Desequilibre entre les 2 CPU

fermer toutes les fenêtres et applications lors de l'installation et de l'analyse.

▶ Télécharge ici :

Malwarebytes

▶ Installe le ( choisis bien "francais" ; ne modifie pas les paramètres d'installe ) et mets le à jour .

(NB : Si tu as un message d'erreur t'indiquant qu'il te manque "COMCTL32.OCX" lors de l'installe, alors télécharge le ici : COMCTL32.OCX

▶ Potasses le Tuto pour te familiariser avec le prg :

( cela dit, il est très simple d'utilisation ).

relance malwarebytes en suivant scrupuleusement ces consignes :

! Déconnecte toi et ferme toutes applications en cours !

▶ Lance Malwarebyte's .

Fais un examen dit "Complet" .

▶ Laisse le programme travailler ( et ne rien faire d'autre avec le PC durant le scan ).
▶ à la fin tu cliques sur "résultat" .
▶ Vérifie que tous les objets infectés soient validés, puis clique sur " suppression " .

▶ Note : si il faut redémarrer ton PC pour finir le nettoyage, fais le !

▶ Poste le rapport sauvegardé après la suppression des objets infectés (dans l'onglet "rapport/log"de Malwarebytes, le dernier en date)

VOila le rapport :

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Process_Killer by g3n-h@ckm@n 1.0.0.0 ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

Mis à jour le 24/03/2011 | 13.05 par g3n-h@ckm@n
Utilisateur : sabrina (Administrateurs)
Ordinateur : SABRINA-PC

Système d'exploitation : Windows 7 Ultimate (32 bits)
Internet Explorer : 8.0.7600.16385
Mozilla Firefox : 3.6.8 (fr)

Scan : 08:09:26 | 01/04/2011

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

[HKLM\..\..\Winlogon] | Shell -> Aucune modification : Explorer.exe -> Explorer.exe
[HKLM\..\..\Winlogon] | AutoRestartShell -> Aucune modification : 1 -> 1
[HKLM\..\..\Winlogon] | userinit -> Aucune modification : C:\Windows\system32\Userinit.exe, -> C:\Windows\system32\Userinit.exe,
[HKLM\..\..\Winlogon] | PowerDownAfterShutdown -> Aucune modification : 1 -> 1

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Associations ¤¤¤¤¤¤¤¤¤¤¤¤¤¤

[HKCR\exefile\..\..\command] : "%1" %*
[HKCR\comfile\..\..\command] : "%1" %*
[HKCR\scrfile\..\..\command] : "%1" /S
[HKCR\batfile\..\..\command] : "%1" %*
[HKCR\piffile\..\..\command] : "%1" %*

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processus ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

explorer.exe -> Processus stoppé

¤¤¤¤¤¤¤¤¤¤ Clés supprimées et Fichier mis en quarantaine ¤¤¤¤¤¤¤¤¤¤

¤¤¤¤¤¤¤¤¤¤ Services ¤¤¤¤¤¤¤¤¤¤

[HKLM\..\..\Services\Ndisuio] | Start -> Aucune modification : 3 -> 3
[HKLM\..\..\Services\EapHost] | Start -> Aucune modification : 2 -> 2
[HKLM\..\..\Services\Wlansvc] | Start -> Aucune modification : 2 -> 2
[HKLM\..\..\Services\SharedAccess] | Start -> Aucune modification : 2 -> 2
[HKLM\..\..\Services\windefend] | Start -> Aucune modification : 2 -> 2
[HKLM\..\..\Services\wuauserv] | Start -> Aucune modification : 2 -> 2
[HKLM\..\..\Services\wscsvc] | Start -> Aucune modification : 2 -> 2

¤¤¤¤¤¤¤¤¤¤ IFEO ¤¤¤¤¤¤¤¤¤¤

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

scanning jobs ...

scanning processes ...

scanning threads ...

scanning modules in svchost.exe...
scanning modules in services.exe...
scanning modules in explorer.exe...

restoring services BITS, wuauserv, ERSvc, WerSvc
Service BITS autorun restored
Service wuauserv autorun restored
Service WerSvc autorun restored
Service WerSvc started

restoring show hidden and system files

restoring SafeBoot registry node

scanning C:\Windows\system32 ...
scanning C:\Program Files\Internet Explorer\ ...
scanning C:\Program Files\Movie Maker\ ...
scanning C:\Program Files\Windows Media Player\ ...
scanning C:\Program Files\Windows NT\ ...
scanning C:\Users\sabrina\AppData\Roaming ...
scanning C:\Users\sabrina\AppData\Local\Temp\ ...
scanning C:\ ...
scanning E:\ ...
scanning Q:\ ...

completed
Infected jobs: 0
Infected files: 0
Infected threads: 0
Splices functions: 0
Cured files: 0
Fixed registry keys: 0

¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤

desactive tes protections , enregistre-le sur ton bureau , lance le scan , et poste rapport.txt qui apparaitra a la fin du scan :

http://dl.dropbox.com/u/21363431/Pre_scan.exe

Resultat 2eme scan :

OTL : http://www.cijoint.fr/cjlink.php?file=cj201103/cijiYoo6LJ.txt

Extra : http://www.cijoint.fr/cjlink.php?file=cj201103/cijmWQe0zt.txt

bien refais un scan OTL stp

Voila le resultat

======= REPORT FROM AD-REMOVER 2.0.0.2,F | ONLY XP/VISTA/7 =======

Updated by TeamXscript on 01/03/11
Contact: AdRemover[DOT]contact[AT]gmail[DOT]com
website: http://www.teamxscript.org

C:\Program Files\Ad-Remover\main.exe (CLEAN [1]) -> Launched at 16:11:40 on 30/03/2011, Normal boot

Microsoft Windows 7 Ultimate (X86)
sabrina@SABRINA-PC (Gateway M-6885U)

============== ACTION(S) ==============

Service: "MyWebSearchService" Service stopped and deleted

File deleted: C:\Windows\system32\f3PSSavr.scr
Folder deleted: C:\Users\sabrina\AppData\Local\AskToolbar
Folder deleted: C:\Users\sabrina\AppData\Local\Conduit
Folder deleted: C:\Users\sabrina\AppData\LocalLow\Conduit
Folder deleted: C:\Users\sabrina\AppData\LocalLow\ConduitEngine
Folder deleted: C:\Program Files\ConduitEngine
Folder deleted: C:\Users\sabrina\AppData\LocalLow\FunWebProducts
Folder deleted: C:\Program Files\FunWebProducts
Folder deleted: C:\Users\sabrina\AppData\LocalLow\MyWebSearch
Folder deleted: C:\Program Files\MyWebSearch
File deleted: C:\Program Files\Windows Live\Messenger\Riched20.dll
File deleted: C:\Program Files\Windows Live\Messenger\Msimg32.dll

(!) -- Temporary files deleted.

-- File opened: C:\Users\sabrina\AppData\Roaming\Mozilla\FireFox\Profiles\dp7uhvaw.default\Prefs.js --
Line deleted: user_pref("extensions.enabledItems", "{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21,firefox@tvunetwo...
-- File closed --

Key deleted: HKLM\Software\Classes\CLSID\{00A6FAF1-072E-44cf-8957-5838F569A31D}
Key deleted: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00A6FAF1-072E-44cf-8957-5838F569A31D}
Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{00A6FAF1-072E-44cf-8957-5838F569A31D}
Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF1-072E-44cf-8957-5838F569A31D}
Key deleted: HKLM\Software\Classes\CLSID\{00A6FAF6-072E-44cf-8957-5838F569A31D}
Key deleted: HKLM\Software\Classes\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}
Key deleted: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{07B18EA1-A523-4961-B6BB-170DE4475CCA}
Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{07B18EA1-A523-4961-B6BB-170DE4475CCA}
Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA1-A523-4961-B6BB-170DE4475CCA}
Key deleted: HKLM\Software\Classes\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA}
Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{07B18EA9-A523-4961-B6BB-170DE4475CCA}
Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA9-A523-4961-B6BB-170DE4475CCA}
Key deleted: HKLM\Software\Classes\CLSID\{07B18EAB-A523-4961-B6BB-170DE4475CCA}
Key deleted: HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{07B18EAB-A523-4961-B6BB-170DE4475CCA}
Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EAB-A523-4961-B6BB-170DE4475CCA}
Key deleted: HKLM\Software\Classes\CLSID\{08858AF6-42AD-4914-95D2-AC3AB0DC8E28}
Key deleted: HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{08858AF6-42AD-4914-95D2-AC3AB0DC8E28}
Key deleted: HKLM\Software\Classes\CLSID\{0F8ECF4F-3646-4C3A-8881-8E138FFCAF70}
Key deleted: HKLM\Software\Classes\CLSID\{1E0DE227-5CE4-4ea3-AB0C-8B03E1AA76BC}
Key deleted: HKLM\Software\Classes\CLSID\{25560540-9571-4D7B-9389-0F166788785A}
Key deleted: HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{25560540-9571-4D7B-9389-0F166788785A}
Key deleted: HKLM\Software\Classes\CLSID\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8}
Key deleted: HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8}
Key deleted: HKLM\Software\Classes\CLSID\{3E720452-B472-4954-B7AA-33069EB53906}
Key deleted: HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3E720452-B472-4954-B7AA-33069EB53906}
Key deleted: HKLM\Software\Classes\CLSID\{53CED2D0-5E9A-4761-9005-648404E6F7E5}
Key deleted: HKLM\Software\Classes\CLSID\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C}
Key deleted: HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C}
Key deleted: HKLM\Software\Classes\CLSID\{7473D292-B7BB-4f24-AE82-7E2CE94BB6A9}
Key deleted: HKLM\Software\Classes\CLSID\{7473D294-B7BB-4f24-AE82-7E2CE94BB6A9}
Key deleted: HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7473D294-B7BB-4f24-AE82-7E2CE94BB6A9}
Key deleted: HKLM\Software\Classes\CLSID\{7473D296-B7BB-4f24-AE82-7E2CE94BB6A9}
Key deleted: HKLM\Software\Classes\CLSID\{799391D3-EB86-4bac-9BD3-CBFEA58A0E15}
Key deleted: HKLM\Software\Classes\CLSID\{819FFE22-35C7-4925-8CDA-4E0E2DB94302}
Key deleted: HKLM\Software\Classes\CLSID\{84DA4FDF-A1CF-4195-8688-3E961F505983}
Key deleted: HKLM\Software\Classes\CLSID\{8E6F1832-9607-4440-8530-13BE7C4B1D14}
Key deleted: HKLM\Software\Classes\CLSID\{938AA51A-996C-4884-98CE-80DD16A5C9DA}
Key deleted: HKLM\Software\Classes\CLSID\{98D9753D-D73B-42D5-8C85-4469CDA897AB}
Key deleted: HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{98D9753D-D73B-42D5-8C85-4469CDA897AB}
Key deleted: HKLM\Software\Classes\CLSID\{9FF05104-B030-46FC-94B8-81276E4E27DF}
Key deleted: HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9FF05104-B030-46FC-94B8-81276E4E27DF}
Key deleted: HKLM\Software\Classes\CLSID\{A9571378-68A1-443d-B082-284F960C6D17}
Key deleted: HKLM\Software\Classes\CLSID\{ADB01E81-3C79-4272-A0F1-7B2BE7A782DC}
Key deleted: HKLM\Software\Classes\CLSID\{B813095C-81C0-4E40-AA14-67520372B987}
Key deleted: HKLM\Software\Classes\CLSID\{C9D7BE3E-141A-4C85-8CD6-32461F3DF2C7}
Key deleted: HKLM\Software\Classes\CLSID\{CFF4CE82-3AA2-451F-9B77-7165605FB835}
Key deleted: HKLM\Software\Classes\CLSID\{D858DAFC-9573-4811-B323-7011A3AA7E61}
Key deleted: HKLM\Software\Classes\CLSID\{D9FFFB27-D62A-4D64-8CEC-1FF006528805}
Key deleted: HKLM\Software\Classes\CLSID\{E79DFBCA-5697-4fbd-94E5-5B2A9C7C1612}
Key deleted: HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{E79DFBCA-5697-4fbd-94E5-5B2A9C7C1612}
Key deleted: HKLM\Software\Classes\Interface\{07B18EAA-A523-4961-B6BB-170DE4475CCA}
Key deleted: HKLM\Software\Classes\Interface\{07B18EAC-A523-4961-B6BB-170DE4475CCA}
Key deleted: HKLM\Software\Classes\Interface\{1093995A-BA37-41D2-836E-091067C4AD17}
Key deleted: HKLM\Software\Classes\Interface\{120927BF-1700-43BC-810F-FAB92549B390}
Key deleted: HKLM\Software\Classes\Interface\{17DE5E5E-BFE3-4E83-8E1F-8755795359EC}
Key deleted: HKLM\Software\Classes\Interface\{1F52A5FA-A705-4415-B975-88503B291728}
Key deleted: HKLM\Software\Classes\Interface\{247A115F-06C2-4FB3-967D-2D62D3CF4F0A}
Key deleted: HKLM\Software\Classes\Interface\{2E3537FC-CF2F-4F56-AF54-5A6A3DD375CC}
Key deleted: HKLM\Software\Classes\Interface\{2E9937FC-CF2F-4F56-AF54-5A6A3DD375CC}
Key deleted: HKLM\Software\Classes\Interface\{3E1656ED-F60E-4597-B6AA-B6A58E171495}
Key deleted: HKLM\Software\Classes\Interface\{3E53E2CB-86DB-4A4A-8BD9-FFEB7A64DF82}
Key deleted: HKLM\Software\Classes\Interface\{3E720451-B472-4954-B7AA-33069EB53906}
Key deleted: HKLM\Software\Classes\Interface\{3E720453-B472-4954-B7AA-33069EB53906}
Key deleted: HKLM\Software\Classes\Interface\{63D0ED2B-B45B-4458-8B3B-60C69BBBD83C}
Key deleted: HKLM\Software\Classes\Interface\{63D0ED2D-B45B-4458-8B3B-60C69BBBD83C}
Key deleted: HKLM\Software\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Key deleted: HKLM\Software\Classes\Interface\{6E74766C-4D93-4CC0-96D1-47B8E07FF9CA}
Key deleted: HKLM\Software\Classes\Interface\{72EE7F04-15BD-4845-A005-D6711144D86A}
Key deleted: HKLM\Software\Classes\Interface\{741DE825-A6F0-4497-9AA6-8023CF9B0FFF}
Key deleted: HKLM\Software\Classes\Interface\{7473D291-B7BB-4F24-AE82-7E2CE94BB6A9}
Key deleted: HKLM\Software\Classes\Interface\{7473D293-B7BB-4F24-AE82-7E2CE94BB6A9}
Key deleted: HKLM\Software\Classes\Interface\{7473D295-B7BB-4F24-AE82-7E2CE94BB6A9}
Key deleted: HKLM\Software\Classes\Interface\{7473D297-B7BB-4F24-AE82-7E2CE94BB6A9}
Key deleted: HKLM\Software\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48}
Key deleted: HKLM\Software\Classes\Interface\{8E9CF769-3D3B-40EB-9E2D-76E7A205E4D2}
Key deleted: HKLM\Software\Classes\Interface\{90449521-D834-4703-BB4E-D3AA44042FF8}
Key deleted: HKLM\Software\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Key deleted: HKLM\Software\Classes\Interface\{991AAC62-B100-47CE-8B75-253965244F69}
Key deleted: HKLM\Software\Classes\Interface\{A626CDBD-3D13-4F78-B819-440A28D7E8FC}
Key deleted: HKLM\Software\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Key deleted: HKLM\Software\Classes\Interface\{BBABDC90-F3D5-4801-863A-EE6AE529862D}
Key deleted: HKLM\Software\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
Key deleted: HKLM\Software\Classes\Interface\{CF54BE1C-9359-4395-8533-1657CF209CFE}
Key deleted: HKLM\Software\Classes\Interface\{D6FF3684-AD3B-48EB-BBB4-B9E6C5A355C1}
Key deleted: HKLM\Software\Classes\Interface\{DE38C398-B328-4F4C-A3AD-1B5E4ED93477}
Key deleted: HKLM\Software\Classes\Interface\{E342AF55-B78A-4CD0-A2BB-DA7F52D9D25E}
Key deleted: HKLM\Software\Classes\Interface\{E342AF55-B78A-4CD0-A2BB-DA7F52D9D25F}
Key deleted: HKLM\Software\Classes\Interface\{E79DFBC9-5697-4FBD-94E5-5B2A9C7C1612}
Key deleted: HKLM\Software\Classes\Interface\{E79DFBCB-5697-4FBD-94E5-5B2A9C7C1612}
Key deleted: HKLM\Software\Classes\Interface\{EB9E5C1C-B1F9-4C2B-BE8A-27D6446FDAF8}
Key deleted: HKLM\Software\Classes\Interface\{F87D7FB5-9DC5-4C8C-B998-D8DFE02E2978}
Key deleted: HKLM\Software\Classes\TypeLib\{07B18EA0-A523-4961-B6BB-170DE4475CCA}
Key deleted: HKLM\Software\Classes\TypeLib\{0D26BC71-A633-4E71-AD31-EADC3A1B6A3A}
Key deleted: HKLM\Software\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
Key deleted: HKLM\Software\Classes\TypeLib\{29D67D3C-509A-4544-903F-C8C1B8236554}
Key deleted: HKLM\Software\Classes\TypeLib\{3E720450-B472-4954-B7AA-33069EB53906}
Key deleted: HKLM\Software\Classes\TypeLib\{7473D290-B7BB-4F24-AE82-7E2CE94BB6A9}
Key deleted: HKLM\Software\Classes\TypeLib\{819FFE20-35C7-4925-8CDA-4E0E2DB94302}
Key deleted: HKLM\Software\Classes\TypeLib\{8CA01F0E-987C-49C3-B852-2F1AC4A7094C}
Key deleted: HKLM\Software\Classes\TypeLib\{8E6F1830-9607-4440-8530-13BE7C4B1D14}
Key deleted: HKLM\Software\Classes\TypeLib\{8FFDF636-0D87-4B33-B9E9-79A53F6E1DAE}
Key deleted: HKLM\Software\Classes\TypeLib\{C8CECDE3-1AE1-4C4A-AD82-6D5B00212144}
Key deleted: HKLM\Software\Classes\TypeLib\{D518921A-4A03-425E-9873-B9A71756821E}
Key deleted: HKLM\Software\Classes\TypeLib\{E47CAEE0-DEEA-464A-9326-3F2801535A4D}
Key deleted: HKLM\Software\Classes\TypeLib\{E79DFBC0-5697-4FBD-94E5-5B2A9C7C1612}
Key deleted: HKLM\Software\Classes\TypeLib\{F42228FB-E84E-479E-B922-FBBD096E792C}
Key deleted: HKLM\Software\Classes\FunWebProducts.DataControl
Key deleted: HKLM\Software\Classes\FunWebProducts.DataControl.1
Key deleted: HKLM\Software\Classes\FunWebProducts.HistoryKillerScheduler
Key deleted: HKLM\Software\Classes\FunWebProducts.HistoryKillerScheduler.1
Key deleted: HKLM\Software\Classes\FunWebProducts.HistorySwatterControlBar
Key deleted: HKLM\Software\Classes\FunWebProducts.HistorySwatterControlBar.1
Key deleted: HKLM\Software\Classes\FunWebProducts.HTMLMenu
Key deleted: HKLM\Software\Classes\FunWebProducts.HTMLMenu.1
Key deleted: HKLM\Software\Classes\FunWebProducts.HTMLMenu.2
Key deleted: HKLM\Software\Classes\FunWebProducts.IECookiesManager
Key deleted: HKLM\Software\Classes\FunWebProducts.IECookiesManager.1
Key deleted: HKLM\Software\Classes\FunWebProducts.KillerObjManager
Key deleted: HKLM\Software\Classes\FunWebProducts.KillerObjManager.1
Key deleted: HKLM\Software\Classes\FunWebProducts.PopSwatterBarButton
Key deleted: HKLM\Software\Classes\FunWebProducts.PopSwatterBarButton.1
Key deleted: HKLM\Software\Classes\FunWebProducts.PopSwatterSettingsControl
Key deleted: HKLM\Software\Classes\FunWebProducts.PopSwatterSettingsControl.1
Key deleted: HKLM\Software\Classes\GenericAskToolbar.ToolbarWnd
Key deleted: HKLM\Software\Classes\GenericAskToolbar.ToolbarWnd.1
Key deleted: HKLM\Software\Classes\MyWebSearch.ChatSessionPlugin
Key deleted: HKLM\Software\Classes\MyWebSearch.ChatSessionPlugin.1
Key deleted: HKLM\Software\Classes\MyWebSearch.HTMLPanel
Key deleted: HKLM\Software\Classes\MyWebSearch.HTMLPanel.1
Key deleted: HKLM\Software\Classes\MyWebSearch.MultipleButton
Key deleted: HKLM\Software\Classes\MyWebSearch.MultipleButton.1
Key deleted: HKLM\Software\Classes\MyWebSearch.OutlookAddin
Key deleted: HKLM\Software\Classes\MyWebSearch.OutlookAddin.1
Key deleted: HKLM\Software\Classes\MyWebSearch.PseudoTransparentPlugin
Key deleted: HKLM\Software\Classes\MyWebSearch.PseudoTransparentPlugin.1
Key deleted: HKLM\Software\Classes\MyWebSearch.ThirdPartyInstaller
Key deleted: HKLM\Software\Classes\MyWebSearch.ThirdPartyInstaller.1
Key deleted: HKLM\Software\Classes\MyWebSearch.UrlAlertButton
Key deleted: HKLM\Software\Classes\MyWebSearch.UrlAlertButton.1
Key deleted: HKLM\Software\Classes\MyWebSearchToolBar.SettingsPlugin
Key deleted: HKLM\Software\Classes\MyWebSearchToolBar.SettingsPlugin.1
Key deleted: HKLM\Software\Classes\MyWebSearchToolBar.ToolbarPlugin
Key deleted: HKLM\Software\Classes\MyWebSearchToolBar.ToolbarPlugin.1
Key deleted: HKLM\Software\Classes\ScreenSaverControl.ScreenSaverInstaller
Key deleted: HKLM\Software\Classes\ScreenSaverControl.ScreenSaverInstaller.1
Key deleted: HKLM\Software\Classes\Toolbar.CT2542115
Key deleted: HKLM\Software\Classes\AppID\GenericAskToolbar.DLL
Key deleted: HKLM\Software\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Key deleted: HKLM\Software\Conduit
Key deleted: HKLM\Software\FocusInteractive
Key deleted: HKLM\Software\Fun Web Products
Key deleted: HKLM\Software\MyWebSearch
Key deleted: HKCU\Software\Conduit
Key deleted: HKCU\Software\FunWebProducts
Key deleted: HKCU\Software\MyWebSearch
Key deleted: HKCU\Software\AppDataLow\Toolbar
Key deleted: HKCU\Software\AppDataLow\Software\Conduit
Key deleted: HKCU\Software\AppDataLow\Software\Fun Web Products
Key deleted: HKCU\Software\AppDataLow\Software\FunWebProducts
Key deleted: HKCU\Software\AppDataLow\Software\MyWebSearch
Key deleted: HKLM\Software\Microsoft\Shared Tools\MSConfig\startupreg\My Web Search Bar Search Scope Monitor
Key deleted: HKLM\Software\Microsoft\Shared Tools\MSConfig\startupreg\MyWebSearch Email Plugin
Key deleted: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0}
Key deleted: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}
Key deleted: HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0}
Key deleted: HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}
Key deleted: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59C7FC09-1C83-4648-B3E6-003D2BBC7481}
Key deleted: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170B96C-28D4-4626-8358-27E6CAEEF907}
Key deleted: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D1A71FA0-FF48-48dd-9B6D-7A13A3E42127}
Key deleted: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DDB1968E-EAD6-40fd-8DAE-FF14757F60C7}
Key deleted: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F138D901-86F0-4383-99B6-9CDD406036DA}
Key deleted: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\MyWebSearch bar Uninstall
Key deleted: HKLM\Software\Classes\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239}
Key deleted: HKLM\Software\Classes\CLSID\{A4730EBE-43A6-443e-9776-36915D323AD3}
Key deleted: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68AF847F-6E91-45DD-9B68-D6A12C30E5D7}
Key deleted: HKLM\Software\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll
Key deleted: HKLM\Software\Microsoft\Multimedia\WMPlayer\Schemes\f3pss
Key deleted: HKLM\Software\Microsoft\Office\Outlook\Addins\MyWebSearch.OutlookAddin
Key deleted: HKLM\Software\Microsoft\Office\Word\Addins\MyWebSearch.OutlookAddin
Key deleted: HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB}
Key deleted: HKLM\Software\MozillaPlugins\@mywebsearch.com/Plugin

Value deleted: HKLM\Software\Microsoft\Windows Media\Wmsdk\Sources|F3PopularScreenSavers
Value deleted: HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\post platform|FunWebProducts
Value deleted: HKLM\Software\Mozilla\Firefox\Extensions|m3ffxtbr@mywebsearch.com
Value deleted: HKLM\Software\Microsoft\Windows\CurrentVersion\Run|My Web Search Bar Search Scope Monitor
Value deleted: HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks|{00A6FAF6-072E-44CF-8957-5838F569A31D}
Value deleted: HKLM\Software\Microsoft\Internet Explorer\Toolbar|{D4027C7F-154A-4066-A1AD-4243D8127440}
Value deleted: HKLM\Software\Microsoft\Internet Explorer\Toolbar|{07B18EA9-A523-4961-B6BB-170DE4475CCA}
Value deleted: HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser|{D4027C7F-154A-4066-A1AD-4243D8127440}
Value deleted: HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser|{07B18EA9-A523-4961-B6BB-170DE4475CCA}

============== ADDITIONNAL SCAN ==============

**** Mozilla Firefox Version [3.6.8 (fr)] ****

Plugins\npwachk.dll (Nullsoft, Inc.)
HKLM_MozillaPlugins\@pages.tvunetworks.com/WebPlayer (x)
Components\Scriptff.dll (McAfee, Inc.)
HKLM_Extensions|{A27F3FEF-1113-4cfb-A032-8E12D7D8EE70} - C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\

-- C:\Users\sabrina\AppData\Roaming\Mozilla\FireFox\Profiles\dp7uhvaw.default --
Extensions\firefox@tvunetworks.com (TVU Web Player)
Extensions\illimitux@illimitux.net (Illimitux)
Extensions\{364d4e0c-543f-4b85-abe3-19551139da4f} (Softonic_France Toolbar)
Extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc} (?)
Prefs.js - browser.download.lastDir, C:\\Users\\sabrina\\Downloads\\Dexter Season5 XVID-PRUNY
Prefs.js - browser.startup.homepage_override.mstone, rv:1.9.2.8

========================================

**** Internet Explorer Version [8.0.7600.16385] ****

HKCU_Main|Default_Page_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKCU_Main|Default_Search_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU_Main|Search bar - hxxp://go.microsoft.com/fwlink/?linkid=54896
HKCU_Main|Start Page - hxxp://fr.msn.com/
HKLM_Main|Default_Page_URL - hxxp://go.microsoft.com/fwlink/?LinkId=54896
HKLM_Main|Default_Search_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM_Main|Search bar - hxxp://search.msn.com/spbasic.htm
HKLM_Main|Search Page - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM_Main|Start Page - hxxp://fr.msn.com/
HKLM_URLSearchHooks|{4daac69c-cba7-45e2-9bc8-1044483d3352} (x)
HKCU_ElevationPolicy\{6052BF20-EA23-4A04-B3C1-A20EFE01A95A} - C:\Program Files\Veetle\Player\vtl_hfs.exe (?)
HKCU_ElevationPolicy\{680FA47E-AB59-46BE-B594-7358726E108B} - C:\Program Files\Veetle\Player\player.exe (?)
HKCU_ElevationPolicy\{E8BC6C2B-DD90-4397-96EB-2AAF0E48ABE6} - C:\Program Files\Veetle\Player\vtl_hfax.exe (?)
HKLM_ElevationPolicy\{07d873dc-b9b9-44f5-af0b-fb59fa54fb7a} - C:\Windows\System32\wpcer.exe (x)
HKLM_ElevationPolicy\{0a402d70-1f10-4ae7-bec9-286a98240695} - C:\Windows\System32\winfxdocobj.exe (x)
HKLM_ElevationPolicy\{6052BF20-EA23-4A04-B3C1-A20EFE01A95A} - C:\Program Files\Veetle\Player\vtl_hfs.exe (?)
HKLM_ElevationPolicy\{680FA47E-AB59-46BE-B594-7358726E108B} - C:\Program Files\Veetle\Player\player.exe (?)
HKLM_ElevationPolicy\{70f641fd-9ffc-4d5b-a4dc-962af4ed7999} - C:\Program Files\Internet Explorer\iedw.exe (x)
HKLM_ElevationPolicy\{E8BC6C2B-DD90-4397-96EB-2AAF0E48ABE6} - C:\Program Files\Veetle\Player\vtl_hfax.exe (?)
BHO\{4daac69c-cba7-45e2-9bc8-1044483d3352} (?)
BHO\{5C255C8A-E604-49b4-9D64-90988571CECB} (?)
BHO\{7DB2D5A0-7241-4E79-B68D-6309F01C5231} - "scriptproxy" (C:\Program Files\McAfee\VirusScan Enterprise\scriptsn.dll)
BHO\{D4027C7F-154A-4066-A1AD-4243D8127440} (?)

========================================

C:\Program Files\Ad-Remover\Quarantine: 115 File(s)
C:\Program Files\Ad-Remover\Backup: 16 File(s)

C:\Ad-Report-CLEAN[1].txt - 30/03/2011 16:11:58 (20526 Byte(s))

End at: 16:13:25, 30/03/2011

============== E.O.F ==============

▶ Télécharge ici : Ad-remover sur ton bureau :

▶ Déconnecte toi et ferme toutes applications en cours !

si tu as XP => double clique
si tu as Vista ou windows 7 => clic droit "executer en tant que...."

▶ sur "Ad-R.exe" pour lancer l'installation et laisse les paramètres d'installation par défaut .

▶ clique le raccourci Ad-remover qui est sur ton bureau pour lancer l'outil .

▶ Au menu principal choisis "option Nettoyer" et tape sur [entrée] .

▶ Laisse travailler l'outil et ne touche à rien ...

▶ Poste le rapport qui apparait à la fin , sur le forum ...

( Le rapport est sauvegardé aussi sous C:\Ad-report.log )
( CTRL+A Pour tout sélectionner , CTRL+C pour copier et CTRL+V pour coller )

Voila le lien pour le fichier OTL :
http://www.cijoint.fr/cjlink.php?file=cj201103/cijxWCIidv.txt

Et celui du fichier Extra :
http://www.cijoint.fr/cjlink.php?file=cj201103/cijHb9UECp.txt

Merci beaucoup!!

Télécharge ici :OTL

▶ enregistre le sur ton Bureau.

si tu as XP => double clique
si tu as Vista ou windows 7 => clic droit "executer en tant que...."

sur OTL.exe pour le lancer.

▶ Coche les 2 cases Lop et Purity

▶ Coche la case devant tous les utilisateurs

▶ règle age du fichier sur "60 jours"

▶ dans les 6 onglets de la moitié gauche , mets tout sur "tous"

ne modifie pas ceci :

"fichiers créés" et "fichiers Modifiés"

▶Clic sur Analyse.

A la fin du scan, le Bloc-Notes va s'ouvrir avec le rapport (OTL.txt).

Ce fichier est sur ton Bureau (en général C:\Documents and settings\le_nom_de_ta_session\OTL.txt)

▶▶▶ NE LE POSTE PAS SUR LE FORUM (il est trop long)

Pour me le transmettre clique sur ce lien : http://www.cijoint.fr/

▶ Clique sur Parcourir et cherche le fichier ci-dessus.

▶ Clique sur Ouvrir.

▶ Clique sur "Cliquez ici pour déposer le fichier".

juste au niveau du bouton , en fin de chargement du fichier , Un lien de cette forme apparaitra :

http://www.cijoint.fr/cjlink.php?file=cjge368/cijSKAP5fU.txt

▶ Copie ce lien dans ta réponse.

▶▶ Tu feras la meme chose avec le "Extra.txt" qui logiquement sera aussi sur ton bureau.

Ca y est j'ai supprime le fichier windows.old, en effet il prenait de la place... j'ai retrouve pres de 140GB de libre en + sur mon disque dur!
A part ca rien d'anormal?
Merci

tu peux supprimer ce dossier c est une vieille install ou alors ratée :

C:\Windows.old
G3?-?@¢??@?......Concepteur de List_Kill'em...

Voila le resultat du scan

############################## | UsbFix 7.042 | [Deletion]

User: sabrina (Administrator) # SABRINA-PC [Gateway M-6885U]
Updated 26/03/2011 by TeamXscript
Started at 09:20:26 | 30/03/2011
Website: http://www.teamxscript.org
Submit your sample: http://www.teamxscript.org/Upload.php
Contact: TeamXscript.ElDesaparecido@gmail.com

CPU: Intel(R) Core(TM)2 Duo CPU T5750 @ 2.00GHz
CPU 2: Intel(R) Core(TM)2 Duo CPU T5750 @ 2.00GHz
Microsoft Windows 7 Ultimate (6.1.7600 32-Bit) #
Internet Explorer 8.0.7600.16385

Windows Firewall: Enabled
RAM -> 3062 Mb
C:\ (%systemdrive%) -> Fixed drive # 288 Gb (16 Mb free - 6%) [OS] # NTFS
D:\ -> CD-ROM
G:\ -> Fixed drive # 596 Gb (170 Mb free - 28%) [Elements] # NTFS

################## | Files # Infected Folders |

Deleted ! C:\$RECYCLE.BIN\S-1-5-20
Deleted ! C:\$RECYCLE.BIN\S-1-5-21-694464195-78308363-3867712432-1000
Deleted ! G:\$RECYCLE.BIN\S-1-5-21-3755893262-122978934-1404654146-1001
Deleted ! G:\$RECYCLE.BIN\S-1-5-21-694464195-78308363-3867712432-1000
Deleted ! G:\$RECYCLE.BIN\S-1-5-21-775447118-1732227721-3573049559-1000
Deleted ! G:\Recycler\S-1-5-21-1004336348-1035525444-839522115-1003
Deleted ! G:\Recycler\S-1-5-21-1214440339-117609710-839522115-1003
Deleted ! G:\Recycler\S-1-5-21-1480884695-1780359854-2649603119-1008
Deleted ! G:\Recycler\S-1-5-21-527237240-1647877149-839522115-1003
Deleted ! G:\Recycler\S-1-5-21-583907252-746137067-854245398-500
Deleted ! G:\Recycler\S-1-5-21-70914453-2589570571-1603408004-1007
Deleted ! G:\Recycler\S-1-5-21-789336058-2139871995-682003330-500
Not deleted ! D:\autorun.inf
Not deleted ! D:\autorun.exe

################## | Registry |

Deleted ! HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System|DisableRegistryTools
Deleted ! HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System|DisableTaskMgr

################## | Mountpoints2 |

Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{e90b14e5-a7de-11df-868e-806e6f6e6963}

################## | Listing |

[30/03/2011 - 09:30:49 | SHD ] C:\$Recycle.Bin
[07/04/2010 - 23:40:11 | N | 1024] C:\.rnd
[10/12/2009 - 06:28:30 | N | 3988] C:\aaw7boot.log
[04/12/2008 - 21:05:33 | D ] C:\ACER
[10/06/2009 - 23:42:20 | N | 24] C:\autoexec.bat
[24/11/2008 - 13:55:05 | D ] C:\book
[14/08/2010 - 23:01:43 | D ] C:\Boot
[14/07/2009 - 03:38:58 | RASH | 383562] C:\bootmgr
[14/08/2010 - 23:01:45 | N | 8192] C:\BOOTSECT.BAK
[25/06/2010 - 20:27:44 | D ] C:\c77f7acecc4933fca6c3621eb0f7b5da
[24/03/2011 - 10:28:10 | D ] C:\Config.Msi
[10/06/2009 - 23:42:20 | N | 10] C:\config.sys
[14/07/2009 - 06:53:55 | SHD ] C:\Documents and Settings
[30/03/2011 - 09:15:34 | ASH | 2408390656] C:\hiberfil.sys
[24/11/2008 - 13:17:35 | D ] C:\Intel
[13/11/2009 - 01:35:32 | N | 0] C:\IO.SYS
[24/11/2008 - 13:52:32 | N | 165] C:\Labelprint.log
[13/11/2009 - 01:35:32 | N | 0] C:\MSDOS.SYS
[11/02/2011 - 18:34:19 | RHD ] C:\MSOCache
[03/12/2009 - 23:57:25 | D ] C:\MSOCache(6)
[30/03/2011 - 09:15:39 | ASH | 3211190272] C:\pagefile.sys
[14/07/2009 - 04:37:05 | D ] C:\PerfLogs
[04/12/2008 - 20:57:31 | N | 163] C:\power2go.log
[29/03/2011 - 20:15:50 | D ] C:\Program Files
[23/03/2011 - 17:12:51 | HD ] C:\ProgramData
[19/02/2011 - 18:06:09 | D ] C:\QUARANTINE
[14/08/2010 - 20:27:19 | SHD ] C:\Recovery
[29/03/2011 - 11:41:09 | SHD ] C:\System Volume Information
[05/07/2009 - 19:10:17 | N | 26] C:\UpdaterforApp.ini
[30/03/2011 - 09:30:49 | D ] C:\UsbFix
[30/03/2011 - 09:20:32 | A | 3503] C:\UsbFix.txt
[14/08/2010 - 20:27:29 | D ] C:\Users
[30/03/2011 - 08:20:07 | D ] C:\Windows
[14/08/2010 - 18:15:07 | D ] C:\windows 7
[14/08/2010 - 22:50:53 | D ] C:\Windows.old
[07/12/2009 - 06:38:32 | N | 56] C:\xcrashdump.dat
[29/03/2005 - 13:59:16 | R | 31000] D:\A2Vlogo_TM.bmp
[18/08/2010 - 00:35:57 | R | 372] D:\autorun.dat
[26/04/2004 - 12:47:34 | R | 1776323] D:\autorun.exe
[08/04/2003 - 09:07:06 | R | 29] D:\autorun.inf
[07/02/2007 - 15:58:12 | D ] D:\server
[30/03/2011 - 09:30:49 | SHD ] G:\$RECYCLE.BIN
[04/07/2010 - 21:14:31 | D ] G:\BIBI
[20/03/2011 - 19:30:57 | D ] G:\Films
[17/02/2011 - 17:21:32 | D ] G:\Jeux DS
[17/02/2011 - 17:24:20 | D ] G:\Lab Computer Nashville
[17/02/2011 - 17:23:36 | D ] G:\musique
[26/02/2009 - 20:14:00 | D ] G:\Ordi labo Stras
[17/02/2011 - 17:23:09 | D ] G:\pics
[17/02/2011 - 17:22:09 | D ] G:\prog
[30/03/2011 - 09:30:48 | SHD ] G:\RECYCLER
[12/08/2010 - 23:03:14 | D ] G:\sauvegarde avt windows 7
[26/02/2009 - 20:34:56 | D ] G:\Sauvegarde thunderbird
[17/02/2011 - 17:21:07 | D ] G:\Sauvegardes USB
[17/02/2011 - 17:42:11 | D ] G:\Series
[26/07/2010 - 04:46:20 | SHD ] G:\System Volume Information

################## | Vaccin |

C:\Autorun.inf -> Vaccine created by UsbFix (TeamXscript)
D:\Autorun.inf -> Vaccine created by Panda USB Vaccine
G:\Autorun.inf -> Vaccine created by UsbFix (TeamXscript)

################## | Upload |

Please send the file: C:\UsbFix_Upload_Me_SABRINA-PC.zip
http://www.teamxscript.org/Upload.php
Thank you for your contribution.

################## | E.O.F |

oui la recherche dans le registre est toujours plus longue que les fichiers

Merci pour cette réponse rapide! Je suis en train de faire le scan usbfix. Je l'ai en anglais donc j'ai cliqué sue "deletion", j'espère que c'est bien la meme chose. Par contre, le scan est parti tres vite, mais maintenant il bloque sur 48% depuis un petit moment (pas loin de 10min) , est-ce bien normal?
Je reposte le résultat dès que l'ai, si le scan finit un jour....

salut

on peut deja voir si tu n'as pas un truc qui bosse en cachette

▶ Télécharge ici : USBFIX sur ton bureau

branche tous tes periphériques sans les ouvrir

/!\ Désactive provisoirement et seulement le temps de l'utilisation d'USBFIX, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent gêner fortement la procédure de recherche et de nettoyage de l'outil.

si tu as XP => double clique
si tu as Vista ou windows 7 => clic droit "executer en tant que...."

sur l'icône Usbfix située sur ton Bureau.
Sur la page, clique sur le bouton :

▶ choisi l option Suppression

▶ UsbFix scannera ton pc , laisse travailler l outil.

▶ Ensuite post le rapport UsbFix.txt qui apparaitra avec le bureau .

▶ Note : Le rapport UsbFix.txt est sauvegardé a la racine du disque.( C:\UsbFix.txt )

( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )