Problème Bad Pool Header et ouverture Firefox

Aucun problèmes apparement !

Rien d'infectieux ...

Quels sont les problemes qui persistent ?

Voilà le rapport Combofix :

ComboFix 11-01-11.03 - Tanguy 14/01/2011 13:00:40.1.2 - x86
Microsoft Windows 7 Professionnel 6.1.7600.0.1252.33.1036.18.3067.2078 [GMT 1:00]
Lancé depuis: c:\users\Tanguy\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\Tanguy\AppData\Roaming\dach100.dll
c:\users\Tanguy\AppData\Roaming\sys

.
((((((((((((((((((((((((((((( Fichiers créés du 2010-12-14 au 2011-01-14 ))))))))))))))))))))))))))))))))))))
.

2011-01-14 12:06 . 2011-01-14 12:06 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-01-13 19:51 . 2011-01-13 19:51 -------- d-----w- C:\_OTM
2011-01-13 17:03 . 2011-01-13 17:23 -------- d-----w- C:\UsbFix
2011-01-13 10:33 . 2010-11-10 04:33 6273872 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{087CFDCB-9FBD-4941-997D-73912A9ED1B9}\mpengine.dll
2011-01-12 21:55 . 2011-01-13 16:20 -------- d-----w- C:\tdsskiller
2011-01-12 19:03 . 2011-01-12 19:03 -------- d-----w- c:\programdata\ATI
2011-01-12 19:03 . 2011-01-12 19:03 -------- d-----w- c:\program files\Common Files\ATI Technologies
2011-01-12 19:03 . 2011-01-13 21:38 -------- d-----w- c:\program files\ZHPDiag
2011-01-12 18:57 . 2010-11-05 22:39 354840 ----a-w- c:\windows\system32\drivers\iaStor.sys
2011-01-12 18:09 . 2011-01-12 21:28 -------- d-----w- c:\users\Tanguy\AppData\Local\Google
2011-01-12 18:09 . 2011-01-12 20:23 -------- d-----w- c:\users\Tanguy\AppData\Local\Deployment
2011-01-12 18:09 . 2011-01-12 18:09 -------- d-----w- c:\users\Tanguy\AppData\Local\Apps
2011-01-12 16:39 . 2011-01-12 16:39 -------- d-----w- c:\users\Tanguy\AppData\Roaming\Malwarebytes
2011-01-12 16:39 . 2010-12-20 17:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-01-12 16:39 . 2011-01-12 16:39 -------- d-----w- c:\programdata\Malwarebytes
2011-01-12 16:39 . 2011-01-12 16:39 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-01-12 16:39 . 2010-12-20 17:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-01-12 15:31 . 2011-01-12 15:31 -------- d-----w- c:\program files\Dachshund Software
2011-01-12 15:13 . 2011-01-12 15:14 -------- d--h--w- c:\windows\AxInstSV
2011-01-10 20:23 . 2011-01-10 20:23 -------- d-----w- c:\program files\Bonjour
2010-12-28 18:07 . 2010-12-28 18:07 -------- d-----w- c:\windows\Sun
2010-12-27 10:58 . 2010-12-27 10:58 -------- d-----w- c:\program files\VirtualDJ
2010-12-22 18:27 . 2011-01-04 11:28 -------- d-----w- c:\programdata\lx_Cats
2010-12-22 18:27 . 2009-08-13 11:02 147968 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\lxdndrpp.dll
2010-12-22 09:59 . 2006-04-19 01:00 62976 ----a-w- c:\windows\system32\E_FD4BBVE.DLL
2010-12-20 09:49 . 2010-12-20 09:49 -------- d-----w- c:\program files\Infogrames
2010-12-19 21:45 . 2010-12-19 21:45 -------- d-----w- c:\program files\directx
2010-12-19 20:31 . 2010-12-19 20:31 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2010-12-19 18:17 . 2010-12-19 18:17 40960 ----a-r- c:\users\Tanguy\AppData\Roaming\Microsoft\Installer\{9559F7CA-5E34-4237-A2D9-D856464AD727}\NewShortcut1_9559F7CA5E344237A2D9D856464AD727.exe
2010-12-19 18:17 . 2010-12-19 18:17 40960 ----a-r- c:\users\Tanguy\AppData\Roaming\Microsoft\Installer\{9559F7CA-5E34-4237-A2D9-D856464AD727}\ARPPRODUCTICON.exe
2010-12-19 18:17 . 2010-12-19 18:18 -------- d-----w- c:\program files\Project64 1.6
2010-12-15 17:19 . 2010-10-12 04:25 516096 ----a-w- c:\program files\Windows Mail\wab.exe
2010-12-15 17:19 . 2010-10-27 04:32 2048 ----a-w- c:\windows\system32\tzres.dll
2010-12-15 17:19 . 2010-11-02 04:41 351232 ----a-w- c:\windows\system32\wmicmiplugin.dll
2010-12-15 17:19 . 2010-11-02 04:40 496128 ----a-w- c:\windows\system32\taskschd.dll
2010-12-15 17:19 . 2010-11-02 04:40 305152 ----a-w- c:\windows\system32\taskcomp.dll
2010-12-15 17:19 . 2010-11-02 04:39 749056 ----a-w- c:\windows\system32\schedsvc.dll
2010-12-15 17:19 . 2010-11-02 04:34 192000 ----a-w- c:\windows\system32\taskeng.exe
2010-12-15 17:19 . 2010-11-02 04:34 179712 ----a-w- c:\windows\system32\schtasks.exe
2010-12-15 17:18 . 2010-10-20 04:54 34304 ----a-w- c:\windows\system32\atmlib.dll
2010-12-15 17:18 . 2010-10-20 02:58 294400 ----a-w- c:\windows\system32\atmfd.dll
2010-12-15 17:18 . 2010-10-16 04:36 314368 ----a-w- c:\windows\system32\webio.dll
2010-12-15 17:18 . 2010-10-16 04:41 101760 ----a-w- c:\windows\system32\consent.exe
2010-12-15 17:17 . 2010-10-20 03:00 2327552 ----a-w- c:\windows\system32\win32k.sys

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-01-13 17:23 . 2011-01-13 17:23 83702800 ----a-w- C:\UsbFix_Upload_Me_TANGUY-PC.zip
2010-12-15 21:49 . 2009-12-15 13:27 135096 ----a-w- c:\windows\system32\drivers\avipbb.sys
2010-12-15 21:49 . 2009-12-15 12:33 61960 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2010-11-29 16:38 . 2010-11-29 16:38 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2010-11-29 16:38 . 2010-11-29 16:38 69632 ----a-w- c:\windows\system32\QuickTime.qts
2010-11-26 04:19 . 2010-11-26 04:19 6650368 ----a-w- c:\windows\system32\drivers\atikmdag.sys
2010-11-26 03:02 . 2010-11-26 03:02 16702976 ----a-w- c:\windows\system32\atioglxx.dll
2010-11-26 02:58 . 2010-11-26 02:58 143360 ----a-w- c:\windows\system32\atiapfxx.exe
2010-11-26 02:58 . 2010-05-05 02:19 550400 ----a-w- c:\windows\system32\aticfx32.dll
2010-11-26 02:54 . 2010-11-26 02:54 462848 ----a-w- c:\windows\system32\ATIDEMGX.dll
2010-11-26 02:54 . 2010-11-26 02:54 393216 ----a-w- c:\windows\system32\atieclxx.exe
2010-11-26 02:54 . 2010-11-26 02:54 176128 ----a-w- c:\windows\system32\atiesrxx.exe
2010-11-26 02:52 . 2010-11-26 02:52 159744 ----a-w- c:\windows\system32\atitmmxx.dll
2010-11-26 02:52 . 2010-11-26 02:52 356352 ----a-w- c:\windows\system32\atipdlxx.dll
2010-11-26 02:52 . 2010-11-26 02:52 278528 ----a-w- c:\windows\system32\Oemdspif.dll
2010-11-26 02:52 . 2010-11-26 02:52 15872 ----a-w- c:\windows\system32\atimuixx.dll
2010-11-26 02:52 . 2010-11-26 02:52 43520 ----a-w- c:\windows\system32\ati2edxx.dll
2010-11-26 02:49 . 2009-07-13 22:09 4066816 ----a-w- c:\windows\system32\atidxx32.dll
2010-11-26 02:30 . 2010-11-26 02:30 4122624 ----a-w- c:\windows\system32\atiumdag.dll
2010-11-26 02:30 . 2010-11-26 02:30 46080 ----a-w- c:\windows\system32\aticalrt.dll
2010-11-26 02:30 . 2010-11-26 02:30 44032 ----a-w- c:\windows\system32\aticalcl.dll
2010-11-26 02:28 . 2010-11-26 02:28 5441024 ----a-w- c:\windows\system32\aticaldd.dll
2010-11-26 02:24 . 2010-05-05 01:34 52736 ----a-w- c:\windows\system32\coinst.dll
2010-11-26 02:22 . 2010-11-26 02:22 3460096 ----a-w- c:\windows\system32\atiumdva.dll
2010-11-26 02:17 . 2010-11-26 02:17 249856 ----a-w- c:\windows\system32\atiadlxx.dll
2010-11-26 02:17 . 2010-11-26 02:17 12800 ----a-w- c:\windows\system32\atiglpxx.dll
2010-11-26 02:16 . 2010-11-26 02:16 27136 ----a-w- c:\windows\system32\atigktxx.dll
2010-11-26 02:16 . 2010-11-26 02:16 231936 ----a-w- c:\windows\system32\drivers\atikmpag.sys
2010-11-26 02:15 . 2010-05-05 01:22 30720 ----a-w- c:\windows\system32\atiuxpag.dll
2010-11-26 02:15 . 2010-11-26 02:15 28672 ----a-w- c:\windows\system32\atiu9pag.dll
2010-11-26 02:15 . 2010-11-26 02:15 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll
2010-11-26 02:09 . 2010-11-26 02:09 52736 ----a-w- c:\windows\system32\atimpc32.dll
2010-11-26 02:09 . 2010-11-26 02:09 52736 ----a-w- c:\windows\system32\amdpcom32.dll
2010-11-12 17:53 . 2010-05-15 21:19 472808 ----a-w- c:\windows\system32\deployJava1.dll
2010-11-01 23:03 . 2010-11-26 23:17 1448448 ----a-w- c:\windows\system32\inetcpl.cpl
2010-11-01 22:59 . 2010-11-26 23:17 2381824 ----a-w- c:\windows\system32\mshtml.tlb
2010-10-19 09:41 . 2009-12-15 12:25 222080 ------w- c:\windows\system32\MpSigStub.exe
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2009-10-30 369200]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2009-02-03 111856]
"Steam"="c:\program files\Steam\Steam.exe" [2010-11-17 1242448]
"Neuf Media Center"="c:\program files\SFR\Media Center\MediaCenter.exe" [2008-10-10 726336]
"RESTART_STICKY_NOTES"="c:\windows\System32\StikyNot.exe" [2009-07-14 354304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-08-17 281768]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2009-02-03 111856]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-11-25 98304]
"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2010-05-10 439568]
"IAStorIcon"="c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-11-05 283160]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-08-05 7703072]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-09-01 1164584]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-24 421160]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-12-20 963976]

c:\users\Tanguy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
AntiCrash.lnk - c:\program files\Dachshund Software\AntiCrash\AntiCrash.exe [2002-12-17 2301798]
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-12-15 384000]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

R0 mnnkhhs;mnnkhhs;c:\windows\System32\drivers\uitjhi.sys [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gvohgndt;GEAR ASPI Filter Helper;c:\windows\System32\svchost.exe [2009-07-14 20992]
R3 IRS1600L;Voicetracerxp.Sys Voice Tracer Communication driver;c:\windows\system32\Drivers\VoiceTracerxp.sys [2002-11-11 16640]
R3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [2011-01-09 310640]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [2010-03-25 30969208]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504]
R3 WatAdminSvc;Service Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [2010-06-08 1343400]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-11-26 176128]
S2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [2010-08-17 135336]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-11-05 13336]
S2 lxdn_device;lxdn_device;c:\windows\system32\lxdncoms.exe [2007-11-28 589824]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2010-11-26 6650368]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-11-26 231936]
S3 k57nd60x;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60x.sys [2009-07-13 229888]
S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
gvohgndt
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://fr.yahoo.com/
uInternet Settings,ProxyOverride = *.local
IE: &Envoyer à OneNote - c:\progra~1\MICROS~3\Office14\ONBttnIE.dll/105
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office14\EXCEL.EXE/3000
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL
FF - ProfilePath - c:\users\Tanguy\AppData\Roaming\Mozilla\Firefox\Profiles\8dhsq5t6.default\
FF - prefs.js: browser.startup.homepage - hxxp://m.fr.yahoo.com/?fr=fptb-tyc8
FF - prefs.js: network.proxy.type - 0
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
FF - Ext: Interest Recognizer for Crazyloader: crazyloader@spointer.com - c:\program files\CrazyLoader\spointer\extensions\crazyloader@spointer.com
.
- - - - ORPHELINS SUPPRIMES - - - -

BHO-{CA99B718-B718-CA99-18B7-99CA18B799CA} - c:\windows\system32\alk2d83.dll
HKCU-Run-EA Core - c:\program files\Electronic Arts\EADM\Core.exe
HKLM-Run-DATAMNGR - c:\progra~1\WIA6EB~1\Datamngr\DATAMN~1.EXE
SafeBoot-klmdb.sys
AddRemove-Bandoo - c:\program files\Fun4IM\PreUninstall.exe
AddRemove-OfferBox Browser - c:\program files\OfferBox\uninst.exe
AddRemove-{E2883E8F-472F-4fb0-9522-AC9BF37916A7} - c:\program files\NOS\bin\getPlus_Helper.dll

.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-696869605-3829081844-908571491-1001\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
"??"=hex:b0,97,85,9a,f8,02,1a,d5,aa,ca,37,48,56,06,c1,71,69,b3,c6,c8,f2,75,fb,
27,2e,eb,ca,fa,7b,8d,3f,0c,2e,a0,7e,f3,dd,07,38,32,59,6b,b5,c8,60,3e,9a,9d,\
"??"=hex:f6,37,fa,cc,f5,ce,b5,5f,37,5d,51,f0,8d,78,df,e1

[HKEY_USERS\S-1-5-21-696869605-3829081844-908571491-1001\Software\SecuROM\License information*]
"datasecu"=hex:6b,60,61,c6,96,d8,8f,72,dd,e6,31,b0,73,01,e9,40,86,95,4a,16,51,
ee,ee,2c,f0,c9,e1,c7,bb,df,f8,05,a0,68,20,71,f5,86,9d,29,d3,fa,70,8b,54,12,\
"rkeysecu"=hex:62,6c,8d,a2,6a,ac,09,b2,e5,73,43,9a,b3,bb,9a,45

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Heure de fin: 2011-01-14 13:08:33
ComboFix-quarantined-files.txt 2011-01-14 12:08

Avant-CF: 190 321 364 992 octets libres
Après-CF: 190 213 574 656 octets libres

- - End Of File - - AB8D9B539C10E0CBD183F7A2BC501027

J'aimerais quand meme que tu puisses lancer Combofix (essaie en cliquant droit "éxécuter en tant qu'admin") ,cela permettrait de voir si un rootkit est caché derriere .

Non enfin j'ai fait comme décrit dans le post. Cela te sembles bizare ?

Je ne vois plus d'infections sur ton dernier rapport . As tu redémarré le pc entre temps ?

Le virus est donc supprimé ou il est encore sur mon ordinateur ?

ahhh c'est bon, voici le rapport :

Rapport de ZHPFix 1.12.3237 par Nicolas Coolman, Update du 12/01/2011
Fichier d'export Registre :
Run by Tanguy at 13/01/2011 22:38:42
Windows 7 Business Edition, 32-bit (Build 7600)
Web site : http://www.premiumorange.com/zeb-help-process/zhpfix.html
Contact : nicolascoolman@yahoo.fr

========== Clé(s) du Registre ==========
HKCU\Software\DataMngr => Clé supprimée avec succès
HKCU\Software\Spointer => Clé supprimée avec succès
HKLM\Software\DataMngr => Clé supprimée avec succès
HKLM\Software\OfferBox => Clé supprimée avec succès

========== Valeur(s) du Registre ==========
O81 - IFC: Internet Feature Controls [HKUS\.DEFAULT] [FEATURE_BROWSER_EMULATION] -- svchost.exe => Valeur absente
O81 - IFC: Internet Feature Controls [HKUS\S-1-5-18] [FEATURE_BROWSER_EMULATION] -- svchost.exe => Valeur absente

========== Récapitulatif ==========
4 : Clé(s) du Registre
2 : Valeur(s) du Registre

End of the scan

Alors oui plus de problème avec Firefox, seulement mon pc est super long !!
C'est pour ça je n'arrive même pas a aller sur la page pour pouvoir poster le rapport !
Je t'ecris avec mon iPhone la.

Tu as lu le dernier message ?

Que faut-il que je fasse ensuite ?

Déconnecte toi d'Internet et ferme toutes les applications ouvertes.

1/Double Clique sur l'icone ZhpFix .

2/ZhpFix va s'ouvrir ,clique sur "importer un rapport ZhpDiag" puis "ok" .

3/Laisse travailler l'outil.

4/Coche ces cases (et pas d'autres !):

[HKCU\Software\DataMngr]
[HKCU\Software\Spointer]
[HKLM\Software\DataMngr]
[HKLM\Software\OfferBox]
O81 - IFC: Internet Feature Controls [HKUS\.DEFAULT] [FEATURE_BROWSER_EMULATION] -- svchost.exe
O81 - IFC: Internet Feature Controls [HKUS\S-1-5-18] [FEATURE_BROWSER_EMULATION] -- svchost.exe

5/Pour finir clique sur "Nettoyer" .

6/colle le rapport obtenu .

Toujours le meme soucis avec firefox ?

Désolé, j'étais partis au sport. Voilà le rapport de OTM :

All processes killed
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7FF99715-3016-4381-84CE-E4E4C9673020}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7FF99715-3016-4381-84CE-E4E4C9673020}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7FF99715-3016-4381-84CE-E4E4C9673020}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7FF99715-3016-4381-84CE-E4E4C9673020}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FC0D62C2-9640-4AEB-A5D5-CF25DF11FA8C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FC0D62C2-9640-4AEB-A5D5-CF25DF11FA8C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FC0D62C2-9640-4AEB-A5D5-CF25DF11FA8C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FC0D62C2-9640-4AEB-A5D5-CF25DF11FA8C}\ not found.
Registry key HKEY_CLASSES_ROOT\CLSID\{7FF99715-3016-4381-84CE-E4E4C9673020}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7FF99715-3016-4381-84CE-E4E4C9673020}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7FF99715-3016-4381-84CE-E4E4C9673020}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7FF99715-3016-4381-84CE-E4E4C9673020}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{7FF99715-3016-4381-84CE-E4E4C9673020} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7FF99715-3016-4381-84CE-E4E4C9673020}\ not found.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\"AppInit_DLLs"|"" /E : value set successfully!
========== FILES ==========
C:\Program Files\Windows Searchqu Toolbar\ToolBar\components folder moved successfully.
C:\Program Files\Windows Searchqu Toolbar\ToolBar\chrome\skin\searchbar folder moved successfully.
C:\Program Files\Windows Searchqu Toolbar\ToolBar\chrome\skin\options folder moved successfully.
C:\Program Files\Windows Searchqu Toolbar\ToolBar\chrome\skin\lib\weatherbutton\panels\images folder moved successfully.
C:\Program Files\Windows Searchqu Toolbar\ToolBar\chrome\skin\lib\weatherbutton\panels folder moved successfully.
C:\Program Files\Windows Searchqu Toolbar\ToolBar\chrome\skin\lib\weatherbutton\icons folder moved successfully.
C:\Program Files\Windows Searchqu Toolbar\ToolBar\chrome\skin\lib\weatherbutton folder moved successfully.
C:\Program Files\Windows Searchqu Toolbar\ToolBar\chrome\skin\lib\uwa folder moved successfully.
C:\Program Files\Windows Searchqu Toolbar\ToolBar\chrome\skin\lib\radio\images folder moved successfully.
C:\Program Files\Windows Searchqu Toolbar\ToolBar\chrome\skin\lib\radio\css folder moved successfully.
C:\Program Files\Windows Searchqu Toolbar\ToolBar\chrome\skin\lib\radio folder moved successfully.
C:\Program Files\Windows Searchqu Toolbar\ToolBar\chrome\skin\lib\panels\images folder moved successfully.
C:\Program Files\Windows Searchqu Toolbar\ToolBar\chrome\skin\lib\panels\css folder moved successfully.
C:\Program Files\Windows Searchqu Toolbar\ToolBar\chrome\skin\lib\panels folder moved successfully.
C:\Program Files\Windows Searchqu Toolbar\ToolBar\chrome\skin\lib folder moved successfully.
C:\Program Files\Windows Searchqu Toolbar\ToolBar\chrome\skin folder moved successfully.
C:\Program Files\Windows Searchqu Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.3.YouTube.1217 folder moved successfully.
C:\Program Files\Windows Searchqu Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.3.Twitter.1257 folder moved successfully.
C:\Program Files\Windows Searchqu Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.3.Twitter.1255 folder moved successfully.
C:\Program Files\Windows Searchqu Toolbar\ToolBar\chrome\content\widgets\net.vmn.www.3.Twitter.1227 folder moved successfully.
C:\Program Files\Windows Searchqu Toolbar\ToolBar\chrome\content\widgets folder moved successfully.
C:\Program Files\Windows Searchqu Toolbar\ToolBar\chrome\content\modules folder moved successfully.
C:\Program Files\Windows Searchqu Toolbar\ToolBar\chrome\content\lib folder moved successfully.
C:\Program Files\Windows Searchqu Toolbar\ToolBar\chrome\content\data\search folder moved successfully.
C:\Program Files\Windows Searchqu Toolbar\ToolBar\chrome\content\data folder moved successfully.
C:\Program Files\Windows Searchqu Toolbar\ToolBar\chrome\content folder moved successfully.
C:\Program Files\Windows Searchqu Toolbar\ToolBar\chrome folder moved successfully.
C:\Program Files\Windows Searchqu Toolbar\ToolBar folder moved successfully.
C:\Program Files\Windows Searchqu Toolbar\Datamngr\FirefoxExtension\content folder moved successfully.
C:\Program Files\Windows Searchqu Toolbar\Datamngr\FirefoxExtension\components folder moved successfully.
C:\Program Files\Windows Searchqu Toolbar\Datamngr\FirefoxExtension folder moved successfully.
C:\Program Files\Windows Searchqu Toolbar\Datamngr folder moved successfully.
C:\Program Files\Windows Searchqu Toolbar folder moved successfully.
C:\Program Files\OfferBox\res folder moved successfully.
C:\Program Files\OfferBox\offerboxffx@offerbox.com\components folder moved successfully.
C:\Program Files\OfferBox\offerboxffx@offerbox.com\chrome\content folder moved successfully.
C:\Program Files\OfferBox\offerboxffx@offerbox.com\chrome folder moved successfully.
C:\Program Files\OfferBox\offerboxffx@offerbox.com folder moved successfully.
C:\Program Files\OfferBox folder moved successfully.
File/Folder C:\PROGRA~1\WIA6EB~1\Datamngr\datamngr.dll not found.
C:\Program Files\Fun4IM\Resources folder moved successfully.
C:\Program Files\Fun4IM\Plugins\Yahoo\Resources\Toolbar\Images folder moved successfully.
C:\Program Files\Fun4IM\Plugins\Yahoo\Resources\Toolbar folder moved successfully.
C:\Program Files\Fun4IM\Plugins\Yahoo\Resources\HTML folder moved successfully.
C:\Program Files\Fun4IM\Plugins\Yahoo\Resources folder moved successfully.
C:\Program Files\Fun4IM\Plugins\Yahoo folder moved successfully.
C:\Program Files\Fun4IM\Plugins\MSN\Resources\Toolbar\Images folder moved successfully.
C:\Program Files\Fun4IM\Plugins\MSN\Resources\Toolbar folder moved successfully.
C:\Program Files\Fun4IM\Plugins\MSN\Resources\HTML folder moved successfully.
C:\Program Files\Fun4IM\Plugins\MSN\Resources folder moved successfully.
C:\Program Files\Fun4IM\Plugins\MSN folder moved successfully.
C:\Program Files\Fun4IM\Plugins\IE\Resources\HTML folder moved successfully.
C:\Program Files\Fun4IM\Plugins\IE\Resources folder moved successfully.
C:\Program Files\Fun4IM\Plugins\IE folder moved successfully.
C:\Program Files\Fun4IM\Plugins folder moved successfully.
C:\Program Files\Fun4IM folder moved successfully.
C:\ProgramData\Fun4IM folder moved successfully.
C:\Users\Tanguy\AppData\Roaming\OfferBox folder moved successfully.
========== SERVICES/DRIVERS ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Public

User: Tanguy
->Temp folder emptied: 110877561 bytes
->Temporary Internet Files folder emptied: 112095955 bytes
->Java cache emptied: 24021924 bytes
->FireFox cache emptied: 47406793 bytes
->Flash cache emptied: 7645 bytes

%systemdrive% .tmp files removed: 918045 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 1619120 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 60765456 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 341,00 mb

OTM by OldTimer - Version 3.1.17.2 log created on 01132011_205112

Files moved on Reboot...

Registry entries deleted on Reboot...

Télécharge OTM de OldTimer sur ton Bureau en cliquant sur ce lien :

http://www.geekstogo.com/forum/files/file/402-otm-oldtimers-move-it/

Double-clique sur OTMoveIt3.exe pour le lancer.

Copie la liste qui se trouve en gras ci-dessous,

et colle-la dans le cadre de gauche de OTMoveIt : "Paste instructions for item to be moved".


:Reg
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7FF99715-3016-4381-84CE-E4E4C9673020}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7FF99715-3016-4381-84CE-E4E4C9673020}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FC0D62C2-9640-4AEB-A5D5-CF25DF11FA8C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FC0D62C2-9640-4AEB-A5D5-CF25DF11FA8C}]
[-HKEY_CLASSES_ROOT\CLSID\{7FF99715-3016-4381-84CE-E4E4C9673020}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7FF99715-3016-4381-84CE-E4E4C9673020}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{7FF99715-3016-4381-84CE-E4E4C9673020}"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""

:files
C:\Program Files\Windows Searchqu Toolbar
C:\Program Files\OfferBox
C:\PROGRA~1\WIA6EB~1\Datamngr\datamngr.dll
C:\Program Files\Fun4IM
C:\ProgramData\Fun4IM
C:\Users\Tanguy\AppData\Roaming\OfferBox
:services

:commands
[emptytemp]
[start explorer]
[reboot]

Clique sur "MoveIt!" pour lancer la suppression.

Le résultat apparaitra dans le cadre "Results".

Clique sur "Exit" pour fermer.

Poste le rapport situé dans C:\_OTMoveIt\MovedFiles sous le nom xxxxxx_xxxxxxxxxx.log .

Il te sera peut-être demander de redémarrer le pc pour achever la suppression. Si c'est le cas accepte par Yes.

Voilà le rapport :

############################## | UsbFix 7.037 | [Suppression]

Utilisateur: Tanguy (Administrateur) # TANGUY-PC [Acer Aspire 5738]
Mis à jour le 10/01/2011 par El Desaparecido / C_XX
Lancé à 18:23:06 | 13/01/2011
Site Web: http://www.teamxscript.org
Contact: eldesaparecido@teamxscript.org

CPU: Pentium(R) Dual-Core CPU T4200 @ 2.00GHz
CPU 2: Pentium(R) Dual-Core CPU T4200 @ 2.00GHz
Microsoft Windows 7 Professionnel (6.1.7600 32-Bit) #
Internet Explorer 9.0.7930.16406

Pare-feu Windows: Activé
RAM -> 3067 Mo
C:\ (%systemdrive%) -> Disque fixe # 288 Go (178 Go libre(s) - 62%) [ACER] # NTFS
D:\ -> CD-ROM
G:\ -> Disque fixe # 466 Go (302 Go libre(s) - 65%) [TANGUY] # FAT32
H:\ -> Disque amovible # 2 Go (2 Go libre(s) - 90%) [CLÉ TANGUY] # FAT
I:\ -> Disque amovible # 4 Mo (3 Mo libre(s) - 87%) [] # FAT

################## | Éléments infectieux |

Supprimé! C:\Users\Tanguy\AppData\Local\Temp\IXP082.TMP
Supprimé! C:\Windows\Integrator.exe
Supprimé! C:\Windows\Temp\OB.exe
Supprimé! C:\$RECYCLE.BIN\S-1-5-20
Supprimé! C:\$RECYCLE.BIN\S-1-5-21-696869605-3829081844-908571491-1001
Supprimé! H:\et3ypes.exe
Supprimé! H:\msvcr71.dll
Supprimé! I:\autorun.inf
Supprimé! I:\et3ypes.exe
Supprimé! I:\msvcr71.dll

################## | Registre |

################## | Mountpoints2 |

Supprimé! HKCU\.\.\.\.\Explorer\MountPoints2\G
Supprimé! HKCU\.\.\.\.\Explorer\MountPoints2\I
Supprimé! HKCU\.\.\.\.\Explorer\MountPoints2\{c736c69e-e906-11de-9e04-001f16b748f2}
Supprimé! HKCU\.\.\.\.\Explorer\MountPoints2\{ea600322-e9a2-11de-9d80-001f16b748f2}

################## | Listing |

[13/01/2011 - 18:23:38 | SHD ] C:\$Recycle.Bin
[12/01/2011 - 22:06:24 | D ] C:\32788R22FWJFW
[25/11/2009 - 19:46:52 | D ] C:\Acer
[08/06/2010 - 16:13:39 | D ] C:\ATI
[10/06/2009 - 22:42:20 | N | 24] C:\autoexec.bat
[27/07/2009 - 23:56:59 | D ] C:\Book
[15/12/2009 - 00:00:17 | D ] C:\Boot
[14/07/2009 - 02:38:58 | RASH | 383562] C:\bootmgr
[15/12/2009 - 00:00:19 | N | 8192] C:\BOOTSECT.BAK
[13/01/2011 - 01:53:02 | D ] C:\Config.Msi
[10/06/2009 - 22:42:20 | N | 10] C:\config.sys
[12/01/2011 - 16:57:38 | N | 918045] C:\DH Temp.tmp
[14/07/2009 - 05:53:55 | SHD ] C:\Documents and Settings
[25/11/2009 - 15:43:24 | D ] C:\Elements
[13/01/2011 - 17:19:11 | ASH | 2411855872] C:\hiberfil.sys
[11/02/2009 - 21:12:45 | D ] C:\Intel
[12/01/2011 - 16:38:38 | N | 0] C:\miniex.ant
[03/03/2009 - 02:44:37 | RHD ] C:\MSOCache
[25/11/2009 - 15:44:34 | D ] C:\MyWinLockerData
[13/01/2011 - 17:19:14 | ASH | 3215810560] C:\pagefile.sys
[24/07/2009 - 17:35:06 | N | 12479] C:\Patch.rev
[14/07/2009 - 03:37:05 | D ] C:\PerfLogs
[03/03/2009 - 12:38:43 | N | 147] C:\Preload.rev
[12/01/2011 - 20:03:14 | D ] C:\Program Files
[12/01/2011 - 20:03:50 | HD ] C:\ProgramData
[15/12/2009 - 13:22:18 | SHD ] C:\Recovery
[27/07/2009 - 15:11:49 | N | 2670] C:\RHDSetup.log
[12/01/2011 - 16:38:38 | N | 0] C:\scanlog.log
[13/01/2011 - 11:33:10 | SHD ] C:\System Volume Information
[13/01/2011 - 17:20:42 | D ] C:\tdsskiller
[12/01/2011 - 22:57:37 | N | 67342] C:\TDSSKiller.2.4.13.0_12.01.2011_22.56.01_log.txt
[12/01/2011 - 23:00:57 | N | 66878] C:\TDSSKiller.2.4.13.0_12.01.2011_23.00.15_log.txt
[12/01/2011 - 23:02:15 | N | 1972] C:\TDSSKiller.2.4.13.0_12.01.2011_23.02.13_log.txt
[12/01/2011 - 23:02:25 | N | 1972] C:\TDSSKiller.2.4.13.0_12.01.2011_23.02.23_log.txt
[12/01/2011 - 23:07:37 | N | 131784] C:\TDSSKiller.2.4.13.0_12.01.2011_23.02.49_log.txt
[13/01/2011 - 17:18:24 | N | 67458] C:\TDSSKiller.2.4.13.0_13.01.2011_17.10.22_log.txt
[13/01/2011 - 17:21:30 | N | 66028] C:\TDSSKiller.2.4.13.0_13.01.2011_17.20.47_log.txt
[11/11/2010 - 14:42:15 | D ] C:\Temp
[13/01/2011 - 18:23:39 | D ] C:\UsbFix
[13/01/2011 - 18:23:07 | A | 3789] C:\UsbFix.txt
[15/12/2009 - 13:22:32 | D ] C:\Users
[13/01/2011 - 18:23:35 | D ] C:\Windows
[22/12/2009 - 18:41:30 | N | 59233473] G:\DriveNavi.exe
[12/10/2010 - 18:33:28 | SHD ] G:\System Volume Information
[10/12/2010 - 23:19:44 | D ] G:\Disque Dur Tanguy
[27/12/2010 - 01:23:38 | SHD ] G:\$RECYCLE.BIN
[31/12/2010 - 12:04:58 | N | 314362] G:\VirtualDJ Local Database v6.xml
[27/12/2010 - 11:55:58 | D ] G:\Atomix Virtual DJ 7.0 PRO + Skins + Plugins + Sound Effect - ACE
[05/01/2011 - 22:18:00 | N | 66631] G:\Montréal.wlmp
[05/01/2011 - 22:38:16 | N | 37593325] G:\Montréal.wmv
[02/01/2011 - 22:52:24 | D ] G:\IUT
[07/08/2010 - 11:54:56 | D ] G:\Documents
[27/08/2010 - 20:43:04 | D ] G:\Pictures
[13/10/2010 - 17:58:08 | D ] G:\Videos
[27/08/2010 - 20:42:26 | D ] G:\Music
[12/01/2011 - 16:24:06 | D ] G:\Bureau
[01/06/2010 - 09:19:24 | D ] H:\IUT
[01/06/2010 - 09:19:40 | D ] H:\Tanguy
[17/09/2010 - 12:39:02 | D ] H:\Intégration TC
[25/09/2010 - 15:29:38 | D ] H:\Photos
[19/11/2010 - 09:20:32 | N | 47012] H:\DEJEUNES_Tanguy CV.docx
[19/11/2010 - 09:20:00 | N | 103368] H:\DEJEUNES_Tanguy CV.pdf
[12/11/2010 - 10:05:38 | N | 54326] H:\Ganar crea mercado.pdf
[12/11/2010 - 00:09:58 | N | 26300] H:\Ganar crea mercado.docx
[18/11/2010 - 09:28:38 | N | 822155] H:\Etude de cas Fly.docx
[18/11/2010 - 18:53:06 | N | 5430961] H:\Affiche_tc_soirée_25nov_2 copie.jpg
[23/11/2010 - 10:36:34 | N | 13058] H:\Budget prévisionnel soirée Old School.docx
[29/11/2010 - 10:42:48 | N | 244040] H:\certificat 2010.pdf
[27/12/2010 - 11:55:58 | D ] H:\Atomix Virtual DJ 7.0 PRO + Skins + Plugins + Sound Effect - ACE
[27/12/2010 - 01:02:26 | D ] H:\Virtual DJ Pro 7 & Serieal
[13/01/2011 - 17:25:46 | N | 126353] H:\ZHPDiag.txt

################## | Vaccin |

C:\Autorun.inf -> Dossier créé par UsbFix (El Desaparecido & C_XX)
G:\Autorun.inf -> Dossier créé par UsbFix (El Desaparecido & C_XX)
H:\Autorun.inf -> Dossier créé par UsbFix (El Desaparecido & C_XX)
I:\Autorun.inf -> Dossier créé par UsbFix (El Desaparecido & C_XX)

################## | Upload |

Veuillez envoyer le fichier: C:\UsbFix_Upload_Me_TANGUY-PC.zip
http://www.teamxscript.org/Upload.php
Merci de votre contribution.

################## | E.O.F |

(!) Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) susceptible d avoir été infectées sans les ouvrir

* Fais un clic droit sur le raccourci UsbFix présent sur ton bureau et choisis "éxécuter en tant qu'administrateur" .

* Au menu principal choisis l'option " F " pour français et tape sur [entrée] .

* Au second menu Choisis l'option " 2 " ( Suppression ) et tape sur [entrée]

* Ton bureau disparaitra et le pc redémarrera .

* Au redémarrage , UsbFix scannera ton pc , laisse travailler l outil.

* Ensuite post le rapport UsbFix.txt qui apparaitra avec le bureau .

* Note : Le rapport UsbFix.txt est sauvegardé a la racine du disque.( C:\UsbFix.txt )

( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

Voici le rapport USBFix :

############################## | UsbFix 7.037 | [Recherche]

Utilisateur: Tanguy (Administrateur) # TANGUY-PC [Acer Aspire 5738]
Mis à jour le 10/01/2011 par El Desaparecido / C_XX
Lancé à 18:05:10 | 13/01/2011
Site Web: http://www.teamxscript.org
Contact: eldesaparecido@teamxscript.org

CPU: Pentium(R) Dual-Core CPU T4200 @ 2.00GHz
CPU 2: Pentium(R) Dual-Core CPU T4200 @ 2.00GHz
Microsoft Windows 7 Professionnel (6.1.7600 32-Bit) #
Internet Explorer 9.0.7930.16406

Pare-feu Windows: Activé
RAM -> 3067 Mo
C:\ (%systemdrive%) -> Disque fixe # 288 Go (178 Go libre(s) - 62%) [ACER] # NTFS
D:\ -> CD-ROM
G:\ -> Disque fixe # 466 Go (302 Go libre(s) - 65%) [TANGUY] # FAT32
H:\ -> Disque amovible # 2 Go (2 Go libre(s) - 90%) [CLÉ TANGUY] # FAT
I:\ -> Disque amovible # 4 Mo (3 Mo libre(s) - 87%) [] # FAT

################## | Éléments infectieux |

Présent! C:\Users\Tanguy\AppData\Local\Temp\IXP082.TMP
Présent! C:\Windows\Integrator.exe
Présent! C:\Windows\Temp\OB.exe
Présent! H:\et3ypes.exe
Présent! H:\msvcr71.dll
Présent! I:\autorun.inf
Présent! I:\et3ypes.exe
Présent! I:\msvcr71.dll

################## | Registre |

################## | Mountpoints2 |

HKCU\.\.\.\.\Explorer\MountPoints2\G
Shell\AutoRun\Command = G:\Password.exe

HKCU\.\.\.\.\Explorer\MountPoints2\I
Shell\AutoRun\Command = I:\Password.exe

HKCU\.\.\.\.\Explorer\MountPoints2\{c736c69e-e906-11de-9e04-001f16b748f2}
Shell\AutoRun\Command = H:\Password.exe

HKCU\.\.\.\.\Explorer\MountPoints2\{ea600322-e9a2-11de-9d80-001f16b748f2}
Shell\AutoRun\Command = E:\autorun.exe

################## | Vaccin |

I:\Autorun.inf -> Dossier créé par Panda USB Vaccine

################## | E.O.F |

* Telecharge et installe UsbFix par El Desaparecido , C_XX & Chimay8

(!) Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) suceptible d avoir été infectés sans les ouvrir

* Fais un clic droit sur le raccourci UsbFix présent sur ton bureau et choisis "éxécuter en tant qu'administrateur" .

* Au menu principal choisis l'option " F " pour français et tape sur [entrée] .

* Au second menu Choisis l'option " 1 " (recherche) et tape sur [entrée]

* Laisse travailler l outil.

* Ensuite post le rapport UsbFix.txt qui apparaitra.

* Note : Le rapport UsbFix.txt est sauvegardé à la racine du disque. ( C:\UsbFix.txt )

( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

* Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.

Que dois-je faire ensuite ?

Voilà le nouveau lol ZHPDiag :

http://www.cijoint.fr/cjlink.php?file=cj201101/cij2WNd22o.txt