-+-+-+-+-

[x] Télécharge Navilog sur ton bureau.

[x] Si ton antivirus s'affole, désactive le momentanément.

[x] Lance navilog ( sous vista/7 -> Clic droit puis " Exécuter en tant qu'administrateur " )

[x] Choisis l'option 1 ( Français ), suis les instructions puis choisis l'option 1 ( Recherche / Désinfection automatique )

[x] Patiente pendant le scan. A la fin du scan, appuie sur une touche.

[x] Un rapport va s'ouvrir, copie/colle son contenu dans ton prochain message.

[x] Note : Le rapport est sauvegardé sous C:\Cleannavi.txt.

-+-+-+-+-> AD-Remover <-+-+-+-+-

[x] Télécharge AD-Remover ( de C_XX ).

[x] Si tu es sous vista, désactive l'UAC. Pour Seven, c'est ici.

[x] Lance AD-Remover puis choisis l'option " Nettoyer ".

[x] Patiente pendant le scan, un rapport s'ouvrira ensuite. Poste son contenu dans ton prochain message

[x] Note : Le rapport se trouve également sous C:\Ad-Report-CLEAN.txt

Pardon voici le lien crée https://www.cjoint.com/?gta4q0KoiI

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Current\Version\Uninstall\oeygq

Voila l'adresse

Laisse tomber spybot et suis ces instructions.

J'ai retrouver le rapport Spybot, jte lepost ici ? il est long...

Non, le rapport est trop long.

Il faut que tu fasses ceci :

[x] Rend toi sur cjoint puis clique sur " Choisissez un fichier ".

[x] Sélectionne le fichier ZHPDiag.txt présent sur ton bureau, puis clique sur " Ouvrir ".

[x] Clique ensuite sur " Créer le lien cjoint " puis copie/colle dans ta prochaine réponse le lien créé.

Lis bien mon post, il faut que tu héberges le fichier sinon il ne passera pas

Rapport de ZHPDiag v1.25.1436 par Nicolas Coolman, Update du 14/06/2010
Run by jess at 19/06/2010 00:25:09
Web site : http://www.premiumorange.com/zeb-help-process/zhpdiag.html
Contact : nicolascoolman@yahoo.fr

---\\ Web Browser
MSIE: Internet Explorer v7.0.6001.18000
MFIE: Mozilla Firefox (3.5.9)

---\\ System Information
Platform : Windows Vista (TM) Home Premium (6.0.6001) Service Pack 1
Processor: x86 Family 6 Model 23 Stepping 6, GenuineIntel
Operating System: 32 Bits
Boot mode: Normal (Normal boot)
Total RAM: 3070 MB (49% free)
System drive C: has 113 GB (51%) free of 221 GB

---\\ Logged in mode
Computer Name: PC-DE-JESS
User Name: jess
All Users Names: jess, Administrateur,
Unselected Option: O1,O45,O61,O65
Logged in as Administrator

---\\ DOS/Devices
C:\ Hard drive, Flash drive, Thumb drive (Free 113 Go of 221 Go)
D:\ CD-ROM drive (Not Inserted)

---\\ Security Center & Tools Informations
[HKLM\SOFTWARE\Microsoft\Security Center] UacDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiSpywareOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiVirusOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] FirewallOverride: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: OK
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoFolderOptions: OK
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] DisableTaskMgr: OK
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] DisableRegistryTools: OK
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] NoDispScrSavPage: OK

---\\ Processus lancés
[MD5.0D392EDE3B97E0B3131B2F63EF1DB94E] - (.Microsoft Corporation - Windows Defender User Interface.) -- C:\Program Files\Windows Defender\MSASCui.exe [1008184]
[MD5.2521D0C1B65ACB7752CA365F538949E4] - (.Intel Corporation - Event Monitor User Notification Tool.) -- C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe [178712]
[MD5.A6001C8CF042D31AB1377CC7626A1046] - (.Pas de propriétaire - HControlUser.) -- C:\Program Files\ATK Hotkey\HcontrolUser.exe [98304]
[MD5.E1E71D80D078C576801B6FE2A29FCF85] - (.Advanced Micro Devices, Inc. - Catalyst® Control Center Launcher.) -- C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [61440]
[MD5.86171114D84AFBD3DFCE930E320C1BBF] - (.Realtek Semiconductor - HD Audio Control Panel.) -- C:\Windows\RtHDVCpl.exe [6183456]
[MD5.F21A8FB31B15860C4F6021960CF723A8] - (.Synaptics, Inc. - Synaptics TouchPad Enhancements.) -- C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1041704]
[MD5.F0187E45268E86AAAA932CBD9087BEA8] - (.Google - Google Desktop.) -- C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [30192]
[MD5.A7A7AD08BA72AC90DCD5511ED895369B] - (.Pas de propriétaire - Pas de description.) -- C:\Program Files\Packard Bell\GOOGLE_EULA\EULALauncher.exe [28672]
[MD5.A2D390F1F2408B94EF34BFE3A00C29D3] - (.Sun Microsystems, Inc. - Java(TM) Platform SE binary.) -- C:\Program Files\Java\jre6\bin\jusched.exe [148888]
[MD5.392845E8D49B5F0E81AAC4D795000A8C] - (.Adobe Systems Incorporated - Adobe Acrobat SpeedLauncher.) -- C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [39792]
[MD5.633B66014DDEDA70C21CFD327BDC214A] - (.Apple Inc. - AppleSyncNotifier.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [177440]
[MD5.C418B204BED40A0979D203EBB1E9A32B] - (.Apple Inc. - iTunesHelper.) -- C:\Program Files\iTunes\iTunesHelper.exe [141600]
[MD5.70843CC2A64D44D457472FB5E78209FF] - (.Kaspersky Lab - Kaspersky Anti-Virus.) -- C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe [340456]
[MD5.55D7A219AD8D0DB8980528944152A6FD] - (.Apple Inc. - QuickTime Task.) -- C:\Program Files\QuickTime\QTTask.exe [417792]
[MD5.CB2B9EB1447D8A264E46948DF46C1212] - (.Packard Bell BV - SmpSys.exe.) -- C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe [1038136]
[MD5.18B4B12358EFCF68D76812058A26181F] - (.Microsoft Corporation - Windows Live Messenger.) -- C:\Program Files\Windows Live\Messenger\msnmsgr.exe [3883856]
[MD5.B30476357EA885420BDFB9A26EE97816] - (.Nero AG - Nero Home.) -- C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe [1688872]
[MD5.5D61BE7DB55B026A5D61A3EED09D0EAD] - (.Google Inc. - GoogleToolbarNotifier.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408]
[MD5.896A1DB9A972AD2339C2E8569EC926D1] - (.Safer Networking Limited - System settings protector.) -- C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2144088]
[MD5.FD278E51A7D6F52D22FCE6C67E037AD6] - (.Microsoft Corporation - Volet Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe [1233920]
[MD5.E8FE4FCE23D2809BD88BCC1D0F8408CE] - (.Pas de propriétaire - Pas de description.) -- C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe [124832]
[MD5.3794B461C45882E06856F282EEF025AF] - (.Microsoft Corporation - Processus hôte pour les services Windows.) -- C:\Windows\system32\svchost.exe [21504]
[MD5.557F35D1CA42AEA14A6690E21887A31F] - (.Apple Inc. - Apple Mobile Device Service.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [144712]
[MD5.5A055A4777CBBC8845DD598CB2EEBF69] - (.Pas de propriétaire - ASLDR Service.) -- C:\Program Files\ATK Hotkey\ASLDRSrv.exe [94208]
[MD5.8FEB268CAE12E43538422312FD96B32F] - (.ATI Technologies Inc. - ATI External Event Utility EXE Module.) -- C:\Windows\system32\Ati2evxx.exe [692224]
[MD5.3F56903E124E820AEECE6D471583C6C1] - (.Apple Inc. - Bonjour Service.) -- C:\Program Files\Bonjou