Antimalware doctor

junes23 -  
Bonjour,
j'ai un pc portable vista avec un anti virus macfee.
un virus antimalware doctor est entrée dans mon ordianteur. je ne peux plus aller sur internet depus. Et macfee ne fonctionne plus. Je suis coincée en mode sans echec comment en sortir et surtout comment suprimer antimalware doctor de mon ordi?
merci

7 réponses

  1.  Malekal_morte- Modérateur
    beu.....
    bizarre ce qui s'est passé sur The Avenger, il a tout pris en driver \o

    on va retenter - je vais virer un truc :)

    Relance The Avenger.

    Dans le cadre , sous Input Script here , copie_colle le contenu du cadre ci dessous et clic execute: 

    begin copying here: 
Drivers to delete: 
alsljw 
Files to delete: 
c:\windows\system32\drivers\alsljw.sys


    * Après le re-démarrage, il crée un fichier log qui s'ouvrira,que tu posteras dans ta prochaine reponse, faisant apparaitre les actions exécutées par The Avenger. Ce fichier log se trouve ici : C:\avenger.txt

    Relance Combofix et poste le rapport ici.

    Rise Against rules :D
    1. junes23
      mon nouveau rapport combofixe

      ComboFix 10-07-22.01 - june 23/07/2010 13:20:00.1.4 - x86 MINIMAL
      Microsoft Windows+7 ...dition Familiale Premium 6.1.7600.0.1252.33.1036.18.3061.2150 [GMT 2:00]
      LancÈ depuis: c:\users\june\Desktop\ComboFix.exe
      * Un nouveau point de restauration a ÈtÈ crÈÈ
      .

      (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
      .

      C:\cleanup.exe
      c:\programdata\FullRemove.exe
      c:\users\june\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Antimalware Doctor.lnk
      c:\users\june\AppData\Roaming\Microsoft\Windows\Start Menu\Antimalware Doctor.lnk
      c:\users\june\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Antimalware Doctor
      c:\users\june\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Antimalware Doctor\Antimalware Doctor.lnk
      c:\users\june\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Antimalware Doctor\Uninstall.lnk
      c:\users\june\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antimalware Doctor.lnk
      c:\windows\SEC
      c:\windows\SEC\172100logo.bmp
      c:\windows\SEC\banner.png
      c:\windows\SEC\Computer.png
      c:\windows\SEC\Media _S_ Logo.png
      c:\windows\SEC\Samsung.png
      c:\windows\SEC\Samsung2.png
      c:\windows\SEC\SamsungLogo.png
      c:\windows\SEC\Thumbs.db
      c:\windows\SEC\Wallpapers\Thumbs.db
      c:\windows\SEC\Wallpapers\wallpaper.jpg
      c:\windows\SEC\Wallpapers\wallpaper1.jpg
      c:\windows\SEC\Wallpapers\Wallpaper2.jpg
      C:\zip.exe

      .
      ((((((((((((((((((((((((((((( Fichiers crÈÈs du 2010-06-23 au 2010-07-23 ))))))))))))))))))))))))))))))))))))
      .

      2010-07-23 11:24 . 2010-07-23 11:24 -------- d-----w- c:\users\june\AppData\Local\temp
      2010-07-23 11:24 . 2010-07-23 11:24 -------- d-----w- c:\users\Public\AppData\Local\temp
      2010-07-23 11:24 . 2010-07-23 11:24 -------- d-----w- c:\users\Default\AppData\Local\temp
      2010-07-23 09:39 . 2010-07-23 09:52 -------- d-----w- c:\users\june\AppData\Local\ElevatedDiagnostics
      2010-07-22 22:03 . 2010-07-23 11:24 766976 ----a-w- c:\windows\system32\drivers\alsljw.sys
      2010-07-22 22:02 . 2010-07-22 22:02 -------- d-----w- c:\users\june\AppData\Local\mvkvrifwu
      2010-07-22 22:02 . 2010-07-22 22:02 1051136 ----a-w- c:\users\june\AppData\Roaming\AE6B1A3372932F260B2F4EED263A43CA\patchsetup70700.exe
      2010-07-22 22:02 . 2010-07-23 21:13 -------- d-----w- c:\users\june\AppData\Roaming\AE6B1A3372932F260B2F4EED263A43CA
      2010-07-19 15:58 . 2010-07-19 15:58 2944904 ----a-w- c:\users\june\AppData\Roaming\Mozilla\Firefox\Profiles\tbmt3ipm.default\extensions\toolbar@ask.com\chrome\temp\askToolbar.exe
      2010-07-17 20:45 . 2010-07-22 22:07 -------- d-----w- c:\users\june\AppData\Roaming\BitTorrent
      2010-07-17 20:45 . 2010-07-17 20:45 -------- d-----w- c:\program files\Ask.com
      2010-07-17 20:45 . 2010-07-17 20:45 -------- d-----w- c:\program files\BitTorrent
      2010-07-08 20:19 . 2010-07-08 20:19 -------- d-----w- c:\windows\system32\Wat
      2010-07-03 07:37 . 2010-07-03 07:37 -------- d-----w- c:\program files\MSXML 4.0
      2010-07-02 15:05 . 2010-07-02 15:24 -------- d-----w- c:\users\june\AppData\Roaming\DataCast
      2010-07-02 15:05 . 2010-07-02 15:05 -------- d-----w- c:\program files\MarkAny
      2010-07-02 15:03 . 2010-07-02 15:03 -------- d-----w- C:\Manual-PCProgram
      2010-07-02 15:01 . 2010-07-02 15:01 -------- d-----w- c:\users\june\AppData\Roaming\AVS4YOU
      2010-07-02 15:00 . 2010-07-11 15:04 -------- d-----w- c:\program files\Common Files\AVSMedia
      2010-07-02 15:00 . 2008-08-13 09:22 974848 ----a-w- c:\windows\system32\mfc70.dll
      2010-07-02 15:00 . 2008-08-13 09:22 487424 ----a-w- c:\windows\system32\msvcp70.dll
      2010-07-02 15:00 . 2008-08-13 09:22 1700352 ----a-w- c:\windows\system32\GdiPlus.dll
      2010-07-02 15:00 . 2010-07-11 15:04 -------- d-----w- c:\program files\AVS4YOU
      2010-07-02 15:00 . 2010-07-02 15:01 -------- d-----w- c:\programdata\AVS4YOU
      2010-06-24 20:18 . 2009-11-25 10:47 99176 ----a-w- c:\windows\system32\PresentationHostProxy.dll
      2010-06-24 20:18 . 2009-11-25 10:47 49472 ----a-w- c:\windows\system32\netfxperf.dll
      2010-06-24 20:18 . 2009-11-25 10:47 297808 ----a-w- c:\windows\system32\mscoree.dll
      2010-06-24 20:18 . 2009-11-25 10:47 295264 ----a-w- c:\windows\system32\PresentationHost.exe
      2010-06-24 20:18 . 2009-11-25 10:47 1130824 ----a-w- c:\windows\system32\dfshim.dll
      2010-06-24 07:45 . 2010-03-24 06:37 1286456 ----a-w- c:\windows\system32\ntdll.dll
      2010-06-24 07:45 . 2010-05-09 09:14 641536 ----a-w- c:\windows\system32\CPFilters.dll
      2010-06-24 07:45 . 2010-05-09 09:14 417792 ----a-w- c:\windows\system32\msdri.dll

      .
      (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
      .
      2010-07-23 21:13 . 2010-03-28 12:08 -------- d-----w- c:\programdata\McAfee Security Scan
      2010-07-23 11:16 . 2010-07-23 11:16 574 ----a-w- C:\cleanup.bat
      2010-07-23 11:16 . 2010-07-23 11:16 0 ----a-w- C:\backup.reg
      2010-07-23 08:40 . 2009-12-05 04:46 -------- d-----w- c:\program files\McAfee
      2010-07-18 14:04 . 2010-03-30 17:40 -------- d-----w- c:\users\june\AppData\Roaming\vlc
      2010-07-15 13:18 . 2009-12-05 04:49 130424 ----a-w- c:\windows\system32\drivers\Mpfp.sys
      2010-07-11 14:59 . 2010-06-11 16:20 -------- d-----w- c:\program files\Creative
      2010-07-06 19:32 . 2009-12-05 22:11 708852 ----a-w- c:\windows\system32\perfh00C.dat
      2010-07-06 19:32 . 2009-12-05 22:11 132834 ----a-w- c:\windows\system32\perfc00C.dat
      2010-07-02 15:05 . 2009-12-05 04:30 -------- d--h--w- c:\program files\InstallShield Installation Information
      2010-07-02 15:05 . 2009-12-05 04:35 -------- d-----w- c:\program files\Samsung
      2010-06-28 06:26 . 2010-03-27 22:13 -------- d-----w- c:\program files\Microsoft.NET
      2010-06-24 16:58 . 2010-03-27 22:16 87792 ----a-w- c:\users\june\AppData\Local\GDIPFONTCACHEV1.DAT
      2010-06-22 18:24 . 2010-04-07 16:01 -------- d-----w- c:\users\june\AppData\Roaming\dvdcss
      2010-06-22 11:42 . 2010-06-22 11:42 -------- d-----w- c:\program files\AnglaisFacile.com
      2010-06-15 19:55 . 2010-05-16 09:05 -------- d-----w- c:\users\june\AppData\Roaming\Skype
      2010-06-15 19:54 . 2010-05-16 09:06 -------- d-----w- c:\users\june\AppData\Roaming\skypePM
      2010-06-12 00:53 . 2010-03-27 22:11 -------- d-----w- c:\programdata\Microsoft Help
      2010-06-11 20:27 . 2010-06-11 20:17 -------- d-----w- c:\program files\Audible
      2010-06-11 16:25 . 2010-06-11 16:23 -------- d--h--w- c:\program files\Creative Installation Information
      2010-06-11 16:23 . 2010-06-11 16:23 -------- d-----w- c:\program files\Common Files\Creative
      2010-06-11 16:23 . 2010-06-11 16:23 -------- d-----w- c:\program files\Common Files\SWF Studio
      2010-06-11 16:22 . 2010-06-11 16:22 -------- d-----w- c:\programdata\Creative
      2010-06-11 16:05 . 2010-06-11 16:05 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
      2010-06-09 16:58 . 2010-06-09 16:58 -------- d-----w- c:\users\june\AppData\Roaming\Skip-Bo
      2010-06-09 16:57 . 2010-06-09 16:57 -------- d-----w- c:\programdata\Trymedia
      2010-06-09 16:57 . 2010-06-09 16:30 -------- d-----w- c:\program files\RealArcade
      2010-06-09 16:31 . 2010-06-09 16:31 -------- d-----w- c:\programdata\Zylom
      2010-06-09 16:31 . 2010-06-09 16:31 -------- d-----w- c:\program files\Zylom Games
      2010-06-09 16:31 . 2009-12-05 05:01 -------- d-----w- c:\program files\Google
      2010-06-07 20:31 . 2010-03-27 22:20 -------- d-----w- c:\program files\Microsoft Silverlight
      2010-05-27 07:24 . 2010-06-11 16:02 34304 ----a-w- c:\windows\system32\atmlib.dll
      2010-05-27 03:49 . 2010-06-11 16:02 293888 ----a-w- c:\windows\system32\atmfd.dll
      2010-05-24 12:42 . 2009-12-05 05:01 -------- d-----w- c:\programdata\Partner
      2010-05-21 05:18 . 2010-06-11 16:03 977920 ----a-w- c:\windows\system32\wininet.dll
      2010-05-16 09:06 . 2010-05-16 09:06 56 ---ha-w- c:\programdata\ezsidmv.dat
      2010-05-01 14:49 . 2010-06-11 16:03 2326528 ----a-w- c:\windows\system32\win32k.sys
      2009-06-10 21:26 . 2009-07-14 02:04 9633792 --sha-r- c:\windows\Fonts\StaticCache.dat
      2009-07-14 01:14 . 2009-07-13 23:42 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe
      .

      ------- Sigcheck -------

      [-] 2009-07-14 01:19 . 133D4B23C1D480428820C96807C3AB75 . 1285712 . . [------] . . c:\windows\System32\drivers\tcpip.sys
      .
      ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
      .
      .
      *Note* les ÈlÈments vides & les ÈlÈments initiaux lÈgitimes ne sont pas listÈs
      REGEDIT4

      [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
      2010-02-04 14:50 1197448 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
      "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-02-04 1197448]

      [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
      [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
      [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
      [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "CTSyncU.exe"="c:\program files\Creative\Sync Manager Unicode\CTSyncU.exe" [2006-08-07 700416]
      "patchsetup70700.exe"="c:\users\june\AppData\Roaming\AE6B1A3372932F260B2F4EED263A43CA\patchsetup70700.exe" [2010-07-22 1051136]
      "jfuotrdv"="c:\users\june\AppData\Local\mvkvrifwu\jlvonmutssd.exe" [BU]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-10-29 7862816]
      "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-10-10 1578280]
      "UpdateLBPShortCut"="c:\program files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]
      "CLMLServer"="c:\program files\CyberLink\Power2Go\CLMLSvc.exe" [2009-06-03 103720]
      "UpdateP2GoShortCut"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]
      "UpdatePDRShortCut"="c:\program files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" [2008-01-04 222504]
      "RemoteControl8"="c:\program files\CyberLink\PowerDVD8\PDVD8Serv.exe" [2009-04-15 91432]
      "PDVD8LanguageShortcut"="c:\program files\CyberLink\PowerDVD8\Language\Language.exe" [2009-04-15 50472]
      "UpdatePPShortCut"="c:\program files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" [2008-12-03 218408]
      "UpdatePSTShortCut"="c:\program files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" [2009-07-21 210216]
      "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-11-04 13830760]
      "mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2010-02-11 1218008]
      "UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]
      "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
      "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
      "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
      "GrpConv"="grpconv -o" [X]

      c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
      McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]

      [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
      "ConsentPromptBehaviorAdmin"= 5 (0x5)
      "ConsentPromptBehaviorUser"= 3 (0x3)
      "EnableUIADesktopToggle"= 0 (0x0)

      [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
      "mixer8"=wdmaud.drv

      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
      @=""

      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
      @=""

      R1 SABI;SAMSUNG Kernel Driver For Windows 7;c:\windows\system32\Drivers\SABI.sys [2009-05-28 10752]
      R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
      R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
      R2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-06-09 136176]
      R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [2010-04-16 93320]
      R2 Rezip;Rezip;c:\windows\SYSTEM32\Rezip.exe [2009-03-05 311296]
      R3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2009-10-26 125696]
      R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
      R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2009-06-27 66080]
      R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-13 139776]
      R3 rtl819xp;Realtek RTL8190\RTL8192E 802.11n Wireless LAN (Mini-)PCI NIC NT Driver;c:\windows\system32\DRIVERS\rtl819xp.sys [2009-06-23 538624]
      R3 WatAdminSvc;Service Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [2010-07-08 1343400]
      R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x86.sys [2009-09-28 315392]

      --- Autres Services/Pilotes en mÈmoire ---

      *Deregistered* - alsljw
      .
      Contenu du dossier 'T'ches planifiÈes'

      2010-07-22 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
      - c:\program files\Google\Update\GoogleUpdate.exe [2010-06-09 16:31]

      2010-07-22 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
      - c:\program files\Google\Update\GoogleUpdate.exe [2010-06-09 16:31]

      2009-12-05 c:\windows\Tasks\McDefragTask.job
      - c:\progra~1\mcafee\mqc\QcConsol.exe [2010-03-27 11:22]

      2009-12-05 c:\windows\Tasks\McQcTask.job
      - c:\progra~1\mcafee\mqc\QcConsol.exe [2010-03-27 11:22]
      .
      .
      ------- Examen supplÈmentaire -------
      .
      uStart Page = hxxp://www.google.com/ig/redirectdomain?brand=smsn&bmod=smsn
      IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
      FF - ProfilePath - c:\users\june\AppData\Roaming\Mozilla\Firefox\Profiles\tbmt3ipm.default\
      FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll
      FF - component: c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll

      ---- PARAMETRES FIREFOX ----
      c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
      c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
      c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
      c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
      c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
      c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
      c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
      c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
      c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
      c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
      c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
      c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
      c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
      c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
      c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
      c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
      c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
      c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
      c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
      c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
      c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
      c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
      c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
      c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
      c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
      .
      - - - - ORPHELINS SUPPRIMES - - - -

      Toolbar-Locked - (no file)
      HKLM-RunOnce-Cleanup - C:\cleanup.exe
      HKLM-RunOnce-<NO NAME> - (no file)

      [HKEY_LOCAL_MACHINE\system\ControlSet001\services\alsljw]

      .
      --------------------- CLES DE REGISTRE BLOQUEES ---------------------

      [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
      @Denied: (Full) (Everyone)
      .
      Heure de fin: 2010-07-23 13:25:42
      ComboFix-quarantined-files.txt 2010-07-23 11:25
      ComboFix2.txt 2010-07-23 10:34

      Avant-CF: 147+763+048+448 octets libres
      AprËs-CF: 147+426+136+064 octets libres

      - - End Of File - - 490A0416ED8A4D366BA35A968C4D8A86
      1. junes23
        mon nouveau rapport combofixe

        ComboFix 10-07-22.01 - june 23/07/2010 13:20:00.1.4 - x86 MINIMAL
        Microsoft Windows+7 ...dition Familiale Premium 6.1.7600.0.1252.33.1036.18.3061.2150 [GMT 2:00]
        LancÈ depuis: c:\users\june\Desktop\ComboFix.exe
        * Un nouveau point de restauration a ÈtÈ crÈÈ
        .

        (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
        .

        C:\cleanup.exe
        c:\programdata\FullRemove.exe
        c:\users\june\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Antimalware Doctor.lnk
        c:\users\june\AppData\Roaming\Microsoft\Windows\Start Menu\Antimalware Doctor.lnk
        c:\users\june\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Antimalware Doctor
        c:\users\june\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Antimalware Doctor\Antimalware Doctor.lnk
        c:\users\june\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Antimalware Doctor\Uninstall.lnk
        c:\users\june\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antimalware Doctor.lnk
        c:\windows\SEC
        c:\windows\SEC\172100logo.bmp
        c:\windows\SEC\banner.png
        c:\windows\SEC\Computer.png
        c:\windows\SEC\Media _S_ Logo.png
        c:\windows\SEC\Samsung.png
        c:\windows\SEC\Samsung2.png
        c:\windows\SEC\SamsungLogo.png
        c:\windows\SEC\Thumbs.db
        c:\windows\SEC\Wallpapers\Thumbs.db
        c:\windows\SEC\Wallpapers\wallpaper.jpg
        c:\windows\SEC\Wallpapers\wallpaper1.jpg
        c:\windows\SEC\Wallpapers\Wallpaper2.jpg
        C:\zip.exe

        .
        ((((((((((((((((((((((((((((( Fichiers crÈÈs du 2010-06-23 au 2010-07-23 ))))))))))))))))))))))))))))))))))))
        .

        2010-07-23 11:24 . 2010-07-23 11:24 -------- d-----w- c:\users\june\AppData\Local\temp
        2010-07-23 11:24 . 2010-07-23 11:24 -------- d-----w- c:\users\Public\AppData\Local\temp
        2010-07-23 11:24 . 2010-07-23 11:24 -------- d-----w- c:\users\Default\AppData\Local\temp
        2010-07-23 09:39 . 2010-07-23 09:52 -------- d-----w- c:\users\june\AppData\Local\ElevatedDiagnostics
        2010-07-22 22:03 . 2010-07-23 11:24 766976 ----a-w- c:\windows\system32\drivers\alsljw.sys
        2010-07-22 22:02 . 2010-07-22 22:02 -------- d-----w- c:\users\june\AppData\Local\mvkvrifwu
        2010-07-22 22:02 . 2010-07-22 22:02 1051136 ----a-w- c:\users\june\AppData\Roaming\AE6B1A3372932F260B2F4EED263A43CA\patchsetup70700.exe
        2010-07-22 22:02 . 2010-07-23 21:13 -------- d-----w- c:\users\june\AppData\Roaming\AE6B1A3372932F260B2F4EED263A43CA
        2010-07-19 15:58 . 2010-07-19 15:58 2944904 ----a-w- c:\users\june\AppData\Roaming\Mozilla\Firefox\Profiles\tbmt3ipm.default\extensions\toolbar@ask.com\chrome\temp\askToolbar.exe
        2010-07-17 20:45 . 2010-07-22 22:07 -------- d-----w- c:\users\june\AppData\Roaming\BitTorrent
        2010-07-17 20:45 . 2010-07-17 20:45 -------- d-----w- c:\program files\Ask.com
        2010-07-17 20:45 . 2010-07-17 20:45 -------- d-----w- c:\program files\BitTorrent
        2010-07-08 20:19 . 2010-07-08 20:19 -------- d-----w- c:\windows\system32\Wat
        2010-07-03 07:37 . 2010-07-03 07:37 -------- d-----w- c:\program files\MSXML 4.0
        2010-07-02 15:05 . 2010-07-02 15:24 -------- d-----w- c:\users\june\AppData\Roaming\DataCast
        2010-07-02 15:05 . 2010-07-02 15:05 -------- d-----w- c:\program files\MarkAny
        2010-07-02 15:03 . 2010-07-02 15:03 -------- d-----w- C:\Manual-PCProgram
        2010-07-02 15:01 . 2010-07-02 15:01 -------- d-----w- c:\users\june\AppData\Roaming\AVS4YOU
        2010-07-02 15:00 . 2010-07-11 15:04 -------- d-----w- c:\program files\Common Files\AVSMedia
        2010-07-02 15:00 . 2008-08-13 09:22 974848 ----a-w- c:\windows\system32\mfc70.dll
        2010-07-02 15:00 . 2008-08-13 09:22 487424 ----a-w- c:\windows\system32\msvcp70.dll
        2010-07-02 15:00 . 2008-08-13 09:22 1700352 ----a-w- c:\windows\system32\GdiPlus.dll
        2010-07-02 15:00 . 2010-07-11 15:04 -------- d-----w- c:\program files\AVS4YOU
        2010-07-02 15:00 . 2010-07-02 15:01 -------- d-----w- c:\programdata\AVS4YOU
        2010-06-24 20:18 . 2009-11-25 10:47 99176 ----a-w- c:\windows\system32\PresentationHostProxy.dll
        2010-06-24 20:18 . 2009-11-25 10:47 49472 ----a-w- c:\windows\system32\netfxperf.dll
        2010-06-24 20:18 . 2009-11-25 10:47 297808 ----a-w- c:\windows\system32\mscoree.dll
        2010-06-24 20:18 . 2009-11-25 10:47 295264 ----a-w- c:\windows\system32\PresentationHost.exe
        2010-06-24 20:18 . 2009-11-25 10:47 1130824 ----a-w- c:\windows\system32\dfshim.dll
        2010-06-24 07:45 . 2010-03-24 06:37 1286456 ----a-w- c:\windows\system32\ntdll.dll
        2010-06-24 07:45 . 2010-05-09 09:14 641536 ----a-w- c:\windows\system32\CPFilters.dll
        2010-06-24 07:45 . 2010-05-09 09:14 417792 ----a-w- c:\windows\system32\msdri.dll

        .
        (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
        .
        2010-07-23 21:13 . 2010-03-28 12:08 -------- d-----w- c:\programdata\McAfee Security Scan
        2010-07-23 11:16 . 2010-07-23 11:16 574 ----a-w- C:\cleanup.bat
        2010-07-23 11:16 . 2010-07-23 11:16 0 ----a-w- C:\backup.reg
        2010-07-23 08:40 . 2009-12-05 04:46 -------- d-----w- c:\program files\McAfee
        2010-07-18 14:04 . 2010-03-30 17:40 -------- d-----w- c:\users\june\AppData\Roaming\vlc
        2010-07-15 13:18 . 2009-12-05 04:49 130424 ----a-w- c:\windows\system32\drivers\Mpfp.sys
        2010-07-11 14:59 . 2010-06-11 16:20 -------- d-----w- c:\program files\Creative
        2010-07-06 19:32 . 2009-12-05 22:11 708852 ----a-w- c:\windows\system32\perfh00C.dat
        2010-07-06 19:32 . 2009-12-05 22:11 132834 ----a-w- c:\windows\system32\perfc00C.dat
        2010-07-02 15:05 . 2009-12-05 04:30 -------- d--h--w- c:\program files\InstallShield Installation Information
        2010-07-02 15:05 . 2009-12-05 04:35 -------- d-----w- c:\program files\Samsung
        2010-06-28 06:26 . 2010-03-27 22:13 -------- d-----w- c:\program files\Microsoft.NET
        2010-06-24 16:58 . 2010-03-27 22:16 87792 ----a-w- c:\users\june\AppData\Local\GDIPFONTCACHEV1.DAT
        2010-06-22 18:24 . 2010-04-07 16:01 -------- d-----w- c:\users\june\AppData\Roaming\dvdcss
        2010-06-22 11:42 . 2010-06-22 11:42 -------- d-----w- c:\program files\AnglaisFacile.com
        2010-06-15 19:55 . 2010-05-16 09:05 -------- d-----w- c:\users\june\AppData\Roaming\Skype
        2010-06-15 19:54 . 2010-05-16 09:06 -------- d-----w- c:\users\june\AppData\Roaming\skypePM
        2010-06-12 00:53 . 2010-03-27 22:11 -------- d-----w- c:\programdata\Microsoft Help
        2010-06-11 20:27 . 2010-06-11 20:17 -------- d-----w- c:\program files\Audible
        2010-06-11 16:25 . 2010-06-11 16:23 -------- d--h--w- c:\program files\Creative Installation Information
        2010-06-11 16:23 . 2010-06-11 16:23 -------- d-----w- c:\program files\Common Files\Creative
        2010-06-11 16:23 . 2010-06-11 16:23 -------- d-----w- c:\program files\Common Files\SWF Studio
        2010-06-11 16:22 . 2010-06-11 16:22 -------- d-----w- c:\programdata\Creative
        2010-06-11 16:05 . 2010-06-11 16:05 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
        2010-06-09 16:58 . 2010-06-09 16:58 -------- d-----w- c:\users\june\AppData\Roaming\Skip-Bo
        2010-06-09 16:57 . 2010-06-09 16:57 -------- d-----w- c:\programdata\Trymedia
        2010-06-09 16:57 . 2010-06-09 16:30 -------- d-----w- c:\program files\RealArcade
        2010-06-09 16:31 . 2010-06-09 16:31 -------- d-----w- c:\programdata\Zylom
        2010-06-09 16:31 . 2010-06-09 16:31 -------- d-----w- c:\program files\Zylom Games
        2010-06-09 16:31 . 2009-12-05 05:01 -------- d-----w- c:\program files\Google
        2010-06-07 20:31 . 2010-03-27 22:20 -------- d-----w- c:\program files\Microsoft Silverlight
        2010-05-27 07:24 . 2010-06-11 16:02 34304 ----a-w- c:\windows\system32\atmlib.dll
        2010-05-27 03:49 . 2010-06-11 16:02 293888 ----a-w- c:\windows\system32\atmfd.dll
        2010-05-24 12:42 . 2009-12-05 05:01 -------- d-----w- c:\programdata\Partner
        2010-05-21 05:18 . 2010-06-11 16:03 977920 ----a-w- c:\windows\system32\wininet.dll
        2010-05-16 09:06 . 2010-05-16 09:06 56 ---ha-w- c:\programdata\ezsidmv.dat
        2010-05-01 14:49 . 2010-06-11 16:03 2326528 ----a-w- c:\windows\system32\win32k.sys
        2009-06-10 21:26 . 2009-07-14 02:04 9633792 --sha-r- c:\windows\Fonts\StaticCache.dat
        2009-07-14 01:14 . 2009-07-13 23:42 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe
        .

        ------- Sigcheck -------

        [-] 2009-07-14 01:19 . 133D4B23C1D480428820C96807C3AB75 . 1285712 . . [------] . . c:\windows\System32\drivers\tcpip.sys
        .
        ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
        .
        .
        *Note* les ÈlÈments vides & les ÈlÈments initiaux lÈgitimes ne sont pas listÈs
        REGEDIT4

        [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
        2010-02-04 14:50 1197448 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
        "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-02-04 1197448]

        [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
        [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
        [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
        [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

        [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "CTSyncU.exe"="c:\program files\Creative\Sync Manager Unicode\CTSyncU.exe" [2006-08-07 700416]
        "patchsetup70700.exe"="c:\users\june\AppData\Roaming\AE6B1A3372932F260B2F4EED263A43CA\patchsetup70700.exe" [2010-07-22 1051136]
        "jfuotrdv"="c:\users\june\AppData\Local\mvkvrifwu\jlvonmutssd.exe" [BU]

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-10-29 7862816]
        "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-10-10 1578280]
        "UpdateLBPShortCut"="c:\program files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]
        "CLMLServer"="c:\program files\CyberLink\Power2Go\CLMLSvc.exe" [2009-06-03 103720]
        "UpdateP2GoShortCut"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]
        "UpdatePDRShortCut"="c:\program files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" [2008-01-04 222504]
        "RemoteControl8"="c:\program files\CyberLink\PowerDVD8\PDVD8Serv.exe" [2009-04-15 91432]
        "PDVD8LanguageShortcut"="c:\program files\CyberLink\PowerDVD8\Language\Language.exe" [2009-04-15 50472]
        "UpdatePPShortCut"="c:\program files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" [2008-12-03 218408]
        "UpdatePSTShortCut"="c:\program files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" [2009-07-21 210216]
        "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-11-04 13830760]
        "mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2010-02-11 1218008]
        "UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]
        "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
        "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
        "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
        "GrpConv"="grpconv -o" [X]

        c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
        McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]

        [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
        "ConsentPromptBehaviorAdmin"= 5 (0x5)
        "ConsentPromptBehaviorUser"= 3 (0x3)
        "EnableUIADesktopToggle"= 0 (0x0)

        [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
        "mixer8"=wdmaud.drv

        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
        @=""

        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
        @=""

        R1 SABI;SAMSUNG Kernel Driver For Windows 7;c:\windows\system32\Drivers\SABI.sys [2009-05-28 10752]
        R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
        R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
        R2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-06-09 136176]
        R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [2010-04-16 93320]
        R2 Rezip;Rezip;c:\windows\SYSTEM32\Rezip.exe [2009-03-05 311296]
        R3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2009-10-26 125696]
        R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
        R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2009-06-27 66080]
        R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-13 139776]
        R3 rtl819xp;Realtek RTL8190\RTL8192E 802.11n Wireless LAN (Mini-)PCI NIC NT Driver;c:\windows\system32\DRIVERS\rtl819xp.sys [2009-06-23 538624]
        R3 WatAdminSvc;Service Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [2010-07-08 1343400]
        R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x86.sys [2009-09-28 315392]

        --- Autres Services/Pilotes en mÈmoire ---

        *Deregistered* - alsljw
        .
        Contenu du dossier 'T'ches planifiÈes'

        2010-07-22 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
        - c:\program files\Google\Update\GoogleUpdate.exe [2010-06-09 16:31]

        2010-07-22 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
        - c:\program files\Google\Update\GoogleUpdate.exe [2010-06-09 16:31]

        2009-12-05 c:\windows\Tasks\McDefragTask.job
        - c:\progra~1\mcafee\mqc\QcConsol.exe [2010-03-27 11:22]

        2009-12-05 c:\windows\Tasks\McQcTask.job
        - c:\progra~1\mcafee\mqc\QcConsol.exe [2010-03-27 11:22]
        .
        .
        ------- Examen supplÈmentaire -------
        .
        uStart Page = hxxp://www.google.com/ig/redirectdomain?brand=smsn&bmod=smsn
        IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
        FF - ProfilePath - c:\users\june\AppData\Roaming\Mozilla\Firefox\Profiles\tbmt3ipm.default\
        FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll
        FF - component: c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll

        ---- PARAMETRES FIREFOX ----
        c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
        c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
        c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
        c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
        c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
        c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
        c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
        c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
        c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
        c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
        c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
        c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
        c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
        c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
        c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
        c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
        c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
        c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
        c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
        c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
        c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
        c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
        c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
        c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
        c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
        .
        - - - - ORPHELINS SUPPRIMES - - - -

        Toolbar-Locked - (no file)
        HKLM-RunOnce-Cleanup - C:\cleanup.exe
        HKLM-RunOnce-<NO NAME> - (no file)

        [HKEY_LOCAL_MACHINE\system\ControlSet001\services\alsljw]

        .
        --------------------- CLES DE REGISTRE BLOQUEES ---------------------

        [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
        @Denied: (Full) (Everyone)
        .
        Heure de fin: 2010-07-23 13:25:42
        ComboFix-quarantined-files.txt 2010-07-23 11:25
        ComboFix2.txt 2010-07-23 10:34

        Avant-CF: 147+763+048+448 octets libres
        AprËs-CF: 147+426+136+064 octets libres

        - - End Of File - - 490A0416ED8A4D366BA35A968C4D8A86
        1. junes23
          voici mon rapport advengerLogfile of The Avenger Version 2.0, (c) by Swandog46
          http://swandog46.geekstogo.com

          Platform: Windows Vista

          *******************

          Script file opened successfully.
          Script file read successfully.

          Backups directory opened successfully at C:\Avenger

          *******************

          Beginning to process script file:

          Rootkit scan active.
          No rootkits found!

          Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\alsljw
          Files to delete:" not found!
          Deletion of driver "alsljw
          Files to delete:" failed!
          Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
          --> the object does not exist

          Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\c:\windows\system32\drivers\alsljw.sys" not found!
          Deletion of driver "c:\windows\system32\drivers\alsljw.sys" failed!
          Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
          --> the object does not exist

          Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\Folder to delete:" not found!
          Deletion of driver "Folder to delete:" failed!
          Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
          --> the object does not exist

          Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\c:\users\june\AppData\Local\mvkvrifwu" not found!
          Deletion of driver "c:\users\june\AppData\Local\mvkvrifwu" failed!
          Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
          --> the object does not exist

          Completed script processing.

          *******************

          Finished! Terminate.
          2. Malekal_morte- Modérateur
            Dégage AstkBar, ça bouffe des ressources pour rien.
            Les barres d'outils sont pas obligatoires.

            Tu es encore infecté.

            Telecharge:: http://www.geekstogo.com/forum/files/file/393-the-avenger-by-swandog46/
            -> http://www.geekstogo.com/forum/files/file/393-the-avenger-by-swandog46/

            * dezippe le , Lance l'épée , executer en tant qu'administrateur sous vista

            Dans le cadre , sous Input Script here , copie_colle le contenu du cadre ci dessous et clic execute:

            begin copying here:
            Drivers to delete:
            alsljw
            Files to delete:
            c:\windows\system32\drivers\alsljw.sys
            Folders to delete:
            c:\users\june\AppData\Local\mvkvrifwu

            * Après le re-démarrage, il crée un fichier log qui s'ouvrira,que tu posteras dans ta prochaine reponse, faisant apparaitre les actions exécutées par The Avenger. Ce fichier log se trouve ici : C:\avenger.txt

            Relance Combofix et poste le rapport ici.

            Rise Against rules :D
            1. junes23
              voici mon rapport

              omboFix 10-07-22.01 - june 23/07/2010 12:29:12.1.4 - x86 MINIMAL
              Microsoft Windows+7 ...dition Familiale Premium 6.1.7600.0.1252.33.1036.18.3061.2152 [GMT 2:00]
              LancÈ depuis: F:\ComboFix.exe
              * Un nouveau point de restauration a ÈtÈ crÈÈ
              .

              (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
              .

              c:\programdata\FullRemove.exe
              c:\system volume information\SystemRestore
              c:\system volume information\SystemRestore\FRStaging\Windows\System32\DriverStore\drvindex.dat
              c:\system volume information\SystemRestore\FRStaging\Windows\System32\DriverStore\INFCACHE.1
              c:\system volume information\SystemRestore\FRStaging\Windows\System32\DriverStore\infpub.dat
              c:\system volume information\SystemRestore\FRStaging\Windows\System32\DriverStore\infstor.dat
              c:\system volume information\SystemRestore\FRStaging\Windows\System32\DriverStore\infstrng.dat
              c:\system volume information\SystemRestore\FRStaging\Windows\System32\NDF\eventlog.etl
              c:\system volume information\SystemRestore\FRStaging\Windows\System32\wfp\wfpdiag.etl
              c:\system volume information\SystemRestore\FRStaging\Windows\Tasks\GoogleUpdateTaskMachineCore.job
              c:\system volume information\SystemRestore\FRStaging\Windows\Tasks\GoogleUpdateTaskMachineUA.job
              c:\system volume information\SystemRestore\FRStaging\Windows\Tasks\SA.DAT
              c:\system volume information\SystemRestore\FRStaging\Windows\Tasks\SCHEDLGU.TXT
              c:\system volume information\SystemRestore\FRStaging\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.1.7600.16385_none_b2f46875c7b9d667\tcpip.sys
              c:\users\june\AppData\Roaming\AE6B1A3372932F260B2F4EED263A43CA
              c:\users\june\AppData\Roaming\AE6B1A3372932F260B2F4EED263A43CA\enemies-names.txt
              c:\users\june\AppData\Roaming\AE6B1A3372932F260B2F4EED263A43CA\local.ini
              c:\users\june\AppData\Roaming\AE6B1A3372932F260B2F4EED263A43CA\lsrslt.ini
              c:\users\june\AppData\Roaming\AE6B1A3372932F260B2F4EED263A43CA\patchsetup70700.exe
              c:\users\june\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Antimalware Doctor.lnk
              c:\users\june\AppData\Roaming\Microsoft\Windows\Start Menu\Antimalware Doctor.lnk
              c:\users\june\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Antimalware Doctor
              c:\users\june\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Antimalware Doctor\Antimalware Doctor.lnk
              c:\users\june\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Antimalware Doctor\Uninstall.lnk
              c:\windows\SEC
              c:\windows\SEC\172100logo.bmp
              c:\windows\SEC\banner.png
              c:\windows\SEC\Computer.png
              c:\windows\SEC\Media _S_ Logo.png
              c:\windows\SEC\Samsung.png
              c:\windows\SEC\Samsung2.png
              c:\windows\SEC\SamsungLogo.png
              c:\windows\SEC\Thumbs.db
              c:\windows\SEC\Wallpapers\Thumbs.db
              c:\windows\SEC\Wallpapers\wallpaper.jpg
              c:\windows\SEC\Wallpapers\wallpaper1.jpg
              c:\windows\SEC\Wallpapers\Wallpaper2.jpg

              .
              ((((((((((((((((((((((((((((( Fichiers crÈÈs du 2010-06-23 au 2010-07-23 ))))))))))))))))))))))))))))))))))))
              .

              2010-07-23 10:32 . 2010-07-23 10:32 -------- d-----w- c:\users\june\AppData\Local\temp
              2010-07-23 10:32 . 2010-07-23 10:32 -------- d-----w- c:\users\Default\AppData\Local\temp
              2010-07-23 09:39 . 2010-07-23 09:52 -------- d-----w- c:\users\june\AppData\Local\ElevatedDiagnostics
              2010-07-22 22:03 . 2010-07-23 10:32 766976 ----a-w- c:\windows\system32\drivers\alsljw.sys
              2010-07-22 22:02 . 2010-07-22 22:02 -------- d-----w- c:\users\june\AppData\Local\mvkvrifwu
              2010-07-19 15:58 . 2010-07-19 15:58 2944904 ----a-w- c:\users\june\AppData\Roaming\Mozilla\Firefox\Profiles\tbmt3ipm.default\extensions\toolbar@ask.com\chrome\temp\askToolbar.exe
              2010-07-17 20:45 . 2010-07-22 22:07 -------- d-----w- c:\users\june\AppData\Roaming\BitTorrent
              2010-07-17 20:45 . 2010-07-17 20:45 -------- d-----w- c:\program files\Ask.com
              2010-07-17 20:45 . 2010-07-17 20:45 -------- d-----w- c:\program files\BitTorrent
              2010-07-08 20:19 . 2010-07-08 20:19 -------- d-----w- c:\windows\system32\Wat
              2010-07-03 07:37 . 2010-07-03 07:37 -------- d-----w- c:\program files\MSXML 4.0
              2010-07-02 15:05 . 2010-07-02 15:24 -------- d-----w- c:\users\june\AppData\Roaming\DataCast
              2010-07-02 15:05 . 2010-07-02 15:05 -------- d-----w- c:\program files\MarkAny
              2010-07-02 15:03 . 2010-07-02 15:03 -------- d-----w- C:\Manual-PCProgram
              2010-07-02 15:01 . 2010-07-02 15:01 -------- d-----w- c:\users\june\AppData\Roaming\AVS4YOU
              2010-07-02 15:00 . 2010-07-11 15:04 -------- d-----w- c:\program files\Common Files\AVSMedia
              2010-07-02 15:00 . 2008-08-13 09:22 974848 ----a-w- c:\windows\system32\mfc70.dll
              2010-07-02 15:00 . 2008-08-13 09:22 487424 ----a-w- c:\windows\system32\msvcp70.dll
              2010-07-02 15:00 . 2008-08-13 09:22 1700352 ----a-w- c:\windows\system32\GdiPlus.dll
              2010-07-02 15:00 . 2010-07-11 15:04 -------- d-----w- c:\program files\AVS4YOU
              2010-07-02 15:00 . 2010-07-02 15:01 -------- d-----w- c:\programdata\AVS4YOU
              2010-06-24 20:18 . 2009-11-25 10:47 99176 ----a-w- c:\windows\system32\PresentationHostProxy.dll
              2010-06-24 20:18 . 2009-11-25 10:47 49472 ----a-w- c:\windows\system32\netfxperf.dll
              2010-06-24 20:18 . 2009-11-25 10:47 297808 ----a-w- c:\windows\system32\mscoree.dll
              2010-06-24 20:18 . 2009-11-25 10:47 295264 ----a-w- c:\windows\system32\PresentationHost.exe
              2010-06-24 20:18 . 2009-11-25 10:47 1130824 ----a-w- c:\windows\system32\dfshim.dll
              2010-06-24 07:45 . 2010-03-24 06:37 1286456 ----a-w- c:\windows\system32\ntdll.dll
              2010-06-24 07:45 . 2010-05-09 09:14 641536 ----a-w- c:\windows\system32\CPFilters.dll
              2010-06-24 07:45 . 2010-05-09 09:14 417792 ----a-w- c:\windows\system32\msdri.dll

              .
              (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
              .
              2010-07-23 10:13 . 2009-12-05 22:11 708614 ----a-w- c:\windows\system32\perfh00C.dat
              2010-07-23 10:13 . 2009-12-05 22:11 132628 ----a-w- c:\windows\system32\perfc00C.dat
              2010-07-23 08:40 . 2009-12-05 04:46 -------- d-----w- c:\program files\McAfee
              2010-07-18 14:04 . 2010-03-30 17:40 -------- d-----w- c:\users\june\AppData\Roaming\vlc
              2010-07-15 13:18 . 2009-12-05 04:49 130424 ----a-w- c:\windows\system32\drivers\Mpfp.sys
              2010-07-11 14:59 . 2010-06-11 16:20 -------- d-----w- c:\program files\Creative
              2010-07-02 15:05 . 2009-12-05 04:30 -------- d--h--w- c:\program files\InstallShield Installation Information
              2010-07-02 15:05 . 2009-12-05 04:35 -------- d-----w- c:\program files\Samsung
              2010-06-28 06:26 . 2010-03-27 22:13 -------- d-----w- c:\program files\Microsoft.NET
              2010-06-24 16:58 . 2010-03-27 22:16 87792 ----a-w- c:\users\june\AppData\Local\GDIPFONTCACHEV1.DAT
              2010-06-22 18:24 . 2010-04-07 16:01 -------- d-----w- c:\users\june\AppData\Roaming\dvdcss
              2010-06-22 11:42 . 2010-06-22 11:42 -------- d-----w- c:\program files\AnglaisFacile.com
              2010-06-15 19:55 . 2010-05-16 09:05 -------- d-----w- c:\users\june\AppData\Roaming\Skype
              2010-06-15 19:54 . 2010-05-16 09:06 -------- d-----w- c:\users\june\AppData\Roaming\skypePM
              2010-06-12 00:53 . 2010-03-27 22:11 -------- d-----w- c:\programdata\Microsoft Help
              2010-06-11 20:27 . 2010-06-11 20:17 -------- d-----w- c:\program files\Audible
              2010-06-11 16:25 . 2010-06-11 16:23 -------- d--h--w- c:\program files\Creative Installation Information
              2010-06-11 16:23 . 2010-06-11 16:23 -------- d-----w- c:\program files\Common Files\Creative
              2010-06-11 16:23 . 2010-06-11 16:23 -------- d-----w- c:\program files\Common Files\SWF Studio
              2010-06-11 16:22 . 2010-06-11 16:22 -------- d-----w- c:\programdata\Creative
              2010-06-11 16:05 . 2010-06-11 16:05 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
              2010-06-09 16:58 . 2010-06-09 16:58 -------- d-----w- c:\users\june\AppData\Roaming\Skip-Bo
              2010-06-09 16:57 . 2010-06-09 16:57 -------- d-----w- c:\programdata\Trymedia
              2010-06-09 16:57 . 2010-06-09 16:30 -------- d-----w- c:\program files\RealArcade
              2010-06-09 16:31 . 2010-06-09 16:31 -------- d-----w- c:\programdata\Zylom
              2010-06-09 16:31 . 2010-06-09 16:31 -------- d-----w- c:\program files\Zylom Games
              2010-06-09 16:31 . 2009-12-05 05:01 -------- d-----w- c:\program files\Google
              2010-06-07 20:31 . 2010-03-27 22:20 -------- d-----w- c:\program files\Microsoft Silverlight
              2010-05-27 07:24 . 2010-06-11 16:02 34304 ----a-w- c:\windows\system32\atmlib.dll
              2010-05-27 03:49 . 2010-06-11 16:02 293888 ----a-w- c:\windows\system32\atmfd.dll
              2010-05-24 12:42 . 2009-12-05 05:01 -------- d-----w- c:\programdata\Partner
              2010-05-21 05:18 . 2010-06-11 16:03 977920 ----a-w- c:\windows\system32\wininet.dll
              2010-05-16 09:06 . 2010-05-16 09:06 56 ---ha-w- c:\programdata\ezsidmv.dat
              2010-05-01 14:49 . 2010-06-11 16:03 2326528 ----a-w- c:\windows\system32\win32k.sys
              2009-06-10 21:26 . 2009-07-14 02:04 9633792 --sha-r- c:\windows\Fonts\StaticCache.dat
              2009-07-14 01:14 . 2009-07-13 23:42 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe
              .

              ------- Sigcheck -------

              [-] 2009-07-14 01:19 . 133D4B23C1D480428820C96807C3AB75 . 1285712 . . [------] . . c:\windows\System32\drivers\tcpip.sys
              .
              ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
              .
              .
              *Note* les ÈlÈments vides & les ÈlÈments initiaux lÈgitimes ne sont pas listÈs
              REGEDIT4

              [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
              2010-02-04 14:50 1197448 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll

              [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
              "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-02-04 1197448]

              [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
              [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
              [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
              [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

              [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
              "CTSyncU.exe"="c:\program files\Creative\Sync Manager Unicode\CTSyncU.exe" [2006-08-07 700416]

              [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
              "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-10-29 7862816]
              "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-10-10 1578280]
              "UpdateLBPShortCut"="c:\program files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]
              "CLMLServer"="c:\program files\CyberLink\Power2Go\CLMLSvc.exe" [2009-06-03 103720]
              "UpdateP2GoShortCut"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]
              "UpdatePDRShortCut"="c:\program files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" [2008-01-04 222504]
              "RemoteControl8"="c:\program files\CyberLink\PowerDVD8\PDVD8Serv.exe" [2009-04-15 91432]
              "PDVD8LanguageShortcut"="c:\program files\CyberLink\PowerDVD8\Language\Language.exe" [2009-04-15 50472]
              "UpdatePPShortCut"="c:\program files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" [2008-12-03 218408]
              "UpdatePSTShortCut"="c:\program files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" [2009-07-21 210216]
              "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-11-04 13830760]
              "mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2010-02-11 1218008]
              "UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]
              "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
              "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
              "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]

              [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
              "GrpConv"="grpconv -o" [X]

              c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
              McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]

              [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
              "ConsentPromptBehaviorAdmin"= 5 (0x5)
              "ConsentPromptBehaviorUser"= 3 (0x3)
              "EnableUIADesktopToggle"= 0 (0x0)

              [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
              "mixer8"=wdmaud.drv

              [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
              @=""

              [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
              @=""

              [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mfehidk.sys]
              @="Driver"

              [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mferkdk.sys]
              @="Driver"

              R1 SABI;SAMSUNG Kernel Driver For Windows 7;c:\windows\system32\Drivers\SABI.sys [2009-05-28 10752]
              R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
              R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
              R2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-06-09 136176]
              R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [2010-04-16 93320]
              R2 Rezip;Rezip;c:\windows\SYSTEM32\Rezip.exe [2009-03-05 311296]
              R3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2009-10-26 125696]
              R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
              R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2009-06-27 66080]
              R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-13 139776]
              R3 rtl819xp;Realtek RTL8190\RTL8192E 802.11n Wireless LAN (Mini-)PCI NIC NT Driver;c:\windows\system32\DRIVERS\rtl819xp.sys [2009-06-23 538624]
              R3 WatAdminSvc;Service Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [2010-07-08 1343400]
              R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x86.sys [2009-09-28 315392]

              --- Autres Services/Pilotes en mÈmoire ---

              *Deregistered* - alsljw
              .
              Contenu du dossier 'T'ches planifiÈes'

              2010-07-22 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
              - c:\program files\Google\Update\GoogleUpdate.exe [2010-06-09 16:31]

              2010-07-22 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
              - c:\program files\Google\Update\GoogleUpdate.exe [2010-06-09 16:31]

              2009-12-05 c:\windows\Tasks\McDefragTask.job
              - c:\progra~1\mcafee\mqc\QcConsol.exe [2010-03-27 11:22]

              2009-12-05 c:\windows\Tasks\McQcTask.job
              - c:\progra~1\mcafee\mqc\QcConsol.exe [2010-03-27 11:22]
              .
              .
              ------- Examen supplÈmentaire -------
              .
              uStart Page = hxxp://www.google.com/ig/redirectdomain?brand=smsn&bmod=smsn
              IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
              FF - ProfilePath - c:\users\june\AppData\Roaming\Mozilla\Firefox\Profiles\tbmt3ipm.default\
              FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll
              FF - component: c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll
              FF - plugin: c:\program files\Google\Update\1.2.183.29\npGoogleOneClick8.dll
              FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
              FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
              FF - plugin: c:\programdata\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll

              ---- PARAMETRES FIREFOX ----
              c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
              c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
              c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
              c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
              c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
              c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
              c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
              c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
              c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
              c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
              c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
              c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
              c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
              c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
              c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
              c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
              c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
              c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
              c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
              c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
              c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
              c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
              c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
              c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
              c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
              .
              - - - - ORPHELINS SUPPRIMES - - - -

              Toolbar-Locked - (no file)
              HKCU-Run-patchsetup70700.exe - c:\users\june\AppData\Roaming\AE6B1A3372932F260B2F4EED263A43CA\patchsetup70700.exe
              HKCU-Run-jfuotrdv - c:\users\june\AppData\Local\mvkvrifwu\jlvonmutssd.exe
              HKLM-RunOnce-<NO NAME> - (no file)
              SafeBoot-mfehidk
              SafeBoot-mferkdk
              SafeBoot-mfetdik
              SafeBoot-mfetdik.sys

              [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\alsljw]

              .
              --------------------- CLES DE REGISTRE BLOQUEES ---------------------

              [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
              @Denied: (Full) (Everyone)
              .
              Heure de fin: 2010-07-23 12:34:13
              ComboFix-quarantined-files.txt 2010-07-23 10:34

              Avant-CF: 147+622+903+808 octets libres
              AprËs-CF: 147+667+914+752 octets libres

              - - End Of File - - 3A724F529B238FF7062693D391AC1E67
              1. Malekal_morte- Modérateur
                Salut,

                Sauvegarde tes documents importants.

                Désactive les logiciels de protection (Antivirus, Antispywares) puis :

                Télécharge Combofix sUBs : http://download.bleepingcomputer.com/sUBs/ComboFix.exe et sauvegarde le sur ton bureau et pas ailleurs!

                Double-clic sur combofix, accepte la licence d'utilisation et laisse toi guider.

                Eventuellement, installe la console de récupération comme cela est conseillé

                Attends que combofix ait terminé, un rapport sera créé. Poste le rapport.
                Si le rapport ne passe pas, envoie le sur ce site : http://www.cijoint.fr/
                et donne le lien ici :)

                Tu as le tutorial sur ce lien pour t'aider : https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

                PS : si Combofix ne se lance pas, renomme le fichier Combofix et retente.

                Si pas mieux, tente en mode sans échec sans prise en charge du réseau : Redémarre en mode sans échec, pour cela, redémarre l'ordinateur, avant le logo Windows, tapote sur la touche F8, un menu va apparaître, choisis Mode sans échec et appuye sur la touche entrée du clavier.

                Discussions similaires

                Antimalware service Executable consomme 45% de RAM.
                KalenShiv

                8 réponses
                Désactiver Antimalware Service Executable
                quentin882

                8 réponses
                Antimalware service executable windows : problème
                Pierre

                11 réponses
                Volume musique de fond Netflix trop fort
                Mimi_1611

                17 réponses