Avast win32

non désactive le juste sans le desinstaller

Ils me demandent de désisnstaller avast c'est normal?

Rapport de la 1ère manip:

-----------\\ ToolBar S&D 1.2.6 XP/Vista

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : AMD Athlon(tm) 64 Processor 3200+ )
BIOS : Phoenix - Award BIOS v6.00PG
USER : HP_Propriétaire ( Administrator )
BOOT : Normal boot
Antivirus : avast! antivirus 4.8.1296 [VPS 081208-0] 4.8.1296 (Activated)
C:\ (Local Disk) - NTFS - Total:226 Go (Free:31 Go)
D:\ (Local Disk) - FAT32 - Total:5 Go (Free:5 Go)
E:\ (CD or DVD) - CDFS - Total:0 Go (Free:0 Go)
F:\ (USB)
G:\ (USB)
H:\ (USB)
I:\ (USB)
J:\ (USB) - FAT32 - Total:3839 Mo (Free:3 Go)

"C:\ToolBar SD" ( MAJ : 04-12-2008|20:40 )
Option : [2] ( 09/12/2008|10:20 )

-----------\\ SUPPRESSION

Supprime! - C:\Program Files\AskTBar\bar
Supprime! - C:\Program Files\AskTBar\PopSwatr
Supprime! - C:\DOCUME~1\HP_PRO~1\Cookies\hp_propriétaire@mywebsearch[1].txt
Supprime! - C:\DOCUME~1\HP_PRO~1\APPLIC~1\Search Settings\kb127
Supprime! - C:\Program Files\Search Settings\kb127
Supprime! - C:\Program Files\Search Settings\SearchSettings.exe
Supprime! - C:\Program Files\AskTBar
Supprime! - C:\DOCUME~1\HP_PRO~1\APPLIC~1\Search Settings
Supprime! - C:\Program Files\Search Settings

-----------\\ Recherche de Fichiers / Dossiers ...

-----------\\ Extensions

(HP_Propriétaire) - {0b38152b-1b20-484d-a11f-5e04a9b0661f} => winamptoolbar
(HP_Propriétaire) - {3112ca9c-de6d-4884-a869-9855de68056c} => google-toolbar
(HP_Propriétaire) - {635abd67-4fe9-1b23-4f01-e679fa7484c1} => ytoolbar

-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"
"Start Page"="https://www.google.fr/?gws_rd=ssl"
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"SearchMigratedDefaultURL"="https://www.google.com/webhp?gws_rd=ssl{searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
"Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Start Page"="https://www.msn.com/fr-fr/"

--------------------\\ Recherche d'autres infections

Aucune autre infection trouvée !

1 - "C:\ToolBar SD\TB_1.txt" - 09/12/2008|10:10 - Option : [1]
2 - "C:\ToolBar SD\TB_2.txt" - 09/12/2008|10:21 - Option : [2]

-----------\\ Fin du rapport a 10:21:20,43

Je vais maintenant lancer scan en ligne, je t'envoi le rapport dès que c'est terminé

Relance Toolbar-S&D en double-cliquant sur le raccourci. Tape sur "2" puis valide en appuyant sur "Entrée".
! Ne ferme pas la fenêtre lors de la suppression !
Un rapport sera généré, poste son contenu ici.

NOTE : Si ton Bureau ne réapparait pas, appuie simultanément sur Ctrl+Alt+Suppr pour ouvrir le Gestionnaire des tâches.
Rends-toi sur l'onglet "Processus". Clique en haut à gauche sur Fichier et choisis "Exécuter..."
Tape explorer puis valide.

_______________________

colle le rapport d'un scan en ligne
avec un des suivants:

bitdefender en ligne :
http://www.bitdefender.fr/scan_fr/scan8/ie.html

Panda en ligne :
http://pandasoftware.fr

Kaspersky en ligne
https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr

secuser en ligne :
http://www.secuser.com/outils/antivirus.htm
http://www.secuser.com/outils/antivirus_installation.htm

scan en ligne firefox

https://www.trendmicro.com/fr_fr/business.html

Voici le rapport:

-----------\\ ToolBar S&D 1.2.6 XP/Vista

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : AMD Athlon(tm) 64 Processor 3200+ )
BIOS : Phoenix - Award BIOS v6.00PG
USER : HP_Propriétaire ( Administrator )
BOOT : Normal boot
Antivirus : avast! antivirus 4.8.1296 [VPS 081208-0] 4.8.1296 (Activated)
C:\ (Local Disk) - NTFS - Total:226 Go (Free:31 Go)
D:\ (Local Disk) - FAT32 - Total:5 Go (Free:5 Go)
E:\ (CD or DVD) - CDFS - Total:0 Go (Free:0 Go)
F:\ (USB)
G:\ (USB)
H:\ (USB)
I:\ (USB)
J:\ (USB) - FAT32 - Total:3839 Mo (Free:3 Go)

"C:\ToolBar SD" ( MAJ : 04-12-2008|20:40 )
Option : [1] ( 09/12/2008|10:06 )

-----------\\ Recherche de Fichiers / Dossiers ...

C:\Program Files\AskTBar
C:\Program Files\AskTBar\bar
C:\Program Files\AskTBar\PopSwatr
C:\Program Files\AskTBar\bar\History
C:\Program Files\AskTBar\bar\Settings
C:\Program Files\AskTBar\bar\History\search2
C:\Program Files\AskTBar\PopSwatr\History
C:\Program Files\AskTBar\PopSwatr\History\allowed
C:\Program Files\AskTBar\PopSwatr\History\notallow
C:\DOCUME~1\HP_PRO~1\Cookies\hp_propriétaire@mywebsearch[1].txt
C:\DOCUME~1\HP_PRO~1\APPLIC~1\Search Settings
C:\DOCUME~1\HP_PRO~1\APPLIC~1\Search Settings\kb127
C:\DOCUME~1\HP_PRO~1\APPLIC~1\Search Settings\kb127\res
C:\DOCUME~1\HP_PRO~1\APPLIC~1\Search Settings\kb127\temp
C:\DOCUME~1\HP_PRO~1\APPLIC~1\Search Settings\kb127\temp\ws-14219.log
C:\DOCUME~1\HP_PRO~1\APPLIC~1\Search Settings\kb127\temp\ws-14220.log
C:\DOCUME~1\HP_PRO~1\APPLIC~1\Search Settings\kb127\temp\ws-14221.log
C:\DOCUME~1\HP_PRO~1\APPLIC~1\Search Settings\kb127\temp\ws-14222.log
C:\Program Files\Search Settings
C:\Program Files\Search Settings\kb127
C:\Program Files\Search Settings\SearchSettings.exe
C:\Program Files\Search Settings\kb127\res
C:\Program Files\Search Settings\kb127\SearchSettings.dll
C:\Program Files\Search Settings\kb127\SearchSettingsRes409.dll
C:\Program Files\Search Settings\kb127\temp

-----------\\ Extensions

(HP_Propriétaire) - {0b38152b-1b20-484d-a11f-5e04a9b0661f} => winamptoolbar
(HP_Propriétaire) - {3112ca9c-de6d-4884-a869-9855de68056c} => google-toolbar
(HP_Propriétaire) - {635abd67-4fe9-1b23-4f01-e679fa7484c1} => ytoolbar

-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"
"Start Page"="https://www.google.fr/?gws_rd=ssl"
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"SearchMigratedDefaultURL"="https://www.google.com/webhp?gws_rd=ssl{searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
"Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Start Page"="https://www.msn.com/fr-fr"

--------------------\\ Recherche d'autres infections

Aucune autre infection trouvée !

1 - "C:\ToolBar SD\TB_1.txt" - 09/12/2008|10:10 - Option : [1]

-----------\\ Fin du rapport a 10:10:12,48

Alors?

vire ce qui est en quarantaine dans avast

puis

Télécharge Toolbar-S&D (Team IDN) sur ton Bureau.
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2

* Lance l'installation du programme en exécutant le fichier téléchargé.
* Double-clique maintenant sur le raccourci de Toolbar-S&D.
* Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.
* Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche.
* Poste le rapport généré. (C:\TB.txt)

Alors, j'ai installé Avast qui a l'air de fonctionner et qui a effectivement trouvé le baggle suivant:
WIN32: Beagle-AAW (Trj). Les fichiers infectés ont été mis en quarantaine.

J'ai essayé de faire les scan que tu m'as indiqués:

-Kaspersky me dit que je dois désinstaller certains logiciels, mais ne me précise pas lesquels pour pouvoir terminer l'installation

-Panda me dit désolé la mise à jour est incomplète en raison d'une erreur veuillez recommencer mais j'ai beau recommencer, ce message revient sans arrêt...

Que pasa?

colle le rapport d'un scan en ligne
avec un des suivants:

Kaspersky en ligne
https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr

Panda en ligne :
http://pandasoftware.fr

Faute de pouvoir supprimer juste les 3 éléments j'ai tout coché puis supprimé, voici le rapport:

--------- Logfile of AD-Remover 1.0.6.5 by C_XX ---------

*** Limited to ***

Boonty/BoontyGames
Eorezo
Everest Poker
Funwebproduct/MyWay/MyWebsearch
Messenger Skinner
Sweetim

******************

# START at: 20:12:24 | Lun 08/12/2008 ON Microsoft® Windows XP ™ v5.1.2600
# BOOT MODE: Normal

# OPTION: Scan
# EXECUTED FROM: C:\Program Files\Ad-remover\AD-Remover.bat

# PC: NOM-EB85C523610 | USER: HP_Propriétaire ( Current user is an administrator )

# DRIVE(S): C:\
# Systemdrive: C:\ (NTFS)
# Internet Explorer v7.0.5730.13

--------- [ RUNNING PROCESSES: 41 ] ---------

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\HP\KBD\KBD.EXE
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
C:\WINDOWS\VM_STI.EXE
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Search Settings\SearchSettings.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Philips\SPC 200NC PC Camera\TrayMin200.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\All Users\Application Data\iWin Games\DesktopAlerts\DesktopAlerts.exe
C:\Program Files\MioNet\MioNetManager.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\MioNet\jvm\bin\MioNet.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\ntvdm.exe

-----------------------------------

(!) ---- IE start pages reset

+-----------------------| Boonty/Boonty Games Elements Deleted..

"HKEY_CURRENT_USER\SOFTWARE\Boonty"
"HKEY_LOCAL_MACHINE\Software\Boonty"
.
[15/10/2008 10:15|d--------] C:\Program Files\Boonty
[15/10/2008 10:05|d--------] C:\Program Files\BoontyGames
[15/10/2008 10:15|d--------] C:\Program Files\Fichiers communs\BOONTY Shared

+-----------------------| Eorezo Elements Deleted..

.
[07/02/2007 16:23|d--------] C:\Program Files\EoRezo

+-----------------------| Everest Poker Elements Deleted..

.

+-----------------------| FunWebProducts/MyWay/MyWebSearch/MyGlobalSearch Elements Deleted..

"HKEY_CLASSES_ROOT\Interface\{e342af55-b78a-4cd0-a2bb-da7f52d9d25e}"
"HKEY_CLASSES_ROOT\Interface\{2e3537fc-cf2f-4f56-af54-5a6a3dd375cc}"
"HKEY_CLASSES_ROOT\Interface\{de38c398-b328-4f4c-a3ad-1b5e4ed93477}"
"HKEY_CLASSES_ROOT\Interface\{3E53E2CB-86DB-4A4A-8BD9-FFEB7A64DF82}"
"HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff}"
"HKEY_CLASSES_ROOT\Interface\{120927bf-1700-43bc-810f-fab92549b390}"
"HKEY_CLASSES_ROOT\Interface\{e342af55-b78a-4cd0-a2bb-da7f52d9d25f}"
"HKEY_CLASSES_ROOT\Interface\{17DE5E5E-BFE3-4E83-8E1F-8755795359EC}"
"HKEY_CLASSES_ROOT\Interface\{1093995a-ba37-41d2-836e-091067c4ad17}"
"HKEY_CLASSES_ROOT\Interface\{1f52a5fa-a705-4415-b975-88503b291728}"
"HKEY_CLASSES_ROOT\Interface\{991AAC62-B100-47CE-8B75-253965244f69}"
"HKEY_CLASSES_ROOT\Interface\{90449521-d834-4703-bb4e-d3aa44042ff8}"
"HKEY_CLASSES_ROOT\Interface\{6e74766c-4d93-4cc0-96d1-47b8e07ff9ca}"
"HKEY_CLASSES_ROOT\Interface\{247a115f-06c2-4fb3-967d-2d62d3cf4f0a}"
"HKEY_CLASSES_ROOT\Interface\{a626cdbd-3d13-4f78-b819-440a28d7e8fc}"
"HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc}"
"HKEY_CLASSES_ROOT\Interface\{d6ff3684-ad3b-48eb-bbb4-b9e6c5a355c1}"
"HKEY_CLASSES_ROOT\Interface\{eb9e5c1c-b1f9-4c2b-be8a-27d6446fdaf8}"
"HKEY_CLASSES_ROOT\Interface\{bbabdc90-f3d5-4801-863a-ee6ae529862d}"
"HKEY_CLASSES_ROOT\Interface\{3e1656ed-f60e-4597-b6aa-b6a58e171495}"
"HKEY_CLASSES_ROOT\Interface\{cf54be1c-9359-4395-8533-1657cf209cfe}"
"HKEY_CLASSES_ROOT\FunWebProducts.DataControl.1"
"HKEY_CLASSES_ROOT\FunWebProducts.HistoryKillerScheduler"
"HKEY_CLASSES_ROOT\FunWebProducts.HistoryKillerScheduler.1"
"HKEY_CLASSES_ROOT\FunWebProducts.HistorySwatterControlBar"
"HKEY_CLASSES_ROOT\FunWebProducts.HistorySwatterControlBar.1"
"HKEY_CLASSES_ROOT\FunWebProducts.HTMLMenu"
"HKEY_CLASSES_ROOT\FunWebProducts.HTMLMenu.1"
"HKEY_CLASSES_ROOT\FunWebProducts.HTMLMenu.2"
"HKEY_CLASSES_ROOT\FunWebProducts.IECookiesManager"
"HKEY_CLASSES_ROOT\FunWebProducts.IECookiesManager.1"
"HKEY_CLASSES_ROOT\FunWebProducts.KillerObjManager"
"HKEY_CLASSES_ROOT\FunWebProducts.KillerObjManager.1"
"HKEY_CLASSES_ROOT\FunWebProducts.PopSwatterBarButton"
"HKEY_CLASSES_ROOT\FunWebProducts.PopSwatterBarButton.1"
"HKEY_CLASSES_ROOT\FunWebProducts.PopSwatterSettingsControl"
"HKEY_CLASSES_ROOT\FunWebProducts.PopSwatterSettingsControl.1"
"HKEY_CLASSES_ROOT\screensavercontrol.screensaverinstaller"
"HKEY_CLASSES_ROOT\screensavercontrol.screensaverinstaller.1"
"HKEY_CLASSES_ROOT\MyWebSearch.ChatSessionPlugin"
"HKEY_CLASSES_ROOT\MyWebSearch.ChatSessionPlugin.1"
"HKEY_CLASSES_ROOT\MyWebSearch.HTMLPanel"
"HKEY_CLASSES_ROOT\MyWebSearch.HTMLPanel.1"
"HKEY_CLASSES_ROOT\MyWebSearch.OutlookAddin"
"HKEY_CLASSES_ROOT\MyWebSearch.OutlookAddin.1"
"HKEY_CLASSES_ROOT\MyWebSearch.PseudoTransparentPlugin"
"HKEY_CLASSES_ROOT\MyWebSearch.PseudoTransparentPlugin.1"
"HKEY_CLASSES_ROOT\MyWebSearchToolBar.SettingsPlugin"
"HKEY_CLASSES_ROOT\MyWebSearchToolBar.SettingsPlugin.1"
"HKEY_CLASSES_ROOT\MyWebSearchToolBar.ToolbarPlugin"
"HKEY_CLASSES_ROOT\MyWebSearchToolBar.ToolbarPlugin.1"
"HKEY_CURRENT_USER\SOFTWARE\Fun Web Products"
"HKEY_CURRENT_USER\SOFTWARE\MyWebSearch"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E79DFBCA-5697-4fbd-94E5-5B2A9C7C1612}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{07B18EAA-A523-4961-B6BB-170DE4475CCA}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{07B18EAC-A523-4961-B6BB-170DE4475CCA}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3E720451-B472-4954-B7AA-33069EB53906}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3E720453-B472-4954-B7AA-33069EB53906}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72EE7F04-15BD-4845-A005-D6711144D86A}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7473D291-B7BB-4F24-AE82-7E2CE94BB6A9}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7473D293-B7BB-4F24-AE82-7E2CE94BB6A9}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7473D295-B7BB-4F24-AE82-7E2CE94BB6A9}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7473D297-B7BB-4F24-AE82-7E2CE94BB6A9}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E79DFBC9-5697-4FBD-94E5-5B2A9C7C1612}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E79DFBCB-5697-4FBD-94E5-5B2A9C7C1612}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F87D7FB5-9DC5-4C8C-B998-D8DFE02E2978}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{63D0ED2B-B45B-4458-8B3B-60C69BBBD83C}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{63D0ED2D-B45B-4458-8B3B-60C69BBBD83C}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{07B18EA0-A523-4961-B6BB-170DE4475CCA}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{0D26BC71-A633-4E71-AD31-EADC3A1B6A3A}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{29D67D3C-509A-4544-903F-C8C1B8236554}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{3E720450-B472-4954-B7AA-33069EB53906}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{7473D290-B7BB-4F24-AE82-7E2CE94BB6A9}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{8CA01F0E-987C-49C3-B852-2F1AC4A7094C}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{8E6F1830-9607-4440-8530-13BE7C4B1D14}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{C8CECDE3-1AE1-4C4A-AD82-6D5B00212144}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D518921A-4A03-425E-9873-B9A71756821E}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E47CAEE0-DEEA-464A-9326-3F2801535A4D}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E79DFBC0-5697-4FBD-94E5-5B2A9C7C1612}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F42228FB-E84E-479E-B922-FBBD096E792C}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Fun Web Products"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyWebSearch bar Uninstall"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media\WMSDK\Sources" /v "f3PopularScreensavers"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59C7FC09-1C83-4648-B3E6-003D2BBC7481}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170B96C-28D4-4626-8358-27E6CAEEF907}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D1A71FA0-FF48-48dd-9B6D-7A13A3E42127}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DDB1968E-EAD6-40fd-8DAE-FF14757F60C7}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F138D901-86F0-4383-99B6-9CDD406036DA}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68af847f-6e91-45dd-9b68-d6a12c30e5d7}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{e79dfbca-5697-4fbd-94e5-5b2a9c7c1612}"
.
[01/12/2008 21:51|--a------] C:\Program Files\Mozilla Firefox\Plugins\NPMyWebS.dll
[01/12/2008 21:51|--a------] C:\Program Files\Windows live\Messenger\riched20.dll
[01/12/2008 21:51|--a------] C:\Program Files\Windows live\Messenger\msimg32.dll
[01/12/2008 21:51|--a------] C:\Program Files\Internet explorer\msimg32.dll

+-----------------------| Messenger Skinner Elements Deleted..

.

+-----------------------| Sweetim Elements Deleted..

.

(!) ---- Temp files deleted.
(!) ---- Recycle bin emptied in all drives.

+---------------------------------------------------------------------------+
+------------------------------- ADDED SCAN ..
+---------------------------------------------------------------------------+

+---------- Scanning prefs.js ... ( # Mozilla User Preferences )

...\axm71qzz.default\prefs.js :

~~~~ Mozilla FireFox version 3.0.4 ~~~~

Start Page : "https://fr.yahoo.com/"

+----------+

+--[HKEY_CURRENT_USER\..\Run]

ctfmon.exe REG_SZ C:\WINDOWS\system32\ctfmon.exe

+--[HKEY_LOCAL_MACHINE\..\Run]

hpsysdrv REG_SZ c:\windows\system\hpsysdrv.exe
AlcxMonitor REG_SZ ALCXMNTR.EXE
HPHUPD08 REG_SZ c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
KBD REG_SZ C:\HP\KBD\KBD.EXE
Recguard REG_SZ C:\WINDOWS\SMINST\RECGUARD.EXE
PS2 REG_SZ C:\WINDOWS\system32\ps2.exe
HP Software Update REG_EXPAND_SZ C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
BigDogPath REG_SZ C:\WINDOWS\VM_STI.EXE Philips SPC 200NC PC Camera
TkBellExe REG_SZ "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
SearchSettings REG_SZ C:\Program Files\Search Settings\SearchSettings.exe
SunJavaUpdateSched REG_SZ "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
Adobe Reader Speed Launcher REG_SZ "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
NvCplDaemon REG_SZ RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
nwiz REG_SZ nwiz.exe /installquiet /keeploaded /nodetect
avast! REG_SZ C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

+--[HKEY_USERS\.DEFAULT\..\Run]

+--[HKEY_CURRENT_USER\..\Internet Explorer\MAIN]

Start Page : hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

+--[HKEY_LOCAL_MACHINE\..\Internet Explorer\MAIN]

Start Page : hxxp://fr.msn.com/

+---------------------------------------------------------------------------+

- "C:\AD-report-08.12.2008.log" (12368 octets)

[ END at: 20:15:57 | 08/12/2008 ] - [ Time elapsed: 3 minutes, 32 seconds ]

+---------------------------------------------------------------------------+
+------------------------------- [ E.O.F - 238 lines ]
+---------------------------------------------------------------------------+

Je désisnstalle maintenant avast et te dirai si ca marche après redémarrage

il faut nettoyer:

relance ad remover choisi l'option B et tape le chiffre correspondant a ces 3 elements:

Boonty
EoRezo
FunWebProducts/MyWay/MyWebSearch/

puis supprime avec S

et colle le rapport

_______________

colle le rapport d'un scan en ligne
avec un des suivants:

Kaspersky en ligne
https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr

Panda en ligne :
http://pandasoftware.fr

Done:

--------- Logfile of AD-Remover 1.0.6.5 by C_XX ---------

# START at: 18:12:27 | Lun 08/12/2008 ON Microsoft® Windows XP ™ v5.1.2600
# BOOT MODE: Normal

# OPTION: Scan
# EXECUTED FROM: C:\Program Files\Ad-remover\AD-Remover.bat

# PC: NOM-EB85C523610 | USER: HP_Propriétaire ( Current user is an administrator )

# DRIVE(S): C:\
# Systemdrive: C:\ (NTFS)
# Internet Explorer v7.0.5730.13

--------- [ RUNNING PROCESSES: 39 ] ---------

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\HP\KBD\KBD.EXE
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
C:\WINDOWS\VM_STI.EXE
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Search Settings\SearchSettings.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Philips\SPC 200NC PC Camera\TrayMin200.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\All Users\Application Data\iWin Games\DesktopAlerts\DesktopAlerts.exe
C:\Program Files\MioNet\MioNetManager.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\MioNet\jvm\bin\MioNet.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ntvdm.exe

-----------------------------------

+-----------------------| Boonty/Boonty Games Elements found..

"HKEY_CURRENT_USER\SOFTWARE\Boonty"
"HKEY_LOCAL_MACHINE\Software\Boonty"
.
[15/10/2008 10:15|d--------] C:\Program Files\Boonty
[15/10/2008 10:05|d--------] C:\Program Files\BoontyGames
[15/10/2008 10:15|d--------] C:\Program Files\Fichiers communs\BOONTY Shared

+-----------------------| Eorezo Elements found..

.
[07/02/2007 16:23|d--------] C:\Program Files\EoRezo

+-----------------------| Everest Poker Elements found..

.

+-----------------------| FunWebProducts/MyWay/MyWebSearch/MyGlobalSearch Elements found..

"HKEY_CLASSES_ROOT\Interface\{e342af55-b78a-4cd0-a2bb-da7f52d9d25e}"
"HKEY_CLASSES_ROOT\Interface\{2e3537fc-cf2f-4f56-af54-5a6a3dd375cc}"
"HKEY_CLASSES_ROOT\Interface\{de38c398-b328-4f4c-a3ad-1b5e4ed93477}"
"HKEY_CLASSES_ROOT\Interface\{3E53E2CB-86DB-4A4A-8BD9-FFEB7A64DF82}"
"HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff}"
"HKEY_CLASSES_ROOT\Interface\{120927bf-1700-43bc-810f-fab92549b390}"
"HKEY_CLASSES_ROOT\Interface\{e342af55-b78a-4cd0-a2bb-da7f52d9d25f}"
"HKEY_CLASSES_ROOT\Interface\{17DE5E5E-BFE3-4E83-8E1F-8755795359EC}"
"HKEY_CLASSES_ROOT\Interface\{1093995a-ba37-41d2-836e-091067c4ad17}"
"HKEY_CLASSES_ROOT\Interface\{1f52a5fa-a705-4415-b975-88503b291728}"
"HKEY_CLASSES_ROOT\Interface\{991AAC62-B100-47CE-8B75-253965244f69}"
"HKEY_CLASSES_ROOT\Interface\{90449521-d834-4703-bb4e-d3aa44042ff8}"
"HKEY_CLASSES_ROOT\Interface\{6e74766c-4d93-4cc0-96d1-47b8e07ff9ca}"
"HKEY_CLASSES_ROOT\Interface\{247a115f-06c2-4fb3-967d-2d62d3cf4f0a}"
"HKEY_CLASSES_ROOT\Interface\{a626cdbd-3d13-4f78-b819-440a28d7e8fc}"
"HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc}"
"HKEY_CLASSES_ROOT\Interface\{d6ff3684-ad3b-48eb-bbb4-b9e6c5a355c1}"
"HKEY_CLASSES_ROOT\Interface\{eb9e5c1c-b1f9-4c2b-be8a-27d6446fdaf8}"
"HKEY_CLASSES_ROOT\Interface\{bbabdc90-f3d5-4801-863a-ee6ae529862d}"
"HKEY_CLASSES_ROOT\Interface\{3e1656ed-f60e-4597-b6aa-b6a58e171495}"
"HKEY_CLASSES_ROOT\Interface\{cf54be1c-9359-4395-8533-1657cf209cfe}"
"HKEY_CLASSES_ROOT\FunWebProducts.DataControl.1"
"HKEY_CLASSES_ROOT\FunWebProducts.HistoryKillerScheduler"
"HKEY_CLASSES_ROOT\FunWebProducts.HistoryKillerScheduler.1"
"HKEY_CLASSES_ROOT\FunWebProducts.HistorySwatterControlBar"
"HKEY_CLASSES_ROOT\FunWebProducts.HistorySwatterControlBar.1"
"HKEY_CLASSES_ROOT\FunWebProducts.HTMLMenu"
"HKEY_CLASSES_ROOT\FunWebProducts.HTMLMenu.1"
"HKEY_CLASSES_ROOT\FunWebProducts.HTMLMenu.2"
"HKEY_CLASSES_ROOT\FunWebProducts.IECookiesManager"
"HKEY_CLASSES_ROOT\FunWebProducts.IECookiesManager.1"
"HKEY_CLASSES_ROOT\FunWebProducts.KillerObjManager"
"HKEY_CLASSES_ROOT\FunWebProducts.KillerObjManager.1"
"HKEY_CLASSES_ROOT\FunWebProducts.PopSwatterBarButton"
"HKEY_CLASSES_ROOT\FunWebProducts.PopSwatterBarButton.1"
"HKEY_CLASSES_ROOT\FunWebProducts.PopSwatterSettingsControl"
"HKEY_CLASSES_ROOT\FunWebProducts.PopSwatterSettingsControl.1"
"HKEY_CLASSES_ROOT\screensavercontrol.screensaverinstaller"
"HKEY_CLASSES_ROOT\screensavercontrol.screensaverinstaller.1"
"HKEY_CLASSES_ROOT\MyWebSearch.ChatSessionPlugin"
"HKEY_CLASSES_ROOT\MyWebSearch.ChatSessionPlugin.1"
"HKEY_CLASSES_ROOT\MyWebSearch.HTMLPanel"
"HKEY_CLASSES_ROOT\MyWebSearch.HTMLPanel.1"
"HKEY_CLASSES_ROOT\MyWebSearch.OutlookAddin"
"HKEY_CLASSES_ROOT\MyWebSearch.OutlookAddin.1"
"HKEY_CLASSES_ROOT\MyWebSearch.PseudoTransparentPlugin"
"HKEY_CLASSES_ROOT\MyWebSearch.PseudoTransparentPlugin.1"
"HKEY_CLASSES_ROOT\MyWebSearchToolBar.SettingsPlugin"
"HKEY_CLASSES_ROOT\MyWebSearchToolBar.SettingsPlugin.1"
"HKEY_CLASSES_ROOT\MyWebSearchToolBar.ToolbarPlugin"
"HKEY_CLASSES_ROOT\MyWebSearchToolBar.ToolbarPlugin.1"
"HKEY_CURRENT_USER\SOFTWARE\Fun Web Products"
"HKEY_CURRENT_USER\SOFTWARE\MyWebSearch"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E79DFBCA-5697-4fbd-94E5-5B2A9C7C1612}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{07B18EAA-A523-4961-B6BB-170DE4475CCA}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{07B18EAC-A523-4961-B6BB-170DE4475CCA}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3E720451-B472-4954-B7AA-33069EB53906}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3E720453-B472-4954-B7AA-33069EB53906}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72EE7F04-15BD-4845-A005-D6711144D86A}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7473D291-B7BB-4F24-AE82-7E2CE94BB6A9}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7473D293-B7BB-4F24-AE82-7E2CE94BB6A9}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7473D295-B7BB-4F24-AE82-7E2CE94BB6A9}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7473D297-B7BB-4F24-AE82-7E2CE94BB6A9}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E79DFBC9-5697-4FBD-94E5-5B2A9C7C1612}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E79DFBCB-5697-4FBD-94E5-5B2A9C7C1612}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F87D7FB5-9DC5-4C8C-B998-D8DFE02E2978}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{63D0ED2B-B45B-4458-8B3B-60C69BBBD83C}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{63D0ED2D-B45B-4458-8B3B-60C69BBBD83C}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{07B18EA0-A523-4961-B6BB-170DE4475CCA}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{0D26BC71-A633-4E71-AD31-EADC3A1B6A3A}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{29D67D3C-509A-4544-903F-C8C1B8236554}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{3E720450-B472-4954-B7AA-33069EB53906}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{7473D290-B7BB-4F24-AE82-7E2CE94BB6A9}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{8CA01F0E-987C-49C3-B852-2F1AC4A7094C}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{8E6F1830-9607-4440-8530-13BE7C4B1D14}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{C8CECDE3-1AE1-4C4A-AD82-6D5B00212144}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D518921A-4A03-425E-9873-B9A71756821E}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E47CAEE0-DEEA-464A-9326-3F2801535A4D}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E79DFBC0-5697-4FBD-94E5-5B2A9C7C1612}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F42228FB-E84E-479E-B922-FBBD096E792C}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Fun Web Products"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyWebSearch bar Uninstall"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FunWebProducts.HistoryKillerScheduler.1"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media\WMSDK\Sources" /v "f3PopularScreensavers"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59C7FC09-1C83-4648-B3E6-003D2BBC7481}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170B96C-28D4-4626-8358-27E6CAEEF907}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D1A71FA0-FF48-48dd-9B6D-7A13A3E42127}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DDB1968E-EAD6-40fd-8DAE-FF14757F60C7}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F138D901-86F0-4383-99B6-9CDD406036DA}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68af847f-6e91-45dd-9b68-d6a12c30e5d7}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{e79dfbca-5697-4fbd-94e5-5b2a9c7c1612}"
.
[01/12/2008 21:51|--a------] C:\Program Files\Mozilla Firefox\Plugins\NPMyWebS.dll
[01/12/2008 21:51|--a------] C:\Program Files\Windows live\Messenger\riched20.dll
[01/12/2008 21:51|--a------] C:\Program Files\Windows live\Messenger\msimg32.dll
[01/12/2008 21:51|--a------] C:\Program Files\Internet explorer\msimg32.dll

+-----------------------| Messenger Skinner Elements found..

.

+-----------------------| Sweetim Elements found..

.

+-----------------------| ADDED SCAN ..

+---------- Scanning prefs.js ... ( # Mozilla User Preferences )

...\axm71qzz.default\prefs.js :

~~~~ Mozilla FireFox version 3.0.4 ~~~~

Start Page : "https://fr.yahoo.com/"

+----------+

+---------------------------------------------------------------------------+

+--[HKEY_CURRENT_USER\..\Run]

ctfmon.exe REG_SZ C:\WINDOWS\system32\ctfmon.exe

+--[HKEY_LOCAL_MACHINE\..\Run]

hpsysdrv REG_SZ c:\windows\system\hpsysdrv.exe
AlcxMonitor REG_SZ ALCXMNTR.EXE
HPHUPD08 REG_SZ c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
KBD REG_SZ C:\HP\KBD\KBD.EXE
Recguard REG_SZ C:\WINDOWS\SMINST\RECGUARD.EXE
PS2 REG_SZ C:\WINDOWS\system32\ps2.exe
HP Software Update REG_EXPAND_SZ C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
BigDogPath REG_SZ C:\WINDOWS\VM_STI.EXE Philips SPC 200NC PC Camera
TkBellExe REG_SZ "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
SearchSettings REG_SZ C:\Program Files\Search Settings\SearchSettings.exe
SunJavaUpdateSched REG_SZ "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
Adobe Reader Speed Launcher REG_SZ "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
NvCplDaemon REG_SZ RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
nwiz REG_SZ nwiz.exe /installquiet /keeploaded /nodetect
avast! REG_SZ C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

+--[HKEY_USERS\.DEFAULT\..\Run]

+--[HKEY_CURRENT_USER\..\Internet Explorer\MAIN]

Start Page : hxxp://google.fr/

+--[HKEY_LOCAL_MACHINE\..\Internet Explorer\MAIN]

Start Page : hxxp://fr.yahoo.com

+---------------------------------------------------------------------------+

- "C:\AD-report-08.12.2008.log" (12017 octets)

[ END at: 18:12:41 | 08/12/2008 ] - [ Time elapsed: 13.4 seconds ]

+---------------------------------------------------------------------------+
+------------------------------- [ E.O.F - 223 lines ]
+---------------------------------------------------------------------------+

relance ad remover choisi l'option B et tape le chiffre correspondant a ces 3 elements:

Boonty
EoRezo
FunWebProducts/MyWay/MyWebSearch/

puis supprime avec S

et colle le rapport

OK Donc:

--------- Logfile of AD-Remover 1.0.6.5 by C_XX ---------

# START at: 18:12:27 | Lun 08/12/2008 ON Microsoft® Windows XP ™ v5.1.2600
# BOOT MODE: Normal

# OPTION: Scan
# EXECUTED FROM: C:\Program Files\Ad-remover\AD-Remover.bat

# PC: NOM-EB85C523610 | USER: HP_Propriétaire ( Current user is an administrator )

# DRIVE(S): C:\
# Systemdrive: C:\ (NTFS)
# Internet Explorer v7.0.5730.13

--------- [ RUNNING PROCESSES: 39 ] ---------

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\HP\KBD\KBD.EXE
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
C:\WINDOWS\VM_STI.EXE
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Search Settings\SearchSettings.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Philips\SPC 200NC PC Camera\TrayMin200.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\All Users\Application Data\iWin Games\DesktopAlerts\DesktopAlerts.exe
C:\Program Files\MioNet\MioNetManager.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\MioNet\jvm\bin\MioNet.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ntvdm.exe

-----------------------------------

+-----------------------| Boonty/Boonty Games Elements found..

"HKEY_CURRENT_USER\SOFTWARE\Boonty"
"HKEY_LOCAL_MACHINE\Software\Boonty"
.
[15/10/2008 10:15|d--------] C:\Program Files\Boonty
[15/10/2008 10:05|d--------] C:\Program Files\BoontyGames
[15/10/2008 10:15|d--------] C:\Program Files\Fichiers communs\BOONTY Shared

+-----------------------| Eorezo Elements found..

.
[07/02/2007 16:23|d--------] C:\Program Files\EoRezo

+-----------------------| Everest Poker Elements found..

.

+-----------------------| FunWebProducts/MyWay/MyWebSearch/MyGlobalSearch Elements found..

"HKEY_CLASSES_ROOT\Interface\{e342af55-b78a-4cd0-a2bb-da7f52d9d25e}"
"HKEY_CLASSES_ROOT\Interface\{2e3537fc-cf2f-4f56-af54-5a6a3dd375cc}"
"HKEY_CLASSES_ROOT\Interface\{de38c398-b328-4f4c-a3ad-1b5e4ed93477}"
"HKEY_CLASSES_ROOT\Interface\{3E53E2CB-86DB-4A4A-8BD9-FFEB7A64DF82}"
"HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff}"
"HKEY_CLASSES_ROOT\Interface\{120927bf-1700-43bc-810f-fab92549b390}"
"HKEY_CLASSES_ROOT\Interface\{e342af55-b78a-4cd0-a2bb-da7f52d9d25f}"
"HKEY_CLASSES_ROOT\Interface\{17DE5E5E-BFE3-4E83-8E1F-8755795359EC}"
"HKEY_CLASSES_ROOT\Interface\{1093995a-ba37-41d2-836e-091067c4ad17}"
"HKEY_CLASSES_ROOT\Interface\{1f52a5fa-a705-4415-b975-88503b291728}"
"HKEY_CLASSES_ROOT\Interface\{991AAC62-B100-47CE-8B75-253965244f69}"
"HKEY_CLASSES_ROOT\Interface\{90449521-d834-4703-bb4e-d3aa44042ff8}"
"HKEY_CLASSES_ROOT\Interface\{6e74766c-4d93-4cc0-96d1-47b8e07ff9ca}"
"HKEY_CLASSES_ROOT\Interface\{247a115f-06c2-4fb3-967d-2d62d3cf4f0a}"
"HKEY_CLASSES_ROOT\Interface\{a626cdbd-3d13-4f78-b819-440a28d7e8fc}"
"HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc}"
"HKEY_CLASSES_ROOT\Interface\{d6ff3684-ad3b-48eb-bbb4-b9e6c5a355c1}"
"HKEY_CLASSES_ROOT\Interface\{eb9e5c1c-b1f9-4c2b-be8a-27d6446fdaf8}"
"HKEY_CLASSES_ROOT\Interface\{bbabdc90-f3d5-4801-863a-ee6ae529862d}"
"HKEY_CLASSES_ROOT\Interface\{3e1656ed-f60e-4597-b6aa-b6a58e171495}"
"HKEY_CLASSES_ROOT\Interface\{cf54be1c-9359-4395-8533-1657cf209cfe}"
"HKEY_CLASSES_ROOT\FunWebProducts.DataControl.1"
"HKEY_CLASSES_ROOT\FunWebProducts.HistoryKillerScheduler"
"HKEY_CLASSES_ROOT\FunWebProducts.HistoryKillerScheduler.1"
"HKEY_CLASSES_ROOT\FunWebProducts.HistorySwatterControlBar"
"HKEY_CLASSES_ROOT\FunWebProducts.HistorySwatterControlBar.1"
"HKEY_CLASSES_ROOT\FunWebProducts.HTMLMenu"
"HKEY_CLASSES_ROOT\FunWebProducts.HTMLMenu.1"
"HKEY_CLASSES_ROOT\FunWebProducts.HTMLMenu.2"
"HKEY_CLASSES_ROOT\FunWebProducts.IECookiesManager"
"HKEY_CLASSES_ROOT\FunWebProducts.IECookiesManager.1"
"HKEY_CLASSES_ROOT\FunWebProducts.KillerObjManager"
"HKEY_CLASSES_ROOT\FunWebProducts.KillerObjManager.1"
"HKEY_CLASSES_ROOT\FunWebProducts.PopSwatterBarButton"
"HKEY_CLASSES_ROOT\FunWebProducts.PopSwatterBarButton.1"
"HKEY_CLASSES_ROOT\FunWebProducts.PopSwatterSettingsControl"
"HKEY_CLASSES_ROOT\FunWebProducts.PopSwatterSettingsControl.1"
"HKEY_CLASSES_ROOT\screensavercontrol.screensaverinstaller"
"HKEY_CLASSES_ROOT\screensavercontrol.screensaverinstaller.1"
"HKEY_CLASSES_ROOT\MyWebSearch.ChatSessionPlugin"
"HKEY_CLASSES_ROOT\MyWebSearch.ChatSessionPlugin.1"
"HKEY_CLASSES_ROOT\MyWebSearch.HTMLPanel"
"HKEY_CLASSES_ROOT\MyWebSearch.HTMLPanel.1"
"HKEY_CLASSES_ROOT\MyWebSearch.OutlookAddin"
"HKEY_CLASSES_ROOT\MyWebSearch.OutlookAddin.1"
"HKEY_CLASSES_ROOT\MyWebSearch.PseudoTransparentPlugin"
"HKEY_CLASSES_ROOT\MyWebSearch.PseudoTransparentPlugin.1"
"HKEY_CLASSES_ROOT\MyWebSearchToolBar.SettingsPlugin"
"HKEY_CLASSES_ROOT\MyWebSearchToolBar.SettingsPlugin.1"
"HKEY_CLASSES_ROOT\MyWebSearchToolBar.ToolbarPlugin"
"HKEY_CLASSES_ROOT\MyWebSearchToolBar.ToolbarPlugin.1"
"HKEY_CURRENT_USER\SOFTWARE\Fun Web Products"
"HKEY_CURRENT_USER\SOFTWARE\MyWebSearch"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E79DFBCA-5697-4fbd-94E5-5B2A9C7C1612}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{07B18EAA-A523-4961-B6BB-170DE4475CCA}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{07B18EAC-A523-4961-B6BB-170DE4475CCA}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3E720451-B472-4954-B7AA-33069EB53906}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3E720453-B472-4954-B7AA-33069EB53906}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72EE7F04-15BD-4845-A005-D6711144D86A}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7473D291-B7BB-4F24-AE82-7E2CE94BB6A9}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7473D293-B7BB-4F24-AE82-7E2CE94BB6A9}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7473D295-B7BB-4F24-AE82-7E2CE94BB6A9}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7473D297-B7BB-4F24-AE82-7E2CE94BB6A9}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E79DFBC9-5697-4FBD-94E5-5B2A9C7C1612}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E79DFBCB-5697-4FBD-94E5-5B2A9C7C1612}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F87D7FB5-9DC5-4C8C-B998-D8DFE02E2978}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{63D0ED2B-B45B-4458-8B3B-60C69BBBD83C}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{63D0ED2D-B45B-4458-8B3B-60C69BBBD83C}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{07B18EA0-A523-4961-B6BB-170DE4475CCA}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{0D26BC71-A633-4E71-AD31-EADC3A1B6A3A}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{29D67D3C-509A-4544-903F-C8C1B8236554}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{3E720450-B472-4954-B7AA-33069EB53906}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{7473D290-B7BB-4F24-AE82-7E2CE94BB6A9}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{8CA01F0E-987C-49C3-B852-2F1AC4A7094C}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{8E6F1830-9607-4440-8530-13BE7C4B1D14}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{C8CECDE3-1AE1-4C4A-AD82-6D5B00212144}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D518921A-4A03-425E-9873-B9A71756821E}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E47CAEE0-DEEA-464A-9326-3F2801535A4D}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{E79DFBC0-5697-4FBD-94E5-5B2A9C7C1612}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F42228FB-E84E-479E-B922-FBBD096E792C}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Fun Web Products"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyWebSearch bar Uninstall"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FunWebProducts.HistoryKillerScheduler.1"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media\WMSDK\Sources" /v "f3PopularScreensavers"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59C7FC09-1C83-4648-B3E6-003D2BBC7481}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170B96C-28D4-4626-8358-27E6CAEEF907}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D1A71FA0-FF48-48dd-9B6D-7A13A3E42127}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DDB1968E-EAD6-40fd-8DAE-FF14757F60C7}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F138D901-86F0-4383-99B6-9CDD406036DA}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68af847f-6e91-45dd-9b68-d6a12c30e5d7}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{e79dfbca-5697-4fbd-94e5-5b2a9c7c1612}"
.
[01/12/2008 21:51|--a------] C:\Program Files\Mozilla Firefox\Plugins\NPMyWebS.dll
[01/12/2008 21:51|--a------] C:\Program Files\Windows live\Messenger\riched20.dll
[01/12/2008 21:51|--a------] C:\Program Files\Windows live\Messenger\msimg32.dll
[01/12/2008 21:51|--a------] C:\Program Files\Internet explorer\msimg32.dll

+-----------------------| Messenger Skinner Elements found..

.

+-----------------------| Sweetim Elements found..

.

+-----------------------| ADDED SCAN ..

+---------- Scanning prefs.js ... ( # Mozilla User Preferences )

...\axm71qzz.default\prefs.js :

~~~~ Mozilla FireFox version 3.0.4 ~~~~

Start Page : "https://fr.yahoo.com/"

+----------+

+---------------------------------------------------------------------------+

+--[HKEY_CURRENT_USER\..\Run]

ctfmon.exe REG_SZ C:\WINDOWS\system32\ctfmon.exe

+--[HKEY_LOCAL_MACHINE\..\Run]

hpsysdrv REG_SZ c:\windows\system\hpsysdrv.exe
AlcxMonitor REG_SZ ALCXMNTR.EXE
HPHUPD08 REG_SZ c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
KBD REG_SZ C:\HP\KBD\KBD.EXE
Recguard REG_SZ C:\WINDOWS\SMINST\RECGUARD.EXE
PS2 REG_SZ C:\WINDOWS\system32\ps2.exe
HP Software Update REG_EXPAND_SZ C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
BigDogPath REG_SZ C:\WINDOWS\VM_STI.EXE Philips SPC 200NC PC Camera
TkBellExe REG_SZ "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
SearchSettings REG_SZ C:\Program Files\Search Settings\SearchSettings.exe
SunJavaUpdateSched REG_SZ "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
Adobe Reader Speed Launcher REG_SZ "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
NvCplDaemon REG_SZ RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
nwiz REG_SZ nwiz.exe /installquiet /keeploaded /nodetect
avast! REG_SZ C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

+--[HKEY_USERS\.DEFAULT\..\Run]

+--[HKEY_CURRENT_USER\..\Internet Explorer\MAIN]

Start Page : hxxp://google.fr/

+--[HKEY_LOCAL_MACHINE\..\Internet Explorer\MAIN]

Start Page : hxxp://fr.yahoo.com

+---------------------------------------------------------------------------+

- "C:\AD-report-08.12.2008.log" (12017 octets)

[ END at: 18:12:41 | 08/12/2008 ] - [ Time elapsed: 13.4 seconds ]

+---------------------------------------------------------------------------+
+------------------------------- [ E.O.F - 223 lines ]
+---------------------------------------------------------------------------+

Alors Docteur?

Télécharges AD-Remover ( de Cyrildu17 / C_XX ) sur ton bureau :
http://sd-1.archive-host.com/membres/up/16506160323759868/AD-R.exe

/!\ Déconnectes toi et fermes toutes applications en cours

● Double clique sur le programme d'installation , et installe le dans son emplacement par défaut. ( C:\Program files )
● Double clique sur l'icône Ad-removersituée sur ton bureau
● Au menu principal choisi l'option "A"
● Postes le rapport qui apparait à la fin .

( le rapport est sauvegardé aussi sous C:\Ad-report(date).log )

(CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

Note :

"Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.

Excuse en fait j'avais pas du tout terminé...

1/

Logfile of random's system information tool 1.04 (written by random/random)
Run by HP_Propriétaire at 2008-12-08 17:35:33
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 32 GB (14%) free of 232 GB
Total RAM: 1022 MB (55% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:36:05, on 08/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\HP\KBD\KBD.EXE
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
C:\WINDOWS\VM_STI.EXE
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Search Settings\SearchSettings.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Philips\SPC 200NC PC Camera\TrayMin200.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\All Users\Application Data\iWin Games\DesktopAlerts\DesktopAlerts.exe
C:\Program Files\MioNet\MioNetManager.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\MioNet\jvm\bin\MioNet.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\HP_Propriétaire\Bureau\RSIT.exe
C:\Program Files\trend micro\HP_Propriétaire.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: e-Carte Bleue Browser Helper Object - {2E03C0FD-4C48-43A7-9A54-00240C70FF16} - C:\WINDOWS\system32\BhoECart.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE Philips SPC 200NC PC Camera
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\Search Settings\SearchSettings.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - Startup: iWin Desktop Alerts.lnk = C:\Documents and Settings\All Users\Application Data\iWin Games\DesktopAlerts\DesktopAlerts.exe
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: TrayMin300.exe.lnk = ?
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZJman000
O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\HP_Propriétaire\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: MioNet Service (MioNet) - Unknown owner - C:\Program Files\MioNet\MioNetManager.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

c'est indiqué dans le message 6

Télécharge ici :

http://images.malwareremoval.com/random/RSIT.exe

random's system information tool (RSIT) par andom/random et sauvegarde-le sur le Bureau.

Double-clique sur RSIT.exe afin de lancer RSIT.

Clique Continue à l'écran Disclaimer.

Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.

Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront.

Poste le contenu de log.txt (<<qui sera affiché)
ainsi que de info.txt (<<qui sera réduit dans la Barre des Tâches).

NB : Les rapports sont sauvegardés dans le dossier C:\rsit

rsit????

Excuse mon ignorance...

colle le rapport rsit

pour voir

J'ai donc à nouveau suivi les instructions, Avast fonctionne à présent, le scan a supprimé 162 fichiers infectés, ci-dessous le rapport combofix:

ComboFix 08-12-06.06 - HP_Propriétaire 2008-12-08 9:49:27.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.648 [GMT 1:00]
Lancé depuis: c:\documents and settings\HP_Propriétaire\Bureau\ComboFix.exe
* Un nouveau point de restauration a été créé
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\HP_Propriétaire\Application Data\FunWebProducts
c:\documents and settings\HP_Propriétaire\Application Data\FunWebProducts\Data\HP_Propriétaire\avatar.dat
c:\documents and settings\HP_Propriétaire\Application Data\FunWebProducts\Data\HP_Propriétaire\outfit.dat
c:\documents and settings\HP_Propriétaire\Application Data\FunWebProducts\Data\HP_Propriétaire\register.dat
c:\documents and settings\HP_Propriétaire\Application Data\FunWebProducts\Data\HP_Propriétaire\zbucks.dat
c:\documents and settings\HP_Propriétaire\Application Data\WinTouch
c:\documents and settings\HP_Propriétaire\Local Settings\Application Data\zfbmrua.dat
c:\documents and settings\HP_Propriétaire\Local Settings\Application Data\zfbmrua.exe
c:\documents and settings\HP_Propriétaire\Local Settings\Application Data\zfbmrua_nav.dat
c:\documents and settings\HP_Propriétaire\Local Settings\Application Data\zfbmrua_navps.dat
c:\program files\FunWebProducts
c:\program files\FunWebProducts\Shared\Cache\CursorManiaBtn.html
c:\program files\FunWebProducts\Shared\Cache\SmileyCentralBtn.html
c:\program files\Insider
c:\program files\MyWebSearch
c:\program files\MyWebSearch\bar\1.bin\F3BKGERR.JPG
c:\program files\MyWebSearch\bar\1.bin\F3CJPEG.DLL
c:\program files\MyWebSearch\bar\1.bin\F3DTACTL.DLL
c:\program files\MyWebSearch\bar\1.bin\F3HISTSW.DLL
c:\program files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL
c:\program files\MyWebSearch\bar\1.bin\F3HTTPCT.DLL
c:\program files\MyWebSearch\bar\1.bin\F3IMSTUB.DLL
c:\program files\MyWebSearch\bar\1.bin\F3POPSWT.DLL
c:\program files\MyWebSearch\bar\1.bin\F3PSSAVR.SCR
c:\program files\MyWebSearch\bar\1.bin\F3REPROX.DLL
c:\program files\MyWebSearch\bar\1.bin\F3RESTUB.DLL
c:\program files\MyWebSearch\bar\1.bin\F3SCHMON.EXE
c:\program files\MyWebSearch\bar\1.bin\F3SCRCTR.DLL
c:\program files\MyWebSearch\bar\1.bin\F3SPACER.WMV
c:\program files\MyWebSearch\bar\1.bin\F3WALLPP.DAT
c:\program files\MyWebSearch\bar\1.bin\F3WPHOOK.DLL
c:\program files\MyWebSearch\bar\1.bin\FWPBUDDY.PNG
c:\program files\MyWebSearch\bar\1.bin\M3FFXTBR.JAR
c:\program files\MyWebSearch\bar\1.bin\M3FFXTBR.MANIFEST
c:\program files\MyWebSearch\bar\1.bin\M3HIGHIN.EXE
c:\program files\MyWebSearch\bar\1.bin\M3HTML.DLL
c:\program files\MyWebSearch\bar\1.bin\M3IDLE.DLL
c:\program files\MyWebSearch\bar\1.bin\M3IMPIPE.EXE
c:\program files\MyWebSearch\bar\1.bin\M3MEDINT.EXE
c:\program files\MyWebSearch\bar\1.bin\M3MSG.DLL
c:\program files\MyWebSearch\bar\1.bin\M3NTSTBR.JAR
c:\program files\MyWebSearch\bar\1.bin\M3NTSTBR.MANIFEST
c:\program files\MyWebSearch\bar\1.bin\M3OUTLCN.DLL
c:\program files\MyWebSearch\bar\1.bin\M3PLUGIN.DLL
c:\program files\MyWebSearch\bar\1.bin\M3SKIN.DLL
c:\program files\MyWebSearch\bar\1.bin\M3SKPLAY.EXE
c:\program files\MyWebSearch\bar\1.bin\M3SLSRCH.EXE
c:\program files\MyWebSearch\bar\1.bin\M3SRCHMN.EXE
c:\program files\MyWebSearch\bar\1.bin\MWSBAR.DLL
c:\program files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
c:\program files\MyWebSearch\bar\1.bin\MWSOEPLG.DLL
c:\program files\MyWebSearch\bar\1.bin\MWSOESTB.DLL
c:\program files\MyWebSearch\bar\1.bin\MWSSVC.EXE
c:\program files\MyWebSearch\bar\1.bin\NPMYWEBS.DLL
c:\program files\MyWebSearch\bar\Avatar\COMMON.F3S
c:\program files\MyWebSearch\bar\Avatar\COMMON\avatar.htm
c:\program files\MyWebSearch\bar\Avatar\COMMON\bgfadel.gif
c:\program files\MyWebSearch\bar\Avatar\COMMON\bgfader.gif
c:\program files\MyWebSearch\bar\Avatar\COMMON\common-x.css
c:\program files\MyWebSearch\bar\Avatar\COMMON\common.css
c:\program files\MyWebSearch\bar\Avatar\COMMON\cornerbl.gif
c:\program files\MyWebSearch\bar\Avatar\COMMON\cornerbr.gif
c:\program files\MyWebSearch\bar\Avatar\COMMON\ext_def.gif
c:\program files\MyWebSearch\bar\Avatar\COMMON\ext_roll.gif
c:\program files\MyWebSearch\bar\Avatar\COMMON\include.js
c:\program files\MyWebSearch\bar\Avatar\COMMON\index.htm
c:\program files\MyWebSearch\bar\Avatar\COMMON\loader.htm
c:\program files\MyWebSearch\bar\Avatar\COMMON\loading.gif
c:\program files\MyWebSearch\bar\Avatar\COMMON\logo.gif
c:\program files\MyWebSearch\bar\Avatar\COMMON\max_def.gif
c:\program files\MyWebSearch\bar\Avatar\COMMON\max_roll.gif
c:\program files\MyWebSearch\bar\Avatar\COMMON\min_def.gif
c:\program files\MyWebSearch\bar\Avatar\COMMON\min_roll.gif
c:\program files\MyWebSearch\bar\Avatar\COMMON\noflash.htm
c:\program files\MyWebSearch\bar\Avatar\COMMON\res_def.gif
c:\program files\MyWebSearch\bar\Avatar\COMMON\res_roll.gif
c:\program files\MyWebSearch\bar\Avatar\COMMON\spacer.gif
c:\program files\MyWebSearch\bar\Avatar\COMMON\spacer.swf
c:\program files\MyWebSearch\bar\Avatar\COMMON\topgrad.gif
c:\program files\MyWebSearch\bar\Avatar\COMMON\window.ico
c:\program files\MyWebSearch\bar\Cache\[u]0/uB19C50A
c:\program files\MyWebSearch\bar\Cache\[u]0/uB19E93C
c:\program files\MyWebSearch\bar\Cache\[u]0/uB19EFA5.bin
c:\program files\MyWebSearch\bar\Cache\[u]0/uB19F1D7.bin
c:\program files\MyWebSearch\bar\Cache\[u]0/uB19F3EA.bin
c:\program files\MyWebSearch\bar\Cache\[u]0/uB19F590.bin
c:\program files\MyWebSearch\bar\Cache\[u]0/uB19F717.bin
c:\program files\MyWebSearch\bar\Cache\files.ini
c:\program files\MyWebSearch\bar\Game\CHECKERS.F3S
c:\program files\MyWebSearch\bar\Game\CHESS.F3S
c:\program files\MyWebSearch\bar\Game\REVERSI.F3S
c:\program files\MyWebSearch\bar\History\search3
c:\program files\MyWebSearch\bar\icons\CM.ICO
c:\program files\MyWebSearch\bar\icons\MFC.ICO
c:\program files\MyWebSearch\bar\icons\PSS.ICO
c:\program files\MyWebSearch\bar\icons\SMILEY.ICO
c:\program files\MyWebSearch\bar\icons\WB.ICO
c:\program files\MyWebSearch\bar\icons\ZWINKY.ICO
c:\program files\MyWebSearch\bar\Message\COMMON.F3S
c:\program files\MyWebSearch\bar\Message\COMMON\ask_logo.gif
c:\program files\MyWebSearch\bar\Message\COMMON\autoup.gif
c:\program files\MyWebSearch\bar\Message\COMMON\autoup.htm
c:\program files\MyWebSearch\bar\Message\COMMON\center.htm
c:\program files\MyWebSearch\bar\Message\COMMON\index.htm
c:\program files\MyWebSearch\bar\Message\COMMON\mid_dots.gif
c:\program files\MyWebSearch\bar\Message\COMMON\mws_logo.gif
c:\program files\MyWebSearch\bar\Message\COMMON\protect.htm
c:\program files\MyWebSearch\bar\Message\COMMON\shocked.gif
c:\program files\MyWebSearch\bar\Message\COMMON\stop.gif
c:\program files\MyWebSearch\bar\Message\COMMON\systray.htm
c:\program files\MyWebSearch\bar\Message\COMMON\systrayp.htm
c:\program files\MyWebSearch\bar\Message\COMMON\tp_grad.gif
c:\program files\MyWebSearch\bar\Message\COMMON\warn.gif
c:\program files\MyWebSearch\bar\Notifier\COMMON.F3S
c:\program files\MyWebSearch\bar\Notifier\DOG.F3S
c:\program files\MyWebSearch\bar\Notifier\FISH.F3S
c:\program files\MyWebSearch\bar\Notifier\KUNGFU.F3S
c:\program files\MyWebSearch\bar\Notifier\LIFEGARD.F3S
c:\program files\MyWebSearch\bar\Notifier\MAID.F3S
c:\program files\MyWebSearch\bar\Notifier\MAILBOX.F3S
c:\program files\MyWebSearch\bar\Notifier\OPERA.F3S
c:\program files\MyWebSearch\bar\Notifier\ROBOT.F3S
c:\program files\MyWebSearch\bar\Notifier\SEDUCT.F3S
c:\program files\MyWebSearch\bar\Notifier\SURFER.F3S
c:\program files\MyWebSearch\bar\Settings\prevcfg2.htm
c:\program files\MyWebSearch\bar\Settings\s_pid.dat
c:\program files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
c:\program files\Uninstall Information\promymyl.html
c:\windows\system32\f3PSSavr.scr
c:\windows\system32\Microsoft\backup.ftp
c:\windows\system32\Microsoft\backup.tftp

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_BOONTY_GAMES
-------\Legacy_MYWEBSEARCHSERVICE
-------\Service_Boonty Games
-------\Service_MyWebSearchService
-------\Service_poof

((((((((((((((((((((((((((((( Fichiers créés du 2008-11-08 au 2008-12-08 ))))))))))))))))))))))))))))))))))))
.

2008-12-07 18:41 . 2008-12-07 21:23 <REP> d-------- c:\program files\FindyKill
2008-12-07 17:51 . 2008-12-07 17:51 <REP> d-------- c:\documents and settings\All Users\Application Data\MAGIX
2008-12-07 03:35 . 2008-12-07 03:35 11,310,447 --a------ C:\upload_moi_NOM-EB85C523610.tar.gz
2008-12-06 16:46 . 2008-12-06 17:04 <REP> d-------- c:\windows\nview
2008-12-06 16:46 . 2005-08-02 16:30 176,128 --a------ c:\windows\system32\nvudisp.exe
2008-12-06 16:46 . 2008-12-08 09:53 29,204 --a------ c:\windows\system32\nvapps.xml
2008-12-06 16:46 . 2005-08-02 16:30 14,757 --a------ c:\windows\system32\nvdisp.nvu
2008-12-01 22:11 . 2008-12-01 22:48 <REP> d-------- c:\windows\system32\Adobe
2008-11-26 23:01 . 2008-12-07 17:45 <REP> d-------- c:\program files\Image-Line
2008-11-26 22:57 . 2008-12-07 17:44 <REP> d-------- c:\program files\VstPlugins
2008-11-26 22:57 . 2003-04-07 12:07 217,088 --a------ c:\windows\system32\rewire.dll
2008-11-26 22:56 . 2002-07-08 00:14 1,294,336 --a------ c:\windows\system32\vorbis.acm
2008-11-26 22:52 . 2002-12-03 22:13 1,048,576 --a------ c:\windows\system32\lameACM.acm
2008-11-26 22:52 . 2003-03-25 06:49 306,960 -ra------ c:\windows\system32\h263_32.ax
2008-11-26 22:52 . 2003-03-25 06:49 277,264 -ra------ c:\windows\system32\h261_32.ax
2008-11-26 22:52 . 2003-03-25 06:49 135,168 -ra------ c:\windows\system32\L3CODECX.ACM
2008-11-26 22:52 . 2003-03-25 06:49 121,856 -ra------ c:\windows\system32\Mp3cnfg.cpl
2008-11-26 22:52 . 2003-03-25 06:49 34,064 -ra------ c:\windows\system32\lhacm.acm
2008-11-26 22:52 . 2003-03-25 06:49 27,648 -ra------ c:\windows\system32\ir50_lcs.dll
2008-11-26 22:52 . 2003-03-25 06:49 18,944 -ra------ c:\windows\system32\Mp3cnfg.exe
2008-11-26 01:13 . 2002-11-02 09:53 57,344 --a------ c:\windows\system32\WNASPINT.DLL
2008-11-26 01:12 . 2008-11-26 01:12 <REP> d-------- C:\eJay
2008-11-24 13:36 . 2008-11-24 13:36 <REP> d-------- c:\documents and settings\HP_Propriétaire\Application Data\MAGIX
2008-11-24 13:36 . 2008-11-24 13:36 28 --a------ c:\windows\Robota.INI
2008-11-24 13:35 . 2001-05-16 17:54 309,616 --a------ c:\windows\system32\wmv8dmod.dll
2008-11-24 13:35 . 2001-03-26 04:41 245,760 --a------ c:\windows\system32\mp4sds32.ax
2008-11-24 13:34 . 2007-04-18 22:07 53,248 --a------ c:\windows\system32\mgxasio2.dll
2008-11-24 13:34 . 2003-04-18 15:29 44,544 --a------ c:\windows\system32\msxml4a.dll
2008-11-24 13:33 . 2008-12-07 17:54 <REP> d-------- c:\program files\MAGIX
2008-11-24 13:33 . 2007-04-27 09:43 120,200 --a------ c:\windows\system32\DLLDEV32i.dll
2008-11-20 21:35 . 2008-11-20 21:35 <REP> d-------- c:\documents and settings\HP_Propriétaire\Application Data\Valusoft
2008-11-20 21:35 . 2008-11-20 21:35 <REP> d-------- c:\documents and settings\All Users\Application Data\Valusoft
2008-11-20 11:55 . 2008-11-20 11:55 <REP> d-------- c:\documents and settings\HP_Propriétaire\Application Data\iWin
2008-11-19 22:46 . 2008-11-19 22:46 <REP> d-------- c:\program files\Fichiers communs\SWF Studio
2008-11-19 22:42 . 2008-11-19 22:42 <REP> d-------- C:\Downloads
2008-11-19 21:44 . 2008-11-20 17:37 <REP> d-------- c:\program files\Free Download Manager
2008-11-17 21:00 . 2008-11-17 21:00 <REP> d-------- c:\documents and settings\HP_Propriétaire\Application Data\SulusGames
2008-11-15 21:13 . 2008-11-15 21:13 <REP> d-------- c:\documents and settings\HP_Propriétaire\Application Data\Gogii Games
2008-11-15 21:06 . 2008-11-25 08:57 <REP> d-------- c:\program files\iWin Games
2008-11-12 19:57 . 2008-10-24 12:21 455,296 --------- c:\windows\system32\dllcache\mrxsmb.sys
2008-11-12 19:56 . 2008-09-04 18:16 1,106,944 --------- c:\windows\system32\dllcache\msxml3.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-07 16:43 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-07 16:33 --------- d-----w c:\program files\iWin.com
2008-12-07 16:33 --------- d-----w c:\documents and settings\HP_Propriétaire\Application Data\IMVU
2008-12-07 01:18 --------- d-----w c:\program files\Spybot - Search & Destroy
2008-12-07 00:49 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2008-12-05 22:48 --------- d-----w c:\program files\eMule
2008-12-03 21:20 --------- d-----w c:\documents and settings\HP_Propriétaire\Application Data\OpenOffice.org2
2008-11-26 00:14 --------- d-----w c:\documents and settings\All Users\Application Data\InstallShield
2008-11-25 07:59 --------- d-----w c:\program files\Ahead
2008-11-12 23:55 --------- d-----w c:\program files\adslTV
2008-11-05 14:58 --------- d-----w c:\documents and settings\HP_Propriétaire\Application Data\Home Sweet Home
2008-11-03 22:32 --------- d-----w c:\documents and settings\HP_Propriétaire\Application Data\vlc
2008-11-03 18:24 --------- d-----w c:\program files\Fichiers communs\Adobe
2008-11-02 00:25 --------- d-----w c:\documents and settings\HP_Propriétaire\Application Data\PlayFirst
2008-11-02 00:25 --------- d-----w c:\documents and settings\All Users\Application Data\PlayFirst
2008-10-27 16:26 --------- d-----w c:\documents and settings\HP_Propriétaire\Application Data\iWinArcade
2008-10-27 16:26 --------- d-----w c:\documents and settings\All Users\Application Data\iWin Games
2008-10-25 19:41 --------- d-----w c:\documents and settings\HP_Propriétaire\Application Data\FarmerJane
2008-10-25 16:49 --------- d-----w c:\documents and settings\HP_Propriétaire\Application Data\BeachPartyCraze
2008-10-24 22:08 --------- d-----w c:\documents and settings\HP_Propriétaire\Application Data\blg
2008-10-24 22:08 --------- d-----w c:\documents and settings\All Users\Application Data\blg
2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-18 02:06 --------- d-----w c:\program files\MioNet
2008-10-15 12:41 --------- d-----w c:\program files\TuneUp Utilities 2008
2008-10-15 12:23 --------- d-----w c:\documents and settings\All Users\Application Data\TuneUp Software
2008-10-15 09:15 --------- d-----w c:\program files\Fichiers communs\BOONTY Shared
2008-10-15 09:15 --------- d-----w c:\program files\Boonty
2008-10-15 09:15 --------- d-----w c:\documents and settings\HP_Propriétaire\Application Data\Zylom
2008-10-15 09:15 --------- d-----w c:\documents and settings\HP_Propriétaire\Application Data\Metaversum
2008-10-15 09:11 --------- d-----w c:\program files\OpenOffice.org 2.4
2008-10-15 09:11 --------- d-----w c:\program files\Java
2008-10-15 09:05 --------- d-----w c:\program files\Zylom Games
2008-10-15 09:05 --------- d-----w c:\program files\BoontyGames
2008-10-15 08:56 --------- d-----w c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2008-10-15 08:02 --------- d-----w c:\program files\MSECache
2008-10-11 16:21 --------- d-----w c:\documents and settings\HP_Propriétaire\Application Data\Friday's games
2008-10-10 22:09 --------- d-----w c:\documents and settings\All Users\Application Data\Zylom
2008-06-23 10:36 0 ----a-w c:\documents and settings\HP_Propriétaire\Application Data\wklnhst.dat
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"HPHUPD08"="c:\program files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe" [2005-06-02 49152]
"KBD"="c:\hp\KBD\KBD.EXE" [2005-02-03 61440]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2005-07-22 237568]
"PS2"="c:\windows\system32\ps2.exe" [2004-10-25 90112]
"HP Software Update"="c:\program files\HP\HP Software Update\HPwuSchd2.exe" [2005-05-12 49152]
"BigDogPath"="c:\windows\VM_STI.EXE" [2004-06-09 40960]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2007-07-16 185896]
"SearchSettings"="c:\program files\Search Settings\SearchSettings.exe" [2008-04-16 985440]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-08-02 7110656]
"AlcxMonitor"="ALCXMNTR.EXE" [2004-09-07 c:\windows\ALCXMNTR.EXE]
"nwiz"="nwiz.exe" [2005-08-02 c:\windows\system32\nwiz.exe]

c:\documents and settings\HP_Propri‚taire\Menu D‚marrer\Programmes\D‚marrage\
iWin Desktop Alerts.lnk - c:\documents and settings\All Users\Application Data\iWin Games\DesktopAlerts\DesktopAlerts.exe [2008-10-27 108032]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Google Updater.lnk - c:\program files\Google\Google Updater\GoogleUpdater.exe [2007-02-11 123640]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-12 282624]
TrayMin300.exe.lnk - c:\program files\Philips\SPC 200NC PC Camera\TrayMin200.exe [2007-03-11 278528]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\adslTV\\adsltv.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1700:TCP"= 1700:TCP:MioNet Remote Drive Access
"1641:TCP"= 1641:TCP:MioNet Remote Drive Verification

R2 MioNet;MioNet Service;"c:\program files\MioNet\MioNetManager.exe" -s "c:\program files\MioNet\wrapper.conf" [2005-07-15 139264]
R3 3xHybrid;3xHybrid service;c:\windows\system32\DRIVERS\3xHybrid.sys [2005-01-03 2799488]
.
Contenu du dossier 'Tâches planifiées'

2008-12-08 c:\windows\Tasks\Maintenance en 1 clic.job
- c:\program files\TuneUp Utilities 2008\OneClickStarter.exe []

2008-12-07 c:\windows\Tasks\RegistrySmart Scheduled Scan.job
- c:\program files\RegistrySmart\RegistrySmart.exe []

2008-12-07 c:\windows\Tasks\RegistrySmart Scheduled Scan.job
- c:\program files\RegistrySmart []
.
- - - - ORPHELINS SUPPRIMES - - - -

URLSearchHooks-{ce0c2586-da36-452b-acdb-320d9bcb19bf} - (no file)
URLSearchHooks-{E312764E-7706-43F1-8DAB-FCDD2B1E416D} - (no file)
Toolbar-{ce0c2586-da36-452b-acdb-320d9bcb19bf} - (no file)
WebBrowser-{CE0C2586-DA36-452B-ACDB-320D9BCB19BF} - (no file)
HKCU-Run-MsnMsgr - c:\program files\Windows Live\Messenger\MsnMsgr.Exe
HKCU-Run-updateMgr - c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe
HKCU-Run-Performance Center - c:\program files\Ascentive\Performance Center\ApcMain.exe
HKCU-Run-BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - c:\program files\Fichiers communs\Nero\Lib\NMBgMonitor.exe
HKLM-Run-NBKeyScan - c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe
HKLM-Run-hozytyneg - c:\program files\MSN\hozytyneg77798.exe
HKLM-Run-UnlockerAssistant - c:\program files\Unlocker\UnlockerAssistant.exe
HKLM-Run-WinampAgent - c:\program files\Winamp\winampa.exe
HKLM-Run-MyWebSearch Plugin - c:\progra~1\MYWEBS~1\bar\1.bin\M3PLUGIN.DLL
HKLM-Run-PCDrProfiler - (no file)

.
------- Examen supplémentaire -------
.
uStart Page = hxxp://google.fr/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mStart Page = hxxp://fr.yahoo.com
uInternet Connection Wizard,ShellNext = iexplore
IE: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZJman000
IE: &Winamp Search - c:\documents and settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
IE: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
IE: {d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\HP_Propriétaire\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk
IE: {d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\HP_Propriétaire\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk -
FireFox -: Profile - c:\documents and settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\axm71qzz.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://fr.yahoo.com/
FF -: plugin - c:\documents and settings\All Users\Application Data\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
FF -: plugin - c:\program files\DivX\DivX Content Uploader\npUpload.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\NPMyWebS.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\npzylomgamesplayer.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-08 09:52:50
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

**************************************************************************
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\MioNet\MioNetManager.exe
c:\program files\MioNet\jvm\bin\MioNet.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\wdfmgr.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Heure de fin: 2008-12-08 9:56:47 - La machine a redémarré
ComboFix-quarantined-files.txt 2008-12-08 08:55:29

Avant-CF: 33 342 095 360 octets libres
Après-CF: 33,371,742,208 octets libres

355 --- E O F --- 2008-11-12 22:00:22

Est ce OK cette fois ci?

vire tes cracks

C:\Documents and Settings\HP_Propriétaire\Mes documents\The Rolling Stones Discography\The Rolling Stones\1977 - Love You Live\1977 - Love You Live (Disc 2)\The Rolling Stones - Crackin' Up.mp3
C:\Documents and Settings\HP_Propriétaire\Mes documents\[DISCOGRAFIA] The Rolling Stones (completa + cover)\--Tutto Rolling Stone--\1977 - Love You Live Cd2\02 - Crackin' Up.mp3
C:\Documents and Settings\HP_Propriétaire\Recent\Crack (2).lnk
C:\Documents and Settings\HP_Propriétaire\Recent\crack.lnk
C:\Documents and Settings\HP_Propriétaire\Recent\cracked.lnk
C:\Documents and Settings\HP_Propriétaire\Recent\Fruity Loops Studio 5 + Crack (full program).lnk
C:\Documents and Settings\HP_Propriétaire\Recent\techno ejay 5 crack (2).lnk
C:\Documents and Settings\HP_Propriétaire\Recent\techno ejay 5 crack.lnk
C:\Documents and Settings\HP_Propriétaire\Recent\• Keygen For Microsoft Office Xp Pro (Word, Excel, Powerpoint, Outlook, Access, Frontpage) By Atomix&Ztaz Zip.lnk

puis

télécharge combofix (par sUBs) ici :

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

et enregistre le sur le bureau.

déconnecte toi d'internet et ferme toutes tes applications.

désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)

double-clique sur combofix.exe et suis les instructions

à la fin, il va produire un rapport C:\ComboFix.txt

réactive ton parefeu, ton antivirus, la garde de ton antispyware

copie/colle le rapport C:\ComboFix.txt dans ta prochaine réponse.

Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi.

Tu as un tutoriel complet ici :

https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

puis

Télécharge ici :

http://images.malwareremoval.com/random/RSIT.exe

random's system information tool (RSIT) par andom/random et sauvegarde-le sur le Bureau.

Double-clique sur RSIT.exe afin de lancer RSIT.

Clique Continue à l'écran Disclaimer.

Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.

Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront.

Poste le contenu de log.txt (<<qui sera affiché)
ainsi que de info.txt (<<qui sera réduit dans la Barre des Tâches).

NB : Les rapports sont sauvegardés dans le dossier C:\rsit