Virus introuvable + redirection firefox

Salut j'aimerais savoir pourquoi mon PC seek encore!? (lumière clignotante sur le boitier?

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Database version: 8064

Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421

11/1/2011 8:34:42 PM
mbam-log-2011-11-01 (20-34-42).txt

Scan type: Full scan (C:\|)
Objects scanned: 490223
Time elapsed: 1 hour(s), 15 minute(s), 28 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\Users\gaby&francois\documents\Francois\APP\office 2007\msoe2007kg.exe (RiskWare.Tool.CK) -> Quarantined and deleted successfully.

fermer toutes les fenêtres et applications lors de l'installation et de l'analyse.

▶ Télécharge ici :

Malwarebytes

▶ Installe le ( choisis bien "francais" ; ne modifie pas les paramètres d'installe ) et mets le à jour .

relance malwarebytes en suivant scrupuleusement ces consignes :

! Déconnecte toi et ferme toutes applications en cours !

▶ Lance Malwarebyte's .

Fais un examen dit "Complet" .

▶ Laisse le programme travailler ( et ne rien faire d'autre avec le PC durant le scan ).
▶ à la fin tu cliques sur "résultat" .
▶ Vérifie que tous les objets infectés soient validés, puis clique sur " suppression " .

▶ Note : si il faut redémarrer ton PC pour finir le nettoyage, fais le !

▶ Poste le rapport sauvegardé après la suppression des objets infectés (dans l'onglet "rapport/log"de Malwarebytes, le dernier en date)

OTL:

http://www.cijoint.fr/cjlink.php?file=cj201111/cijcEKcIiX.txt

Extras:
http://www.cijoint.fr/cjlink.php?file=cj201111/cijlLxbIxJ.txt

Télécharge ici :OTL

▶ enregistre le sur ton Bureau.

si tu as XP => double clique
si tu as Vista ou windows 7 => clic droit "executer en tant que...."

sur OTL.exe pour le lancer.

▶ => Clique ici pour voir la Configuration

▶ Copie et colle le contenu de ce qui suit en gras dans la partie inférieure d'OTL "Personnalisation"

netsvcs
safebootminimal
safebootnetwork
%systemroot%\system32\config\*.exe /s
%systemroot%\system32\*.sys
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa /s

▶ Clic sur Analyse.

A la fin du scan, le Bloc-Notes va s'ouvrir avec le rapport (OTL.txt).

Ce fichier est sur ton Bureau (en général C:\Documents and settings\le_nom_de_ta_session\OTL.txt)

▶▶▶ NE LE POSTE PAS SUR LE FORUM (il est trop long)

Pour me le transmettre clique sur ce lien : http://www.cijoint.fr/

▶ Clique sur Parcourir et cherche le fichier ci-dessus.

▶ Clique sur Ouvrir.

▶ Clique sur "Cliquez ici pour déposer le fichier".

juste au niveau du bouton , en fin de chargement du fichier , Un lien de cette forme apparaitra :

http://www.cijoint.fr/cjlink.php?file=cjge368/cijSKAP5fU.txt

▶ Copie ce lien dans ta réponse.

▶▶ Tu feras la meme chose avec le "Extra.txt" qui logiquement sera aussi sur ton bureau.

ComboFix 11-10-30.03 - Urgence 10/30/2011 14:28:57.4.4 - x64
Microsoft Windows 7 Édition Familiale Premium 6.1.7601.1.1252.2.1036.18.8191.6769 [GMT -4:00]
Lancé depuis: c:\users\Urgence\Downloads\ComboFix.exe
Commutateurs utilisés :: c:\users\Urgence\Desktop\CFScript.txt
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Un nouveau point de restauration a été créé
.
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_X6VA005
-------\Service_X6va005
.
.
((((((((((((((((((((((((((((( Fichiers créés du 2011-09-28 au 2011-10-30 ))))))))))))))))))))))))))))))))))))
.
.
2011-10-30 18:40 . 2011-10-30 18:40 -------- d-----w- c:\users\Gaby&Francois\AppData\Local\temp
2011-10-30 18:40 . 2011-10-30 18:40 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-10-20 11:30 . 2011-10-20 11:30 -------- d-----w- c:\users\Urgence\AppData\Roaming\Avira
2011-10-20 11:28 . 2011-07-21 16:22 123784 ----a-w- c:\windows\system32\drivers\avipbb.sys
2011-10-20 11:28 . 2011-07-21 16:22 88288 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2011-10-20 11:28 . 2011-10-20 11:28 -------- d-----w- c:\programdata\Avira
2011-10-20 11:28 . 2011-10-20 11:28 -------- d-----w- c:\program files (x86)\Avira
2011-10-12 23:32 . 2011-09-06 03:03 3138048 ----a-w- c:\windows\system32\win32k.sys
2011-10-12 23:32 . 2011-08-17 05:26 613888 ----a-w- c:\windows\system32\psisdecd.dll
2011-10-12 23:32 . 2011-08-17 05:25 108032 ----a-w- c:\windows\system32\psisrndr.ax
2011-10-12 23:32 . 2011-08-17 04:24 465408 ----a-w- c:\windows\SysWow64\psisdecd.dll
2011-10-12 23:32 . 2011-08-17 04:19 75776 ----a-w- c:\windows\SysWow64\psisrndr.ax
2011-10-12 23:31 . 2011-08-27 05:37 861696 ----a-w- c:\windows\system32\oleaut32.dll
2011-10-12 23:31 . 2011-08-27 05:37 331776 ----a-w- c:\windows\system32\oleacc.dll
2011-10-12 23:31 . 2011-08-27 04:26 571904 ----a-w- c:\windows\SysWow64\oleaut32.dll
2011-10-12 23:31 . 2011-08-27 04:26 233472 ----a-w- c:\windows\SysWow64\oleacc.dll
2011-10-09 16:39 . 2011-10-09 16:39 -------- d-----w- C:\AMD
2011-10-09 16:37 . 2011-10-09 16:37 -------- d-----w- c:\programdata\UAB
2011-10-09 16:37 . 2011-10-09 16:37 -------- d-----w- c:\users\Urgence\AppData\Local\PC_Drivers_Headquarters
2011-10-09 16:37 . 2011-10-09 16:37 -------- d-----w- c:\programdata\PC Drivers HeadQuarters
2011-10-09 16:36 . 2011-10-09 16:36 -------- d-----w- c:\program files (x86)\PC Drivers HeadQuarters
2011-10-09 06:08 . 2011-10-09 06:08 -------- d-----w- c:\program files (x86)\Battlelog Web Plugins
2011-10-09 06:01 . 2011-10-09 06:01 -------- d-----w- c:\programdata\EA Core
2011-10-09 05:59 . 2011-10-09 05:59 -------- d--h--w- c:\program files (x86)\Common Files\EAInstaller
2011-10-09 05:59 . 2011-10-10 04:50 280904 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2011-10-09 05:59 . 2011-10-09 05:59 75136 ----a-w- c:\windows\SysWow64\PnkBstrA.exe
2011-10-09 01:50 . 2011-10-09 01:50 -------- d-----w- c:\users\Urgence\AppData\Roaming\Origin
2011-10-09 01:50 . 2011-10-09 01:50 -------- d-----w- c:\users\Urgence\AppData\Local\Origin
2011-10-09 01:49 . 2011-10-09 06:06 -------- d-----w- c:\programdata\Electronic Arts
2011-10-09 01:49 . 2011-10-09 06:01 -------- d-----w- c:\programdata\Origin
2011-10-09 01:49 . 2011-10-09 01:53 -------- d-----w- c:\program files (x86)\Origin Games
2011-10-09 01:49 . 2011-10-09 01:49 -------- d-----w- c:\program files (x86)\Origin
2011-10-09 01:40 . 2011-10-09 01:40 -------- d-----w- c:\program files (x86)\Gravity
.
.
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-10-10 04:50 . 2011-07-16 14:28 280904 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
2011-10-10 02:18 . 2011-07-16 02:18 280904 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0
2011-09-25 23:25 . 2011-05-14 12:47 404640 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-08-31 21:00 . 2010-09-15 02:24 25416 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-20 14:41 . 2010-06-24 15:33 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2011-10-19_22.31.50 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-07-14 04:54 . 2011-10-19 22:26 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-07-14 04:54 . 2011-10-29 02:25 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-07-14 04:54 . 2011-10-19 22:26 65536 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2011-10-29 02:25 65536 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2011-10-19 22:26 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:54 . 2011-10-29 02:25 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-08-27 20:15 . 2011-10-30 16:31 63814 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
- 2009-07-14 05:10 . 2011-10-19 22:03 30260 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2011-10-30 16:31 30260 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2010-08-07 04:05 . 2011-10-30 16:31 13570 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-4277798355-574018920-2560163427-1003_UserData.bin
+ 2010-01-14 00:42 . 2011-10-27 22:06 13944 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-4277798355-574018920-2560163427-1000_UserData.bin
- 2010-01-13 23:35 . 2011-10-07 02:40 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-01-13 23:35 . 2011-10-21 00:05 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-01-13 23:35 . 2011-10-21 00:05 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2010-01-13 23:35 . 2011-10-07 02:40 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2011-10-21 00:05 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-07-14 04:54 . 2011-10-07 02:40 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-10-26 11:32 . 2011-10-26 11:32 25088 c:\windows\Installer\89f22.msi
+ 2010-02-03 03:00 . 2011-10-29 16:25 1604 c:\windows\system32\wdi\ERCQueuedResolutions.dat
+ 2011-10-30 18:41 . 2011-10-30 18:41 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2011-10-19 22:26 . 2011-10-19 22:26 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2011-10-30 18:41 . 2011-10-30 18:41 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2011-10-19 22:26 . 2011-10-19 22:26 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2011-10-19 22:26 . 2009-10-07 06:46 131608 c:\windows\Temp\logishrd\LVPrcInj02.dll
+ 2011-10-30 18:41 . 2009-10-07 06:46 131608 c:\windows\Temp\logishrd\LVPrcInj02.dll
+ 2011-10-30 18:41 . 2009-10-07 06:47 109080 c:\windows\Temp\logishrd\LVPrcInj01.dll
- 2011-10-19 22:26 . 2009-10-07 06:47 109080 c:\windows\Temp\logishrd\LVPrcInj01.dll
- 2010-04-15 14:41 . 2011-10-19 21:43 262144 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2010-04-15 14:41 . 2011-10-29 02:25 262144 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
- 2009-10-17 07:31 . 2011-10-19 22:30 755728 c:\windows\system32\perfh00C.dat
+ 2009-10-17 07:31 . 2011-10-30 16:31 755728 c:\windows\system32\perfh00C.dat
- 2009-07-14 02:36 . 2011-10-19 22:30 661504 c:\windows\system32\perfh009.dat
+ 2009-07-14 02:36 . 2011-10-30 16:31 661504 c:\windows\system32\perfh009.dat
- 2009-10-17 07:31 . 2011-10-19 22:30 154208 c:\windows\system32\perfc00C.dat
+ 2009-10-17 07:31 . 2011-10-30 16:31 154208 c:\windows\system32\perfc00C.dat
- 2009-07-14 02:36 . 2011-10-19 22:30 125590 c:\windows\system32\perfc009.dat
+ 2009-07-14 02:36 . 2011-10-30 16:31 125590 c:\windows\system32\perfc009.dat
- 2009-07-14 05:12 . 2011-10-07 02:40 262144 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2009-07-14 05:12 . 2011-10-21 00:05 262144 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
- 2009-07-14 05:01 . 2011-10-19 22:26 402560 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 05:01 . 2011-10-30 18:41 402560 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2010-10-01 12:34 . 2011-10-30 18:41 2798076 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-4277798355-574018920-2560163427-1003-8192.dat
- 2010-10-01 12:34 . 2011-10-19 22:26 2798076 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-4277798355-574018920-2560163427-1003-8192.dat
- 2011-03-13 22:24 . 2011-10-13 02:43 3344088 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-4277798355-574018920-2560163427-1003-12288.dat
+ 2011-03-13 22:24 . 2011-10-30 18:41 3344088 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-4277798355-574018920-2560163427-1003-12288.dat
- 2010-01-14 01:02 . 2011-10-16 21:30 1505496 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-4277798355-574018920-2560163427-1000-8192.dat
+ 2010-01-14 01:02 . 2011-10-28 01:53 1505496 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-4277798355-574018920-2560163427-1000-8192.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files (x86)\Windows Live\Messenger\msnmsgr.exe" [2011-05-13 4283256]
"Steam"="c:\program files (x86)\Steam\steam.exe" [2011-08-13 1242448]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"PlusService"="c:\program files (x86)\Yuna Software\Messenger Plus!\PlusService.exe" [2011-09-20 801792]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2011-04-21 281768]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Service Google Update (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-03-14 136176]
R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x]
R3 gupdatem;Service Google Update (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-03-14 136176]
R3 lvpopf64;Logitech POP Suppression Filter;c:\windows\system32\DRIVERS\lvpopf64.sys [x]
R3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys [x]
R3 LVUVC64;QuickCam for Notebooks Deluxe(UVC);c:\windows\system32\DRIVERS\lvuvc64.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Service Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R3 WPRO_40_1340;WinPcap Packet Driver (WPRO_40_1340);c:\windows\system32\drivers\WPRO_40_1340.sys [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2011-04-21 136360]
S2 LVPrcS64;Process Monitor;c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe [2009-10-07 191000]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atipmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 e1yexpress;Intel(R) Gigabit Network Connections Driver;c:\windows\system32\DRIVERS\e1y62x64.sys [x]
S3 LVPr2M64;Logitech LVPr2M64 Driver;c:\windows\system32\DRIVERS\LVPr2M64.sys [x]
.
.
Contenu du dossier 'Tâches planifiées'
.
2011-10-30 c:\windows\Tasks\GlaryInitialize.job
- c:\program files (x86)\Glary Utilities\initialize.exe [2011-09-20 13:07]
.
2011-10-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-03-14 02:04]
.
2011-10-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-03-14 02:04]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-01-20 9996320]
"combofix"="c:\combofix\CF29784.3XE" [2010-11-20 345088]
.
------- Examen supplémentaire -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://homepage.gateway.com/rdr.aspx?b=ACGW&l=0c0c&m=dx4822&r=173601106106p0385v195k4861r290
mStart Page = hxxp://homepage.gateway.com/rdr.aspx?b=ACGW&l=0c0c&m=dx4822&r=173601106106p0385v195k4861r290
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xporter vers Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Urgence\AppData\Roaming\Mozilla\Firefox\Profiles\cx02veao.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.spirit-of-metal.com/
.
- - - - ORPHELINS SUPPRIMES - - - -
.
Toolbar-Locked - (no file)
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
------------------------ Autres processus actifs ------------------------
.
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Bonjour\mDNSResponder.exe
c:\windows\SysWOW64\PnkBstrA.exe
c:\program files (x86)\Common Files\LogiShrd\LVMVFM\LVPrS64H.exe
c:\program files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
.
**************************************************************************
.
Heure de fin: 2011-10-30 14:56:20 - La machine a redémarré
ComboFix-quarantined-files.txt 2011-10-30 18:56
ComboFix2.txt 2011-10-29 12:39
ComboFix3.txt 2011-10-19 23:13
ComboFix4.txt 2011-10-19 22:35
.
Avant-CF: 638,791,958,528 octets libres
Après-CF: 638,670,311,424 octets libres
.
- - End Of File - - 03C54858D330A8B23576B2BD481B3F0A

refais la meme chose mais avec juste ca dedans :

Driver::
X6va005

Désolé pour l'attente

ComboFix 11-10-29.03 - Urgence 10/29/2011 8:12.3.4 - x64
Microsoft Windows 7 Édition Familiale Premium 6.1.7601.1.1252.2.1036.18.8191.6584 [GMT -4:00]
Lancé depuis: c:\users\Urgence\Downloads\ComboFix.exe
Commutateurs utilisés :: c:\users\Urgence\Desktop\CFScript.txt
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Un nouveau point de restauration a été créé
.
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\Spybot - Search & Destroy
c:\program files (x86)\Spybot - Search & Destroy\advcheck.dll
c:\program files (x86)\Spybot - Search & Destroy\aports.dll
c:\program files (x86)\Spybot - Search & Destroy\blindman.exe
c:\program files (x86)\Spybot - Search & Destroy\DBIXQZNJOSEUV.scr
c:\program files (x86)\Spybot - Search & Destroy\Default configuration.ini
c:\program files (x86)\Spybot - Search & Destroy\DelZip179.dll
c:\program files (x86)\Spybot - Search & Destroy\Dummies\dummy.cd_clint.dll
c:\program files (x86)\Spybot - Search & Destroy\Dummies\dummy.dap.gif
c:\program files (x86)\Spybot - Search & Destroy\Dummies\dummy.data.xml
c:\program files (x86)\Spybot - Search & Destroy\Dummies\dummy.default.gif
c:\program files (x86)\Spybot - Search & Destroy\Dummies\dummy.related.htm
c:\program files (x86)\Spybot - Search & Destroy\ELCTAUH.scr
c:\program files (x86)\Spybot - Search & Destroy\Help\Brasil.license.txt
c:\program files (x86)\Spybot - Search & Destroy\Help\Cesky.license.txt
c:\program files (x86)\Spybot - Search & Destroy\Help\Deutsch.license.txt
c:\program files (x86)\Spybot - Search & Destroy\Help\English.chm
c:\program files (x86)\Spybot - Search & Destroy\Help\English.license.txt
c:\program files (x86)\Spybot - Search & Destroy\Help\Espanol.license.txt
c:\program files (x86)\Spybot - Search & Destroy\Help\Francais.license.txt
c:\program files (x86)\Spybot - Search & Destroy\Help\Hellenic.license.txt
c:\program files (x86)\Spybot - Search & Destroy\Help\Italiano.license.txt
c:\program files (x86)\Spybot - Search & Destroy\Help\Japanese.license.ansi.txt
c:\program files (x86)\Spybot - Search & Destroy\Help\Japanese.license.txt
c:\program files (x86)\Spybot - Search & Destroy\Help\Korean.license.txt
c:\program files (x86)\Spybot - Search & Destroy\Help\Nederlands.license.txt
c:\program files (x86)\Spybot - Search & Destroy\Help\Polski.license.txt
c:\program files (x86)\Spybot - Search & Destroy\Help\Russkiy.license.txt
c:\program files (x86)\Spybot - Search & Destroy\Help\Slovensky.license.txt
c:\program files (x86)\Spybot - Search & Destroy\Help\Srpski.license.txt
c:\program files (x86)\Spybot - Search & Destroy\Help\Suomi.license.txt
c:\program files (x86)\Spybot - Search & Destroy\Includes\Adware.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\AdwareC.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\Browserpages.sbs
c:\program files (x86)\Spybot - Search & Destroy\Includes\CLSIDs.sbs
c:\program files (x86)\Spybot - Search & Destroy\Includes\Cookies.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\Cookies.sbs
c:\program files (x86)\Spybot - Search & Destroy\Includes\Dialer.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\Dialer.sbs
c:\program files (x86)\Spybot - Search & Destroy\Includes\DialerC.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\Domains.sbs
c:\program files (x86)\Spybot - Search & Destroy\Includes\HeavyDuty.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\Hijackers.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\HijackersC.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\Keyloggers.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\KeyloggersC.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\Logs.uts
c:\program files (x86)\Spybot - Search & Destroy\Includes\LSP.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\LSP.sbs
c:\program files (x86)\Spybot - Search & Destroy\Includes\Malware.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\MalwareC.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\OperaPlugins.sbs
c:\program files (x86)\Spybot - Search & Destroy\Includes\ProcWatch.sbs
c:\program files (x86)\Spybot - Search & Destroy\Includes\PUPS.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\PUPSC.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\RegWatch.sbs
c:\program files (x86)\Spybot - Search & Destroy\Includes\RegXLinks.sbs
c:\program files (x86)\Spybot - Search & Destroy\Includes\Revision.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\Revision.sbs
c:\program files (x86)\Spybot - Search & Destroy\Includes\Searchpages.sbs
c:\program files (x86)\Spybot - Search & Destroy\Includes\Security.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\SecurityC.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\Services.sbs
c:\program files (x86)\Spybot - Search & Destroy\Includes\Spybots.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\SpybotsC.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\Spyware.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\SpywareC.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\Startup.tnfo
c:\program files (x86)\Spybot - Search & Destroy\Includes\Targets.nfo
c:\program files (x86)\Spybot - Search & Destroy\Includes\Tracks.uti
c:\program files (x86)\Spybot - Search & Destroy\Includes\Trojans.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\TrojansC.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\TTLASSH.sbs
c:\program files (x86)\Spybot - Search & Destroy\Includes\URL-Blacklist.sbs
c:\program files (x86)\Spybot - Search & Destroy\Includes\X509White.sbs
c:\program files (x86)\Spybot - Search & Destroy\Languages\Afrikaans.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Arabic.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Azeri.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Bahasa Indonesia.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Belarusskiy.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Bosanski.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Brasil.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Bulgarski.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Catalan.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Cesky.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Chinese (simplified).sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Chinese (traditional).sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Dansk.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Deutsch.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Eesti.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\English.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Espanol.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Esperanto.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Euskera.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Farsi.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Francais.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Furlan.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Galego.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Hebrew.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Hellenic.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Hindi.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Hrvatski.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Islenska.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Italiano.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Japanese.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Korean.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Latvian.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Letzebuergesch.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Lietuviu.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Magyar.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Makedonski.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Melayu.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Nederlands.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Norsk.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Polski.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Portugues.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Romaneste.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Russkiy.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Shqip.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Slovenscina.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Slovensky.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Srpski.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Suomi.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Svenska.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Thai.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Turkce.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Ukrainian.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Uzbek.sbl
c:\program files (x86)\Spybot - Search & Destroy\messages.zres
c:\program files (x86)\Spybot - Search & Destroy\OptOut.ini
c:\program files (x86)\Spybot - Search & Destroy\Plugins\Chai.dll
c:\program files (x86)\Spybot - Search & Destroy\Plugins\Fennel.dll
c:\program files (x86)\Spybot - Search & Destroy\Plugins\Mate.dll
c:\program files (x86)\Spybot - Search & Destroy\Plugins\TCPIPAddress.dll
c:\program files (x86)\Spybot - Search & Destroy\SDFiles.exe
c:\program files (x86)\Spybot - Search & Destroy\SDHelper.dll
c:\program files (x86)\Spybot - Search & Destroy\SDMain.exe
c:\program files (x86)\Spybot - Search & Destroy\SDShred.exe
c:\program files (x86)\Spybot - Search & Destroy\SDUpdate.exe
c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe
c:\program files (x86)\Spybot - Search & Destroy\Skins\Colorblind.ini
c:\program files (x86)\Spybot - Search & Destroy\Skins\Italia.ini
c:\program files (x86)\Spybot - Search & Destroy\Skins\Italia.jpg
c:\program files (x86)\Spybot - Search & Destroy\Skins\Peace.ini
c:\program files (x86)\Spybot - Search & Destroy\Skins\Peace.jpg
c:\program files (x86)\Spybot - Search & Destroy\SpybotSD.exe
c:\program files (x86)\Spybot - Search & Destroy\sqlite3.dll
c:\program files (x86)\Spybot - Search & Destroy\TeaTimer.exe
c:\program files (x86)\Spybot - Search & Destroy\Tools.dll
c:\program files (x86)\Spybot - Search & Destroy\unins000.dat
c:\program files (x86)\Spybot - Search & Destroy\unins000.exe
c:\program files (x86)\Spybot - Search & Destroy\unins000.msg
c:\program files (x86)\Spybot - Search & Destroy\UninsSrv.dll
c:\program files (x86)\Spybot - Search & Destroy\Update.exe
c:\program files (x86)\Spybot - Search & Destroy\Updates\advcheck165.exe
c:\program files (x86)\Spybot - Search & Destroy\Updates\advcheck165.zip
c:\program files (x86)\Spybot - Search & Destroy\Updates\clsid.zip
c:\program files (x86)\Spybot - Search & Destroy\Updates\downloaded.ini
c:\program files (x86)\Spybot - Search & Destroy\Updates\online.ini
c:\program files (x86)\Spybot - Search & Destroy\Updates\online.ini.uiz
c:\program files (x86)\Spybot - Search & Destroy\Updates\teatimer166.exe
c:\program files (x86)\Spybot - Search & Destroy\Updates\teatimer166.zip
c:\program files (x86)\Spybot - Search & Destroy\UXWYABUY.scr
c:\program files (x86)\Spybot - Search & Destroy\YAYSRKV.scr
.
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_SBSDWSCService
.
.
((((((((((((((((((((((((((((( Fichiers créés du 2011-09-28 au 2011-10-29 ))))))))))))))))))))))))))))))))))))
.
.
2011-10-29 12:24 . 2011-10-29 12:24 -------- d-----w- c:\users\Gaby&Francois\AppData\Local\temp
2011-10-29 12:24 . 2011-10-29 12:24 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-10-20 11:30 . 2011-10-20 11:30 -------- d-----w- c:\users\Urgence\AppData\Roaming\Avira
2011-10-20 11:28 . 2011-07-21 16:22 123784 ----a-w- c:\windows\system32\drivers\avipbb.sys
2011-10-20 11:28 . 2011-07-21 16:22 88288 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2011-10-20 11:28 . 2011-10-20 11:28 -------- d-----w- c:\programdata\Avira
2011-10-20 11:28 . 2011-10-20 11:28 -------- d-----w- c:\program files (x86)\Avira
2011-10-12 23:32 . 2011-09-06 03:03 3138048 ----a-w- c:\windows\system32\win32k.sys
2011-10-12 23:32 . 2011-08-17 05:26 613888 ----a-w- c:\windows\system32\psisdecd.dll
2011-10-12 23:32 . 2011-08-17 05:25 108032 ----a-w- c:\windows\system32\psisrndr.ax
2011-10-12 23:32 . 2011-08-17 04:24 465408 ----a-w- c:\windows\SysWow64\psisdecd.dll
2011-10-12 23:32 . 2011-08-17 04:19 75776 ----a-w- c:\windows\SysWow64\psisrndr.ax
2011-10-12 23:31 . 2011-08-27 05:37 861696 ----a-w- c:\windows\system32\oleaut32.dll
2011-10-12 23:31 . 2011-08-27 05:37 331776 ----a-w- c:\windows\system32\oleacc.dll
2011-10-12 23:31 . 2011-08-27 04:26 571904 ----a-w- c:\windows\SysWow64\oleaut32.dll
2011-10-12 23:31 . 2011-08-27 04:26 233472 ----a-w- c:\windows\SysWow64\oleacc.dll
2011-10-09 16:39 . 2011-10-09 16:39 -------- d-----w- C:\AMD
2011-10-09 16:37 . 2011-10-09 16:37 -------- d-----w- c:\programdata\UAB
2011-10-09 16:37 . 2011-10-09 16:37 -------- d-----w- c:\users\Urgence\AppData\Local\PC_Drivers_Headquarters
2011-10-09 16:37 . 2011-10-09 16:37 -------- d-----w- c:\programdata\PC Drivers HeadQuarters
2011-10-09 16:36 . 2011-10-09 16:36 -------- d-----w- c:\program files (x86)\PC Drivers HeadQuarters
2011-10-09 06:08 . 2011-10-09 06:08 -------- d-----w- c:\program files (x86)\Battlelog Web Plugins
2011-10-09 06:01 . 2011-10-09 06:01 -------- d-----w- c:\programdata\EA Core
2011-10-09 05:59 . 2011-10-09 05:59 -------- d--h--w- c:\program files (x86)\Common Files\EAInstaller
2011-10-09 05:59 . 2011-10-10 04:50 280904 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2011-10-09 05:59 . 2011-10-09 05:59 75136 ----a-w- c:\windows\SysWow64\PnkBstrA.exe
2011-10-09 01:50 . 2011-10-09 01:50 -------- d-----w- c:\users\Urgence\AppData\Roaming\Origin
2011-10-09 01:50 . 2011-10-09 01:50 -------- d-----w- c:\users\Urgence\AppData\Local\Origin
2011-10-09 01:49 . 2011-10-09 06:06 -------- d-----w- c:\programdata\Electronic Arts
2011-10-09 01:49 . 2011-10-09 06:01 -------- d-----w- c:\programdata\Origin
2011-10-09 01:49 . 2011-10-09 01:53 -------- d-----w- c:\program files (x86)\Origin Games
2011-10-09 01:49 . 2011-10-09 01:49 -------- d-----w- c:\program files (x86)\Origin
2011-10-09 01:40 . 2011-10-09 01:40 -------- d-----w- c:\program files (x86)\Gravity
.
.
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-10-10 04:50 . 2011-07-16 14:28 280904 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
2011-10-10 02:18 . 2011-07-16 02:18 280904 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0
2011-09-25 23:25 . 2011-05-14 12:47 404640 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-08-31 21:00 . 2010-09-15 02:24 25416 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-20 14:41 . 2010-06-24 15:33 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2011-10-19_22.31.50 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-07-14 04:54 . 2011-10-19 22:26 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-07-14 04:54 . 2011-10-29 02:25 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-07-14 04:54 . 2011-10-19 22:26 65536 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2011-10-29 02:25 65536 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2011-10-19 22:26 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:54 . 2011-10-29 02:25 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-08-27 20:15 . 2011-10-29 12:05 63798 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
- 2009-07-14 05:10 . 2011-10-19 22:03 30260 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2011-10-29 12:05 30260 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2010-08-07 04:05 . 2011-10-29 12:05 13530 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-4277798355-574018920-2560163427-1003_UserData.bin
+ 2010-01-14 00:42 . 2011-10-27 22:06 13944 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-4277798355-574018920-2560163427-1000_UserData.bin
- 2010-01-13 23:35 . 2011-10-07 02:40 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-01-13 23:35 . 2011-10-21 00:05 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-01-13 23:35 . 2011-10-21 00:05 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2010-01-13 23:35 . 2011-10-07 02:40 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2011-10-21 00:05 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-07-14 04:54 . 2011-10-07 02:40 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-10-26 11:32 . 2011-10-26 11:32 25088 c:\windows\Installer\89f22.msi
+ 2010-02-03 03:00 . 2011-10-20 02:09 1604 c:\windows\system32\wdi\ERCQueuedResolutions.dat
+ 2011-10-29 12:25 . 2011-10-29 12:25 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2011-10-19 22:26 . 2011-10-19 22:26 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2011-10-29 12:25 . 2011-10-29 12:25 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2011-10-19 22:26 . 2011-10-19 22:26 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2011-10-19 22:26 . 2009-10-07 06:46 131608 c:\windows\Temp\logishrd\LVPrcInj02.dll
+ 2011-10-29 12:25 . 2009-10-07 06:46 131608 c:\windows\Temp\logishrd\LVPrcInj02.dll
+ 2011-10-29 12:25 . 2009-10-07 06:47 109080 c:\windows\Temp\logishrd\LVPrcInj01.dll
- 2011-10-19 22:26 . 2009-10-07 06:47 109080 c:\windows\Temp\logishrd\LVPrcInj01.dll
- 2010-04-15 14:41 . 2011-10-19 21:43 262144 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2010-04-15 14:41 . 2011-10-29 02:25 262144 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
- 2009-10-17 07:31 . 2011-10-19 22:30 755728 c:\windows\system32\perfh00C.dat
+ 2009-10-17 07:31 . 2011-10-29 12:07 755728 c:\windows\system32\perfh00C.dat
- 2009-07-14 02:36 . 2011-10-19 22:30 661504 c:\windows\system32\perfh009.dat
+ 2009-07-14 02:36 . 2011-10-29 12:07 661504 c:\windows\system32\perfh009.dat
- 2009-10-17 07:31 . 2011-10-19 22:30 154208 c:\windows\system32\perfc00C.dat
+ 2009-10-17 07:31 . 2011-10-29 12:07 154208 c:\windows\system32\perfc00C.dat
- 2009-07-14 02:36 . 2011-10-19 22:30 125590 c:\windows\system32\perfc009.dat
+ 2009-07-14 02:36 . 2011-10-29 12:07 125590 c:\windows\system32\perfc009.dat
- 2009-07-14 05:12 . 2011-10-07 02:40 262144 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2009-07-14 05:12 . 2011-10-21 00:05 262144 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
- 2009-07-14 05:01 . 2011-10-19 22:26 402560 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 05:01 . 2011-10-29 12:24 402560 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2010-10-01 12:34 . 2011-10-29 12:24 2798076 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-4277798355-574018920-2560163427-1003-8192.dat
- 2010-10-01 12:34 . 2011-10-19 22:26 2798076 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-4277798355-574018920-2560163427-1003-8192.dat
- 2011-03-13 22:24 . 2011-10-13 02:43 3344088 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-4277798355-574018920-2560163427-1003-12288.dat
+ 2011-03-13 22:24 . 2011-10-29 04:36 3344088 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-4277798355-574018920-2560163427-1003-12288.dat
- 2010-01-14 01:02 . 2011-10-16 21:30 1505496 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-4277798355-574018920-2560163427-1000-8192.dat
+ 2010-01-14 01:02 . 2011-10-28 01:53 1505496 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-4277798355-574018920-2560163427-1000-8192.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files (x86)\Windows Live\Messenger\msnmsgr.exe" [2011-05-13 4283256]
"Steam"="c:\program files (x86)\Steam\steam.exe" [2011-08-13 1242448]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"PlusService"="c:\program files (x86)\Yuna Software\Messenger Plus!\PlusService.exe" [2011-09-20 801792]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2011-04-21 281768]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Service Google Update (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-03-14 136176]
R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x]
R3 gupdatem;Service Google Update (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-03-14 136176]
R3 lvpopf64;Logitech POP Suppression Filter;c:\windows\system32\DRIVERS\lvpopf64.sys [x]
R3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys [x]
R3 LVUVC64;QuickCam for Notebooks Deluxe(UVC);c:\windows\system32\DRIVERS\lvuvc64.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Service Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R3 WPRO_40_1340;WinPcap Packet Driver (WPRO_40_1340);c:\windows\system32\drivers\WPRO_40_1340.sys [x]
R3 X6va005;X6va005;c:\users\Urgence\AppData\Local\Temp\0057DB8.tmp [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2011-04-21 136360]
S2 LVPrcS64;Process Monitor;c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe [2009-10-07 191000]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atipmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 e1yexpress;Intel(R) Gigabit Network Connections Driver;c:\windows\system32\DRIVERS\e1y62x64.sys [x]
S3 LVPr2M64;Logitech LVPr2M64 Driver;c:\windows\system32\DRIVERS\LVPr2M64.sys [x]
.
.
Contenu du dossier 'Tâches planifiées'
.
2011-10-29 c:\windows\Tasks\GlaryInitialize.job
- c:\program files (x86)\Glary Utilities\initialize.exe [2011-09-20 13:07]
.
2011-10-29 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-03-14 02:04]
.
2011-10-29 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-03-14 02:04]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-01-20 9996320]
"combofix"="c:\combofix\CF1748.3XE" [2010-11-20 345088]
.
------- Examen supplémentaire -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://homepage.gateway.com/rdr.aspx?b=ACGW&l=0c0c&m=dx4822&r=173601106106p0385v195k4861r290
mStart Page = hxxp://homepage.gateway.com/rdr.aspx?b=ACGW&l=0c0c&m=dx4822&r=173601106106p0385v195k4861r290
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xporter vers Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Urgence\AppData\Roaming\Mozilla\Firefox\Profiles\cx02veao.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.spirit-of-metal.com/
.
- - - - ORPHELINS SUPPRIMES - - - -
.
Toolbar-Locked - (no file)
AddRemove-{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1 - c:\program files (x86)\Spybot - Search & Destroy\unins000.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\X6va005]
"ImagePath"="\??\c:\users\Urgence\AppData\Local\Temp\0057DB8.tmp"
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
------------------------ Autres processus actifs ------------------------
.
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Bonjour\mDNSResponder.exe
c:\windows\SysWOW64\PnkBstrA.exe
c:\program files (x86)\Common Files\LogiShrd\LVMVFM\LVPrS64H.exe
c:\program files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
.
**************************************************************************
.
Heure de fin: 2011-10-29 08:39:04 - La machine a redémarré
ComboFix-quarantined-files.txt 2011-10-29 12:38
ComboFix2.txt 2011-10-19 23:13
ComboFix3.txt 2011-10-19 22:35
.
Avant-CF: 639,397,376,000 octets libres
Après-CF: 639,099,990,016 octets libres
.
- - End Of File - - F7A74994B1591BF4FF0077934C3A361D

__________________________________________________
=>/!\Le script qui suit a été écrit spécialement cet ordinateur/!\ <=
=>il est fort déconseillé de le transposer sur un autre ordinateur !<=
----------------------------------------------------------------------------

Toujours avec toutes les protections désactivées, fais ceci :

▶ Ouvre le bloc-notes (Menu démarrer --> programmes --> accessoires --> bloc-notes)
▶ Copie/colle dans le bloc-notes ce qui entre les lignes ci dessous (sans les lignes) :

----------------------------------------------------------
KillAll::

Folder::
c:\program files (x86)\Spybot - Search & Destroy

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"=-
"iTunesHelper"=-

Driver::
SBSDWSCService

RegLock::
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]


------------------------------------------------------------------

▶ Enregistre ce fichier sur ton Bureau (et pas ailleurs !) sous le nom CFScript.txt
▶ Quitte le Bloc Notes

▶ Fais un glisser/déposer de ce fichier CFScript sur le fichier combofix

▶ Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal ! Ne touche à rien tant que le scan n'est pas terminé.
▶ Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
▶ Si le fichier ne s'ouvre pas, il se trouve ici => C:\ComboFix.txt

C:\Qoobox\Quarantine\C
C:\Qoobox\Quarantine\catchme.log
C:\Qoobox\Quarantine\Registry_backups
C:\Qoobox\Quarantine\C\install.exe.vir
C:\Qoobox\Quarantine\C\Users
C:\Qoobox\Quarantine\C\Windows
C:\Qoobox\Quarantine\C\Users\Urgence
C:\Qoobox\Quarantine\C\Users\Urgence\AppData
C:\Qoobox\Quarantine\C\Users\Urgence\AppData\Local
C:\Qoobox\Quarantine\C\Users\Urgence\AppData\Roaming
C:\Qoobox\Quarantine\C\Users\Urgence\AppData\Local\TempDIR
C:\Qoobox\Quarantine\C\Users\Urgence\AppData\Local\TempDIR\raptr_installer.exe.vir
C:\Qoobox\Quarantine\C\Users\Urgence\AppData\Roaming\app
C:\Qoobox\Quarantine\C\Users\Urgence\AppData\Roaming\app\Jerakine_lang.dat.vir
C:\Qoobox\Quarantine\C\Users\Urgence\AppData\Roaming\app\Jerakine_lang_vesrion.dat.vir
C:\Qoobox\Quarantine\C\Windows\Temp
C:\Qoobox\Quarantine\C\Windows\Temp\logishrd
C:\Qoobox\Quarantine\Registry_backups\AddRemove-Adobe Shockwave Player.reg.dat
C:\Qoobox\Quarantine\Registry_backups\AddRemove-dBpoweramp AAC Encoder.reg.dat
C:\Qoobox\Quarantine\Registry_backups\AddRemove-dBpoweramp CLI Encoder.reg.dat
C:\Qoobox\Quarantine\Registry_backups\AddRemove-dBpoweramp Dalet Codec.reg.dat
C:\Qoobox\Quarantine\Registry_backups\AddRemove-dBpoweramp DSP Effects.reg.dat
C:\Qoobox\Quarantine\Registry_backups\AddRemove-dBpoweramp FLAC Codec.reg.dat
C:\Qoobox\Quarantine\Registry_backups\AddRemove-dBpoweramp m4a Codec.reg.dat
C:\Qoobox\Quarantine\Registry_backups\AddRemove-dBpoweramp m4a Utilities.reg.dat
C:\Qoobox\Quarantine\Registry_backups\AddRemove-dBpoweramp m4b Audio book Encoder.reg.dat
C:\Qoobox\Quarantine\Registry_backups\AddRemove-dBpoweramp Midi Decoder.reg.dat
C:\Qoobox\Quarantine\Registry_backups\AddRemove-dBpoweramp Monkeys Audio Codec.reg.dat
C:\Qoobox\Quarantine\Registry_backups\AddRemove-dBpoweramp Mp2 and BwfMp2 codec.reg.dat
C:\Qoobox\Quarantine\Registry_backups\AddRemove-dBpoweramp mp3 (Fraunhofer IIS) Codec.reg.dat
C:\Qoobox\Quarantine\Registry_backups\AddRemove-dBpoweramp Musepack Codec.reg.dat
C:\Qoobox\Quarantine\Registry_backups\AddRemove-dBpoweramp Music Converter.reg.dat
C:\Qoobox\Quarantine\Registry_backups\AddRemove-dBpoweramp Ogg Vorbis Codec.reg.dat
C:\Qoobox\Quarantine\Registry_backups\AddRemove-dBpoweramp Ogg Vorbis Lancer Encoder.reg.dat
C:\Qoobox\Quarantine\Registry_backups\AddRemove-dBpoweramp OptimFROG Codec.reg.dat
C:\Qoobox\Quarantine\Registry_backups\AddRemove-dBpoweramp Real Audio (Helix) Encoder.reg.dat
C:\Qoobox\Quarantine\Registry_backups\AddRemove-dBpoweramp Shorten Codec.reg.dat
C:\Qoobox\Quarantine\Registry_backups\AddRemove-dBpoweramp Speex Codec.reg.dat
C:\Qoobox\Quarantine\Registry_backups\AddRemove-dBPoweramp tooLame MP2 codec.reg.dat
C:\Qoobox\Quarantine\Registry_backups\AddRemove-dBpoweramp TTA Codec.reg.dat
C:\Qoobox\Quarantine\Registry_backups\AddRemove-dBpoweramp Wave64 Codec.reg.dat
C:\Qoobox\Quarantine\Registry_backups\AddRemove-dBpoweramp WavPack Codec.reg.dat
C:\Qoobox\Quarantine\Registry_backups\AddRemove-dBpoweramp Windows Media Audio 10 Codec.reg.dat
C:\Qoobox\Quarantine\Registry_backups\AddRemove-dBpowerAMP Windows Media Audio 9 Codec.reg.dat
C:\Qoobox\Quarantine\Registry_backups\AddRemove-dBpoweramp [Calculate Audio CRC] Codec.reg.dat
C:\Qoobox\Quarantine\Registry_backups\AddRemove-dBpoweramp [Multi Encoder] Codec.reg.dat
C:\Qoobox\Quarantine\Registry_backups\AddRemove-dBpoweramp [ReplayGain] Codec.reg.dat
C:\Qoobox\Quarantine\Registry_backups\tcpip.reg
C:\Qoobox\Quarantine\Registry_backups\Toolbar-Locked.reg.dat
C:\Qoobox\Quarantine\Registry_backups\Wow6432Node-Toolbar-Locked.reg.dat

tu l'as passé deux fois apparemment...

execute cet outil avec le clic droit "executer en tant qu'administrateur" après l'avoir enregistré dans ton pc , puis fournis le rapport obtenu

http://dl.dropbox.com/u/21363431/fichiers/Comboquarantine.bat

Le bloc-notes ou Combofix? Parce que combofix j'ai voulu renommé le .exe et il me disais que c'était impossible...

pourquoi tu ne l'as pas renommé ?

tu as utilisé defogger au moins avant ?
¤¤¤¤¤¤¤¤¤¤_g3n-h@ckm@n_developpement_¤¤¤¤¤¤¤¤¤¤
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤_Pre_scan_¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

ComboFix 11-10-19.06 - Urgence 10/19/2011 18:47:53.2.4 - x64
Microsoft Windows 7 Édition Familiale Premium 6.1.7601.1.1252.2.1036.18.8191.6743 [GMT -4:00]
Lancé depuis: c:\users\Urgence\Downloads\ComboFix.exe
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Un nouveau point de restauration a été créé
.
.
((((((((((((((((((((((((((((( Fichiers créés du 2011-09-19 au 2011-10-19 ))))))))))))))))))))))))))))))))))))
.
.
2011-10-19 22:59 . 2011-10-19 22:59 -------- d-----w- c:\users\Gaby&Francois\AppData\Local\temp
2011-10-19 22:59 . 2011-10-19 22:59 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-10-12 23:32 . 2011-09-06 03:03 3138048 ----a-w- c:\windows\system32\win32k.sys
2011-10-12 23:32 . 2011-08-17 05:26 613888 ----a-w- c:\windows\system32\psisdecd.dll
2011-10-12 23:32 . 2011-08-17 05:25 108032 ----a-w- c:\windows\system32\psisrndr.ax
2011-10-12 23:32 . 2011-08-17 04:24 465408 ----a-w- c:\windows\SysWow64\psisdecd.dll
2011-10-12 23:32 . 2011-08-17 04:19 75776 ----a-w- c:\windows\SysWow64\psisrndr.ax
2011-10-12 23:31 . 2011-08-27 05:37 861696 ----a-w- c:\windows\system32\oleaut32.dll
2011-10-12 23:31 . 2011-08-27 05:37 331776 ----a-w- c:\windows\system32\oleacc.dll
2011-10-12 23:31 . 2011-08-27 04:26 571904 ----a-w- c:\windows\SysWow64\oleaut32.dll
2011-10-12 23:31 . 2011-08-27 04:26 233472 ----a-w- c:\windows\SysWow64\oleacc.dll
2011-10-09 16:39 . 2011-10-09 16:39 -------- d-----w- C:\AMD
2011-10-09 16:37 . 2011-10-09 16:37 -------- d-----w- c:\programdata\UAB
2011-10-09 16:37 . 2011-10-09 16:37 -------- d-----w- c:\users\Urgence\AppData\Local\PC_Drivers_Headquarters
2011-10-09 16:37 . 2011-10-09 16:37 -------- d-----w- c:\programdata\PC Drivers HeadQuarters
2011-10-09 16:36 . 2011-10-09 16:36 -------- d-----w- c:\program files (x86)\PC Drivers HeadQuarters
2011-10-09 06:08 . 2011-10-09 06:08 -------- d-----w- c:\program files (x86)\Battlelog Web Plugins
2011-10-09 06:01 . 2011-10-09 06:01 -------- d-----w- c:\programdata\EA Core
2011-10-09 05:59 . 2011-10-09 05:59 -------- d--h--w- c:\program files (x86)\Common Files\EAInstaller
2011-10-09 05:59 . 2011-10-10 04:50 280904 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2011-10-09 05:59 . 2011-10-09 05:59 75136 ----a-w- c:\windows\SysWow64\PnkBstrA.exe
2011-10-09 01:50 . 2011-10-09 01:50 -------- d-----w- c:\users\Urgence\AppData\Roaming\Origin
2011-10-09 01:50 . 2011-10-09 01:50 -------- d-----w- c:\users\Urgence\AppData\Local\Origin
2011-10-09 01:49 . 2011-10-09 06:06 -------- d-----w- c:\programdata\Electronic Arts
2011-10-09 01:49 . 2011-10-09 06:01 -------- d-----w- c:\programdata\Origin
2011-10-09 01:49 . 2011-10-09 01:53 -------- d-----w- c:\program files (x86)\Origin Games
2011-10-09 01:49 . 2011-10-09 01:49 -------- d-----w- c:\program files (x86)\Origin
2011-10-09 01:40 . 2011-10-09 01:40 -------- d-----w- c:\program files (x86)\Gravity
2011-09-28 00:58 . 2011-09-28 00:58 -------- d-----w- c:\programdata\Kaspersky Lab Setup Files
2011-09-28 00:21 . 2011-10-19 21:19 512 ----a-w- C:\PhysicalDisk0_MBR.bin
2011-09-28 00:17 . 2011-10-19 21:19 -------- d-----w- C:\ZHP
2011-09-28 00:16 . 2011-10-19 21:19 -------- d-----w- c:\program files (x86)\ZHPDiag
2011-09-27 23:26 . 2011-09-27 23:26 -------- d-----w- c:\program files (x86)\Apple Software Update
2011-09-27 23:26 . 2011-09-27 23:26 -------- d-----w- c:\program files (x86)\Bonjour
2011-09-27 23:26 . 2011-09-27 23:26 -------- d-----w- c:\program files\Bonjour
2011-09-20 00:21 . 2011-09-20 00:28 -------- d-----w- c:\users\Gaby&Francois\AppData\Roaming\GlarySoft
2011-09-20 00:19 . 2011-10-15 17:48 -------- d-----w- c:\program files (x86)\Glary Utilities
.
.
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-10-10 04:50 . 2011-07-16 14:28 280904 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
2011-10-10 02:18 . 2011-07-16 02:18 280904 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0
2011-09-25 23:25 . 2011-05-14 12:47 404640 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-08-31 21:00 . 2010-09-15 02:24 25416 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-20 14:41 . 2010-06-24 15:33 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2011-07-30 16:45 . 2009-07-14 02:36 175616 ----a-w- c:\windows\system32\msclmd.dll
2011-07-30 16:45 . 2009-07-14 02:36 152576 ----a-w- c:\windows\SysWow64\msclmd.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2011-10-19_22.31.50 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-08-27 20:15 . 2011-10-19 22:33 63070 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
- 2009-07-14 05:10 . 2011-10-19 22:03 30260 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2011-10-19 22:33 30260 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2010-08-07 04:05 . 2011-10-19 22:33 13208 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-4277798355-574018920-2560163427-1003_UserData.bin
- 2011-10-19 22:26 . 2011-10-19 22:26 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2011-10-19 23:00 . 2011-10-19 23:00 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2011-10-19 23:00 . 2011-10-19 23:00 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2011-10-19 22:26 . 2011-10-19 22:26 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2011-10-19 22:26 . 2009-10-07 06:46 131608 c:\windows\Temp\logishrd\LVPrcInj02.dll
+ 2011-10-19 23:00 . 2009-10-07 06:46 131608 c:\windows\Temp\logishrd\LVPrcInj02.dll
- 2011-10-19 22:26 . 2009-10-07 06:47 109080 c:\windows\Temp\logishrd\LVPrcInj01.dll
+ 2011-10-19 23:00 . 2009-10-07 06:47 109080 c:\windows\Temp\logishrd\LVPrcInj01.dll
+ 2009-07-14 05:01 . 2011-10-19 22:59 402560 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2009-07-14 05:01 . 2011-10-19 22:26 402560 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2011-03-13 22:24 . 2011-10-13 02:43 3344088 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-4277798355-574018920-2560163427-1003-12288.dat
+ 2011-03-13 22:24 . 2011-10-19 22:59 3344088 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-4277798355-574018920-2560163427-1003-12288.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files (x86)\Windows Live\Messenger\msnmsgr.exe" [2011-05-13 4283256]
"Steam"="c:\program files (x86)\Steam\steam.exe" [2011-08-13 1242448]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"PlusService"="c:\program files (x86)\Yuna Software\Messenger Plus!\PlusService.exe" [2011-09-20 801792]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2011-07-05 421888]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-08-19 421736]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Service Google Update (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-03-14 136176]
R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x]
R3 gupdatem;Service Google Update (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-03-14 136176]
R3 lvpopf64;Logitech POP Suppression Filter;c:\windows\system32\DRIVERS\lvpopf64.sys [x]
R3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys [x]
R3 LVUVC64;QuickCam for Notebooks Deluxe(UVC);c:\windows\system32\DRIVERS\lvuvc64.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Service Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R3 WPRO_40_1340;WinPcap Packet Driver (WPRO_40_1340);c:\windows\system32\drivers\WPRO_40_1340.sys [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 LVPrcS64;Process Monitor;c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe [2009-10-07 191000]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atipmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 e1yexpress;Intel(R) Gigabit Network Connections Driver;c:\windows\system32\DRIVERS\e1y62x64.sys [x]
S3 LVPr2M64;Logitech LVPr2M64 Driver;c:\windows\system32\DRIVERS\LVPr2M64.sys [x]
.
.
Contenu du dossier 'Tâches planifiées'
.
2011-10-19 c:\windows\Tasks\GlaryInitialize.job
- c:\program files (x86)\Glary Utilities\initialize.exe [2011-09-20 13:07]
.
2011-10-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-03-14 02:04]
.
2011-10-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-03-14 02:04]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-01-20 9996320]
.
------- Examen supplémentaire -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://homepage.gateway.com/rdr.aspx?b=ACGW&l=0c0c&m=dx4822&r=173601106106p0385v195k4861r290
mStart Page = hxxp://homepage.gateway.com/rdr.aspx?b=ACGW&l=0c0c&m=dx4822&r=173601106106p0385v195k4861r290
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xporter vers Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Urgence\AppData\Roaming\Mozilla\Firefox\Profiles\cx02veao.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.spirit-of-metal.com/
.
- - - - ORPHELINS SUPPRIMES - - - -
.
Toolbar-Locked - (no file)
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Autres processus actifs ------------------------
.
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Bonjour\mDNSResponder.exe
c:\windows\SysWOW64\PnkBstrA.exe
c:\program files (x86)\Common Files\LogiShrd\LVMVFM\LVPrS64H.exe
c:\program files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
.
**************************************************************************
.
Heure de fin: 2011-10-19 19:12:50 - La machine a redémarré
ComboFix-quarantined-files.txt 2011-10-19 23:12
ComboFix2.txt 2011-10-19 22:35
.
Avant-CF: 640,117,014,528 octets libres
Après-CF: 640,053,329,920 octets libres
.
- - End Of File - - 93FD3EC52CD1E1966F0327A9BB57A8B5

hello

je peux l'avoir entier ?

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Service Google Update (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-03-14 136176]
R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x]
R3 gupdatem;Service Google Update (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-03-14 136176]
R3 lvpopf64;Logitech POP Suppression Filter;c:\windows\system32\DRIVERS\lvpopf64.sys [x]
R3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys [x]
R3 LVUVC64;QuickCam for Notebooks Deluxe(UVC);c:\windows\system32\DRIVERS\lvuvc64.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Service Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R3 WPRO_40_1340;WinPcap Packet Driver (WPRO_40_1340);c:\windows\system32\drivers\WPRO_40_1340.sys [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 LVPrcS64;Process Monitor;c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe [2009-10-07 191000]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atipmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 e1yexpress;Intel(R) Gigabit Network Connections Driver;c:\windows\system32\DRIVERS\e1y62x64.sys [x]
S3 LVPr2M64;Logitech LVPr2M64 Driver;c:\windows\system32\DRIVERS\LVPr2M64.sys [x]
.
.
Contenu du dossier 'Tâches planifiées'
.
2011-10-19 c:\windows\Tasks\GlaryInitialize.job
- c:\program files (x86)\Glary Utilities\initialize.exe [2011-09-20 13:07]
.
2011-10-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-03-14 02:04]
.
2011-10-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-03-14 02:04]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-01-20 9996320]
.
------- Examen supplémentaire -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://homepage.gateway.com/rdr.aspx?b=ACGW&l=0c0c&m=dx4822&r=173601106106p0385v195k4861r290
mStart Page = hxxp://homepage.gateway.com/rdr.aspx?b=ACGW&l=0c0c&m=dx4822&r=173601106106p0385v195k4861r290
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xporter vers Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Urgence\AppData\Roaming\Mozilla\Firefox\Profiles\cx02veao.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.spirit-of-metal.com/
.
- - - - ORPHELINS SUPPRIMES - - - -
.
Toolbar-Locked - (no file)
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Autres processus actifs ------------------------
.
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Bonjour\mDNSResponder.exe
c:\windows\SysWOW64\PnkBstrA.exe
c:\program files (x86)\Common Files\LogiShrd\LVMVFM\LVPrS64H.exe
c:\program files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
.
**************************************************************************
.
Heure de fin: 2011-10-19 19:12:50 - La machine a redémarré
ComboFix-quarantined-files.txt 2011-10-19 23:12
ComboFix2.txt 2011-10-19 22:35
.
Avant-CF: 640,117,014,528 octets libres
Après-CF: 640,053,329,920 octets libres
.
- - End Of File - - 93FD3EC52CD1E1966F0327A9BB57A8B5

passe outre le message de combofix

ComboFix me dit que mon AntiVri est encore présent, pourtant je l'ai carrément désinstallé...

salut


/!\ ATTENTION SUIVRE A LA LETTRE CES INDICATIONS/!\

__________________________________________________________
>Ce logiciel n'est à utiliser que prescrit par un helper qualifié et formé à l'outil.<
>>>>>>>Ne pas utiliser en dehors de ce cas de figure : dangereux!<<<<<<<<
=====================================================

▶ Surtout , pense à l'enregistrement à renommer Combofix en "ton prenom.exe" avant qu'il soit enregistré sur ton disque dur

Telecharge ici : Combofix

Avant d'utiliser ComboFix :

Si tu utilises AVG, IL FAUT IMPERATIVEMENT LE DESINSTALLER avant d'utiliser Combofix car il peut causer des dégâts en interaction avec l'outil pouvant mener à la réinstallation totale du système.
La simple désactivation du résident n'est pas suffisante.
Télécharge le désinstalleur d'AVG sur ce lien : https://www.avg.com/fr-fr/avg-remover
Choisis la version adéquate (32 ou 64 bits)/!\

Les logiciels d'émulation de CD comme Daemon Tools peuvent gêner les outils de désinfection. Utilise Defogger pour les désactiver temporairement :

▶ Télécharge Defogger (de jpshortstuff) sur ton Bureau

▶ Lance le

Une fenêtre apparait : clique sur "Disable"

▶ Fais redémarrer l'ordinateur si l'outil te le demande

Note : Quand nous aurons terminé la désinfection, tu pourras réactiver ces logiciels en relançant Defogger et en cliquant sur "Re-enable"

_________________________________________________________
>> referme les fenêtres de tous les programmes en cours.
>> Désactive provisoirement et seulement le temps de l'utilisation de ComboFix,
>>la protection en temps réel de ton Antivirus et de tes Antispywares,
>>qui peuvent gêner fortement la procédure de recherche et de nettoyage de l'outil.
°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°

si tu as XP => double clique
si tu as Vista ou windows 7 => clic droit "executer en tant que...."

sur combofix renommé

¤¤¤¤¤¤¤¤¤¤ LAISSE-LE INSTALLER LA CONSOLE DE RECUPERATION S'IL TE LE DEMANDE ¤¤¤¤¤¤¤¤¤¤

▶ !!!!!NE TOUCHE A RIEN PENDANT LE TRAVAIL DE COMBOFIX (SOURIS/CLAVIER.....)!!!!!

▶ n'oublie pas de reactiver la garde de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet.

▶▶ Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.