PC trés infecté

Bonjour,
J'ai le même problème que Balboa 99 semble-t-il, mon PC est super lent au démarrage en exécution (environ 20min pour pouvoir commencer quelque chose)... donc dès que le scan complet avec Malwarebytes sera terminé (s'il y arrive un jour car il semble qu'il faille au moins 7-8h) et que j'aurais fais le scan avec Usbfix, pourrais-je poster tout ça ici et demander votre aide ? :D

Le voici

# DelFix v10.3 - Rapport créé le 20/06/2013 à 21:08:06
# Mis à jour le 08/06/2013 par Xplode
# Nom d'utilisateur : Henry - ACER-564DF136B7
# Système d'exploitation : Microsoft Windows XP Service Pack 3 (32 bits)

~ Suppression des outils de désinfection ...

Supprimé : C:\USBFix
Supprimé : C:\_OTL
Supprimé : C:\ZHP
Supprimé : C:\Program Files\ZHPDiag
Supprimé : C:\AdwCleaner[R1].txt
Supprimé : C:\PhysicalDisk0_MBR.bin
Supprimé : C:\rkill.log
Supprimé : C:\UsbFix [Clean 1] ACER-564DF136B7.txt
Supprimé : C:\UsbFix [Clean 3] ACER-564DF136B7.txt
Supprimé : C:\UsbFix [Listing 1 ] ACER-564DF136B7.txt
Supprimé : C:\Documents and Settings\Henry\Bureau\adwcleaner.exe
Supprimé : C:\Documents and Settings\Henry\Bureau\Extras.Txt
Supprimé : C:\Documents and Settings\Henry\Bureau\OTL.Txt
Supprimé : C:\Documents and Settings\Henry\Bureau\OTL.exe
Supprimé : C:\Documents and Settings\Henry\Bureau\TFC.exe
Supprimé : C:\Documents and Settings\Henry\Bureau\UsbFix [Clean 1] ACER-564DF136B7.txt
Supprimé : C:\Documents and Settings\Henry\Bureau\UsbFix [Clean 3] ACER-564DF136B7.txt
Supprimé : C:\Documents and Settings\Henry\Bureau\UsbFix.exe
Supprimé : C:\Documents and Settings\Henry\Bureau\ZHPDiag.txt
Supprimé : C:\Documents and Settings\Henry\Bureau\ZHPDiag2.exe
Supprimé : C:\Documents and Settings\All Users\Bureau\MBRCheck.lnk
Supprimé : C:\Documents and Settings\All Users\Bureau\ZHPDiag.lnk
Supprimé : C:\Documents and Settings\All Users\Bureau\ZHPFix.lnk
Supprimée : HKCU\Software\USBFix
Supprimée : HKLM\SOFTWARE\OldTimer Tools
Supprimée : HKLM\SOFTWARE\AdwCleaner
Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\USBFix
Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZHPDiag_is1

########## - EOF - ##########

le rapport de delfix ?

Salut g3n-h@ckm@n

Un grand merci pour ton aide

Bonne soirée

non c'est pas utile tu peux faire le menage

https://forums-fec.be/entraide/viewtopic.php?f=11&t=229

¤¤¤¤¤¤¤¤¤¤_Pre_Scan_Concept_¤¤¤¤¤¤¤¤¤¤
Windows 8 => meme flop que Vista X 10

Le PC fonctionne bien, plus de problème

L'anti-virus se charge

Je pensais lancer un scan complet de Malwarebytes

Qu'en penses-tu ? Faut-il un nouveau rapport de ZHPdiag ?

d'ac cite les soucis qu il te reste que je situe un peu

Non rien d'autre

et tu n'as rien d'autre ? disque dur externe etc ????? à ce que j'ai cru comprendre si....

Le clé USB qui se trouvait peut-être en H ne sera plus utilisée sur ce PC, donc pas de problème

il semblerait que tu ne te décides pas à brancher tes supports externes....

Voici le rapport

############################## | UsbFix V 7.127 | [Suppression]

Utilisateur: Henry (Administrateur) # ACER-564DF136B7
Mis à jour le 05/06/2013 par El Desaparecido
Lancé à 21:30:54 | 19/06/2013

Site Web: https://www.sosvirus.net/
Upload Malware: http://upload.sosvirus.org/
Contact: contact@sosvirus.org

PC: Acer (Extensa 7620 ) (X86-based PC)
CPU: Intel(R) Core(TM)2 Duo CPU T5750 @ 2.00GHz (1995)
RAM -> [Total : 2046 | Free : 1284]
BIOS: Ver 1.00PARTTBL
BOOT: Normal boot

OS: Microsoft Windows XP Professionnel (5.1.2600 32-Bit) # Service Pack 3
WB: Windows Internet Explorer 8.0.6001.18702

SC: Security Center Service [Enabled]
WU: Windows Update Service [Enabled]
FW: Windows FireWall Service [Enabled]

C:\ (%systemdrive%) -> Disque fixe # 113 Go (85 Go libre(s) - 75%) [ACER] # NTFS
D:\ -> Disque fixe # 114 Go (113 Go libre(s) - 99%) [ACERDATA] # FAT32
E:\ -> CD-ROM

################## | El Desaparecido Section |

HKLM\SOFTWARE | Run : [preload] - C:\Windows\RUNXMLPL.exe
HKLM\SOFTWARE | Run : [IAAnotif] - "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
HKLM\SOFTWARE | Run : [SynTPStart] - C:\Program Files\Synaptics\SynTP\SynTPStart.exe
HKLM\SOFTWARE | Run : [RTHDCPL] - RTHDCPL.EXE
HKLM\SOFTWARE | Run : [AzMixerSel] - C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
HKLM\SOFTWARE | Run : [StartCCC] - "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
HKLM\SOFTWARE | Run : [Acer ePresentation HPD] - C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
HKLM\SOFTWARE | Run : [ePower_DMC] - C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
HKLM\SOFTWARE | Run : [Boot] - C:\Acer\Empowering Technology\ePower\Boot.exe
HKLM\SOFTWARE | Run : [eRecoveryService] - C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
HKLM\SOFTWARE | Run : [LManager] - C:\PROGRA~1\LAUNCH~1\LManager.exe
HKLM\SOFTWARE | Run : [Kernel and Hardware Abstraction Layer] - KHALMNPR.EXE
HKLM\SOFTWARE | Run : [HP Software Update] - C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
HKLM\SOFTWARE | Run : [APSDaemon] - "C:\Program Files\Fichiers communs\Apple\Apple Application Support\APSDaemon.exe"
HKLM\SOFTWARE | Run : [Adobe ARM] - "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
HKLM\SOFTWARE | Run : [avast] - "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
HKLM\SOFTWARE | RunOnce : [] -
HKU\S-1-5-19\SOFTWARE | Run : [CTFMON.EXE] - C:\WINDOWS\system32\CTFMON.EXE
HKU\S-1-5-20\SOFTWARE | Run : [CTFMON.EXE] - C:\WINDOWS\system32\CTFMON.EXE
HKU\S-1-5-21-3194007295-2266635485-1072483425-1008\SOFTWARE | Run : [ctfmon.exe] - C:\WINDOWS\system32\ctfmon.exe
HKU\S-1-5-21-3194007295-2266635485-1072483425-1008\SOFTWARE | Run : [MsnMsgr] - "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
HKU\S-1-5-21-3194007295-2266635485-1072483425-1008\SOFTWARE | Run : [swg] - "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
HKU\S-1-5-21-3194007295-2266635485-1072483425-1008\SOFTWARE | Run : [Skype] - "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
HKU\S-1-5-18\SOFTWARE | Run : [CTFMON.EXE] - C:\WINDOWS\system32\CTFMON.EXE

################## | Processus Stoppés |

Stoppé! C:\WINDOWS\system32\Ati2evxx.exe (1720)
Stoppé! C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe (1976)
Stoppé! C:\WINDOWS\system32\Ati2evxx.exe (376)
Stoppé! C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (1040)
Stoppé! C:\WINDOWS\Explorer.EXE (1084)
Stoppé! C:\Program Files\Alwil Software\Avast5\afwServ.exe (1260)
Stoppé! C:\WINDOWS\system32\spoolsv.exe (1992)
Stoppé! C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe (1116)
Stoppé! C:\Program Files\Microsoft\BingBar\7.1.391.0\BBSvc.exe (400)
Stoppé! C:\Program Files\Bonjour\mDNSResponder.exe (704)
Stoppé! C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (788)
Stoppé! C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe (2244)
Stoppé! C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe (2280)
Stoppé! C:\Program Files\Fichiers communs\Motive\McciCMService.exe (2392)
Stoppé! C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (2452)
Stoppé! C:\Program Files\CyberLink\Shared Files\RichVideo.exe (2564)
Stoppé! C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe (2612)
Stoppé! C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLIDSVC.EXE (2784)
Stoppé! C:\WINDOWS\system32\wuauclt.exe (760)
Stoppé! C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLIDSvcM.exe (740)
Stoppé! C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (1000)
Stoppé! C:\WINDOWS\RTHDCPL.EXE (1020)
Stoppé! C:\Acer\Empowering Technology\ePresentation\ePresentation.exe (1548)
Stoppé! C:\Acer\Empowering Technology\ePower\ePower_DMC.exe (1760)
Stoppé! C:\Acer\Empowering Technology\eRecovery\eRAgent.exe (2100)
Stoppé! C:\PROGRA~1\LAUNCH~1\LManager.exe (2316)
Stoppé! C:\Program Files\HP\HP Software Update\HPWuSchd2.exe (2468)
Stoppé! C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (2536)
Stoppé! C:\Program Files\Alwil Software\Avast5\avastUI.exe (2880)
Stoppé! C:\WINDOWS\system32\ctfmon.exe (3200)
Stoppé! C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe (3172)
Stoppé! C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (3308)
Stoppé! C:\Program Files\Skype\Phone\Skype.exe (3544)
Stoppé! C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe (2108)
Stoppé! C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (2224)
Stoppé! C:\Program Files\Logitech\SetPoint\SetPoint.exe (1016)
Stoppé! C:\Program Files\WinZip\WZQKPICK.EXE (3000)
Stoppé! C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (3096)
Stoppé! C:\Program Files\Fichiers communs\Logishrd\KHAL2\KHALMNPR.EXE (988)
Stoppé! C:\DOCUME~1\Henry\LOCALS~1\Temp\RtkBtMnt.exe (4056)
Stoppé! C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe (2716)
Stoppé! C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe (5116)
Stoppé! C:\WINDOWS\system32\wbem\wmiapsrv.exe (5200)
Stoppé! C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe (5444)

################## | Éléments infectieux |

Supprimé! C:\DOCUME~1\Henry\LOCALS~1\Temp\RtkBtMnt.exe

(!) Fichiers temporaires supprimés.

################## | Registre |

################## | Mountpoints2 |

################## | Listing |

[23/09/2008 - 15:42:56 | D ] C:\Acer
[18/06/2013 - 22:46:08 | N | 1152] C:\AdwCleaner[R1].txt
[18/06/2013 - 18:30:07 | RASHD ] C:\Autorun.inf
[22/03/2008 - 21:42:46 | N | 715550] C:\bknowsetup.log
[24/09/2008 - 06:29:20 | D ] C:\BOOK
[23/09/2008 - 22:37:46 | N | 212] C:\boot.ini
[05/08/2004 - 06:00:00 | N | 4952] C:\Bootfont.bin
[06/09/2004 - 16:40:26 | N | 512] C:\BOOTSECT.DOS
[19/06/2013 - 19:41:25 | D ] C:\Config.Msi
[24/09/2008 - 06:22:55 | D ] C:\DOCS
[23/09/2008 - 22:39:21 | D ] C:\Documents and Settings
[24/09/2008 - 06:23:00 | D ] C:\DOTNETFX
[23/09/2008 - 16:56:20 | D ] C:\ELEMENTS
[15/06/2013 - 03:22:58 | N | 4968] C:\ffastun.ffa
[15/06/2013 - 03:22:58 | N | 884736] C:\ffastun.ffl
[15/06/2013 - 03:22:58 | N | 90112] C:\ffastun.ffo
[15/06/2013 - 03:22:58 | N | 2977792] C:\ffastun0.ffx
[19/06/2013 - 21:25:34 | ASH | 2145832960] C:\hiberfil.sys
[24/09/2008 - 06:23:31 | D ] C:\I386
[06/09/2004 - 17:00:24 | N | 0] C:\IO.SYS
[06/09/2004 - 17:00:24 | N | 0] C:\MSDOS.SYS
[16/04/2011 - 19:06:46 | RHD ] C:\MSOCache
[05/08/2004 - 06:00:00 | N | 47564] C:\NTDETECT.COM
[23/09/2008 - 16:37:26 | N | 252240] C:\ntldr
[19/06/2013 - 21:25:32 | ASH | 2145386496] C:\pagefile.sys
[09/04/2008 - 22:09:28 | N | 6326] C:\Patch.rev
[26/04/2007 - 00:45:58 | N | 631] C:\PDVD.iss
[17/06/2013 - 21:35:22 | N | 512] C:\PhysicalDisk0_MBR.bin
[23/03/2008 - 09:05:28 | N | 73] C:\preload.aaa
[23/03/2008 - 09:05:28 | N | 73] C:\Preload.rev
[19/06/2013 - 19:22:22 | D ] C:\Program Files
[24/09/2008 - 08:24:38 | SHD ] C:\RECYCLER
[22/03/2008 - 21:42:04 | N | 595] C:\RHDSetup.log
[10/01/2011 - 09:59:59 | N | 368] C:\rkill.log
[22/03/2008 - 21:42:46 | N | 32] C:\setup.log
[24/09/2008 - 06:25:47 | D ] C:\SUPPORT
[24/09/2008 - 06:25:48 | D ] C:\sysinfo
[23/09/2008 - 22:37:49 | SHD ] C:\System Volume Information
[19/06/2013 - 21:36:42 | D ] C:\UsbFix
[18/06/2013 - 18:30:08 | N | 12505] C:\UsbFix [Clean 1] ACER-564DF136B7.txt
[19/06/2013 - 21:37:03 | A | 8512] C:\UsbFix [Clean 3] ACER-564DF136B7.txt
[19/06/2013 - 19:16:43 | N | 5893] C:\UsbFix [Listing 1 ] ACER-564DF136B7.txt
[24/09/2008 - 06:25:49 | D ] C:\VALUEADD
[19/06/2013 - 21:26:10 | D ] C:\WINDOWS
[23/09/2008 - 18:13:05 | D ] C:\winnt
[22/03/2008 - 21:17:44 | N | 4] C:\wps.dat
[17/06/2013 - 21:35:25 | D ] C:\ZHP
[19/06/2013 - 19:22:09 | D ] C:\_OTL
[15/06/2013 - 03:10:58 | N | 57344] D:\ffastun.ffl
[15/06/2013 - 03:10:58 | N | 139264] D:\ffastun0.ffx
[23/09/2008 - 22:40:00 | SHD ] D:\System Volume Information
[15/06/2013 - 03:10:58 | N | 61440] D:\ffastun.ffo
[15/06/2013 - 03:10:58 | N | 4379] D:\ffastun.ffa
[18/06/2013 - 18:30:08 | RASHD ] D:\Autorun.inf
[16/08/2009 - 03:04:00 | D ] D:\30b68b8111190fd97e
[24/09/2008 - 08:38:30 | D ] D:\Henry
[24/09/2008 - 09:34:50 | SHD ] D:\Recycled

################## | Vaccin |

C:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
D:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)

################## | E.O.F | https://www.sosvirus.net/ |

tu refais une suppression avec usbfix en branchant tous tes périphériques comme demandé ils sont infectés

Ok mais je n'ai rien branché

Est-ce qu'il y a encore quelque chose à nettoyer ?

re

on les branche et ils sont automatiquement détectés

Salut

Je n'ai pas ajouté de lecteur H ni branché de clés USB ou disque dur
Comment fait-on avec usbfix pour sélectionner des lecteurs ?

Voici le rapport

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
Process iexplore.exe killed successfully!
No active process named firefox.exe was found!
Process msnmsgr.exe killed successfully!
No active process named Teatimer.exe was found!
No active process named safari.exe was found!
No active process named opera.exe was found!
No active process named rundll32.exe was found!
========== OTL ==========
Registry key HKEY_USERS\S-1-5-21-3194007295-2266635485-1072483425-1008\Software\Microsoft\Internet Explorer\SearchScopes\{6B7E39E9-FEBB-40EB-904C-5CF4D6F32DC5}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6B7E39E9-FEBB-40EB-904C-5CF4D6F32DC5}\ not found.
File C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll not found.
File C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{0BF43445-2F28-4351-9252-17FE6E806AA0} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0BF43445-2F28-4351-9252-17FE6E806AA0}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
C:\WINDOWS\Downloaded Program Files\erma.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8f2588b3-fb66-11de-9506-001f3c2ee192}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8f2588b3-fb66-11de-9506-001f3c2ee192}\ not found.
File H:\rndj.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8f2588b3-fb66-11de-9506-001f3c2ee192}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8f2588b3-fb66-11de-9506-001f3c2ee192}\ not found.
File H:\rndj.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8f2588b3-fb66-11de-9506-001f3c2ee192}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8f2588b3-fb66-11de-9506-001f3c2ee192}\ not found.
File H:\rndj.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8f2588b3-fb66-11de-9506-001f3c2ee192}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8f2588b3-fb66-11de-9506-001f3c2ee192}\ not found.
File H:\rndj.exe not found.
D:\Henry\Mes documents\~WRL3817.tmp deleted successfully.
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Alcmtr deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\IMJPMIG8.1 deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\iTunesHelper deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\MSPY2002 deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\PHIME2002A deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\PHIME2002ASync deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\BrowserChoice\ deleted successfully.
========== FILES ==========
C:\Documents and Settings\All Users\Application Data\vot03.pad moved successfully.
File\Folder C:\Documents and Settings\All Users\Application Data\vot03.js not found.
C:\Documents and Settings\All Users\Application Data\dco81do.dat moved successfully.
C:\sqmdata00.sqm moved successfully.
C:\sqmdata01.sqm moved successfully.
C:\sqmdata02.sqm moved successfully.
C:\sqmdata03.sqm moved successfully.
C:\sqmdata04.sqm moved successfully.
C:\sqmdata05.sqm moved successfully.
C:\sqmdata06.sqm moved successfully.
C:\sqmdata07.sqm moved successfully.
C:\sqmdata08.sqm moved successfully.
C:\sqmdata09.sqm moved successfully.
C:\sqmdata10.sqm moved successfully.
C:\sqmdata11.sqm moved successfully.
C:\sqmdata12.sqm moved successfully.
C:\sqmdata13.sqm moved successfully.
C:\sqmdata14.sqm moved successfully.
C:\sqmdata15.sqm moved successfully.
C:\sqmdata16.sqm moved successfully.
C:\sqmdata17.sqm moved successfully.
C:\sqmdata18.sqm moved successfully.
C:\sqmdata19.sqm moved successfully.
C:\sqmnoopt00.sqm moved successfully.
C:\sqmnoopt01.sqm moved successfully.
C:\sqmnoopt02.sqm moved successfully.
C:\sqmnoopt03.sqm moved successfully.
C:\sqmnoopt04.sqm moved successfully.
C:\sqmnoopt05.sqm moved successfully.
C:\sqmnoopt06.sqm moved successfully.
C:\sqmnoopt07.sqm moved successfully.
C:\sqmnoopt08.sqm moved successfully.
C:\sqmnoopt09.sqm moved successfully.
C:\sqmnoopt10.sqm moved successfully.
C:\sqmnoopt11.sqm moved successfully.
C:\sqmnoopt12.sqm moved successfully.
C:\sqmnoopt13.sqm moved successfully.
C:\sqmnoopt14.sqm moved successfully.
C:\sqmnoopt15.sqm moved successfully.
C:\sqmnoopt16.sqm moved successfully.
C:\sqmnoopt17.sqm moved successfully.
C:\sqmnoopt18.sqm moved successfully.
C:\sqmnoopt19.sqm moved successfully.
C:\Program Files\Spybot - Search & Destroy\Help folder moved successfully.
C:\Program Files\Spybot - Search & Destroy folder moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrateur
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Henry
->Temp folder emptied: 180174304 bytes
->Temporary Internet Files folder emptied: 19051877 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Google Chrome cache emptied: 18175150 bytes
->Flash cache emptied: 2290 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 0 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 736421 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 107231845 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 270 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 147538081 bytes

Total Files Cleaned = 451.00 mb

OTL by OldTimer - Version 3.2.69.0 log created on 06192013_192209

Files\Folders moved on Reboot...
File move failed. C:\WINDOWS\temp\_avast_\Webshlock.txt scheduled to be moved on reboot.
C:\WINDOWS\temp\Perflib_Perfdata_f0c.dat moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

ok tu me feras le plaisir de mettre ton lecteur "H:\" que tu n'avais pas mis et de refaire une suppression avec usbfix

tu as mis ce lecteur depuis, et tu as reinfecté la machine avec

==

ATTENTION !!! : Script personnalisé pour cette machine uniquement , ne pas reproduire !!

si tu as XP => double clique
si tu as Vista ou windows 7 => clic droit "executer en tant que...."

sur OTL.exe pour le lancer.

▶Copie la liste qui se trouve en gras ci-dessous,

▶ colle-la dans la zone sous "Personnalisation" :


:processes
explorer.exe
iexplore.exe
firefox.exe
msnmsgr.exe
Teatimer.exe
safari.exe
opera.exe
rundll32.exe

:OTL
IE - HKU\S-1-5-21-3194007295-2266635485-1072483425-1008\..\SearchScopes\{6B7E39E9-FEBB-40EB-904C-5CF4D6F32DC5}: "URL" = http://www.search.ask.com/?l=dis{searchTerms}&locale=&apn_ptnrs=U3&apn_dtid=OSJ000
FF - user.js - File not found
CHR - plugin: Java Deployment Toolkit 6.0.260.3 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java Platform SE 6 U26 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
O3 - HKLM\..\Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O33 - MountPoints2\{8f2588b3-fb66-11de-9506-001f3c2ee192}\Shell\AUtoPlaY\CommAnd - "" = H:\rndj.exe
O33 - MountPoints2\{8f2588b3-fb66-11de-9506-001f3c2ee192}\Shell\AutoRun\command - "" = H:\rndj.exe
O33 - MountPoints2\{8f2588b3-fb66-11de-9506-001f3c2ee192}\Shell\ExPlore\COMmAnd - "" = H:\rndj.exe
O33 - MountPoints2\{8f2588b3-fb66-11de-9506-001f3c2ee192}\Shell\opEn\CoMmAND - "" = H:\rndj.exe
[1 D:\Henry\Mes documents\*.tmp files -> D:\Henry\Mes documents\*.tmp -> ]

:Reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Alcmtr"=-
""=-
"IMJPMIG8.1"=-
"iTunesHelper"=-
"MSPY2002"=-
"PHIME2002A"=-
"PHIME2002ASync"=-
[-HKEY_LOCAL_MACHINE\Software\BrowserChoice]

:Files
C:\Documents and Settings\All Users\Application Data\vot03.pad
C:\Documents and Settings\All Users\Application Data\vot03.js
C:\Documents and Settings\All Users\Application Data\dco81do.dat
C:\*.sqm
C:\Program Files\Spybot - Search & Destroy

:commands
[emptytemp]

▶ Clique sur "Correction" pour lancer la suppression.

▶ Poste le rapport qui logiquement s'ouvrira tout seul en fin de travail appres le redemarrage.

Ok bonne soirée et à demain

Voici les liens

https://www.cjoint.com/?CFswh7rURWY

https://www.cjoint.com/?CFswiIECFSD