Infecté ou pas ?

Résolu
Bonsoir,
je dois nettoyer le PC d'un ami qui est de plus en plus lent. J'ai fais un scan Sbybot il a touvé un petit truc et l'a enlevé. Malware byte complet n'a rien trouvé. J'ai fais un Genproc qui n'a rien vu non plus hors le PC est toujours lent ^^'.
J'ai fais un scan Hijackthis, (rapport en fin de message)
Le PC est-il infecté ou non ?
Merci à vous !

Rapport Hijackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:42:00, on 18/08/2009
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16890)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Users\Patrick\ExtraFilm PhotoAssistant\Agent.exe
C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\Program Files\D-Link\D-Link Wireless N DWA-140\AirNCFG.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Windows\system32\taskeng.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Windows\system32\conime.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Windows\system32\wuauclt.exe
I:\AAA\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.aldi.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2fwww.msn.be%2f%3f
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.aldi.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [toolbar_eula_launcher] C:\Program Files\GoogleEULA\EULALauncher.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [ExtraFilmHemmaAgent] "C:\Users\Patrick\ExtraFilm PhotoAssistant\Agent.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [D-Link D-Link Wireless N DWA-140] C:\Program Files\D-Link\D-Link Wireless N DWA-140\AirNCFG.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Verz&enden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://www.extrafilm.be/ImageUploader5.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {A73BAEFA-EE65-494D-BEDB-DD3E5A34FA98} (Image Uploader) - http://www.extrafilm.be/ImageUploader4.cab
O16 - DPF: {AE2B937E-EA7D-4A8D-888C-B68D7F72A3C4} (IPSUploader4 Control) - http://as.photoprintit.de/ips-opdata/74914091/activex/IPSUploader4.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game03.zylom.com/activex/zylomgamesplayer.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ExtraFilm upload service (EFUploadSrv) - Textalk AB - C:\Program Files\ExtraFilm Designer BE NL\EFUploadSrv.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktopManager.exe
O23 - Service: Google Updateservice (gupdate1c9f35e5f7ee078) (gupdate1c9f35e5f7ee078) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

--
End of file - 9627 bytes
Configuration: Windows Internet Explorer 7.0

7 réponses

  1. Contributeur sécurité
    slt

    désactive le tea timer de spybot car windows defender est déjà actif et cela fais double emploi et donc ralenti le pc

    _________________

    pour vista le sp2 est sorti et internet explorer en est à la version 8

    Platform: Windows Vista (WinNT 6.00.1904)
    MSIE: Internet Explorer v7.00 (7.00.6000.16890)

    __________________

    plus complet qu'hijakchits:

    Télécharge ici :

    http://images.malwareremoval.com/random/RSIT.exe

    random's system information tool (RSIT) par andom/random et sauvegarde-le sur le Bureau.

    Double-clique sur RSIT.exe afin de lancer RSIT.

    Clique Continue à l'écran Disclaimer.

    Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.

    Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront.

    Poste le contenu de log.txt (<<qui sera affiché)
    ainsi que de info.txt (<<qui sera réduit dans la Barre des Tâches).

    NB : Les rapports sont sauvegardés dans le dossier C:\rsit

    __________________

    pour voir si rien d'infectieux colle un scan en ligne de chez kaspersky
    https://www.kaspersky.fr/downloads
    ou panda ou nod32 ou bitdefender

    ____________________

    a plus
    1. Voila le log.txt :

      Logfile of random's system information tool 1.06 (written by random/random)
      Run by Patrick at 2009-08-19 12:02:42
      Microsoft® Windows Vista™ Home Premium
      System drive C: has 224 GB (72%) free of 313 GB
      Total RAM: 895 MB (11% free)

      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 12:03:11, on 19/08/2009
      Platform: Windows Vista (WinNT 6.00.1904)
      MSIE: Internet Explorer v7.00 (7.00.6000.16890)
      Boot mode: Normal

      Running processes:
      C:\Windows\system32\Dwm.exe
      C:\Windows\Explorer.EXE
      C:\Program Files\Windows Defender\MSASCui.exe
      C:\Windows\RtHDVCpl.exe
      C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
      C:\Program Files\Alwil Software\Avast4\ashDisp.exe
      C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
      C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
      C:\Users\Patrick\ExtraFilm PhotoAssistant\Agent.exe
      C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
      C:\Program Files\D-Link\D-Link Wireless N DWA-140\AirNCFG.exe
      C:\Program Files\Java\jre6\bin\jusched.exe
      C:\Program Files\Windows Sidebar\sidebar.exe
      C:\Windows\ehome\ehtray.exe
      C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
      C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
      C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
      C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe
      C:\Windows\ehome\ehmsas.exe
      C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
      C:\Windows\system32\taskeng.exe
      C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
      C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
      C:\Windows\system32\conime.exe
      C:\Windows\system32\wuauclt.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\Windows\system32\DllHost.exe
      C:\Users\Patrick\Desktop\RSIT.exe
      C:\Program Files\trend micro\Patrick.exe
      C:\Windows\system32\Rundll32.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.aldi.com/
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2fwww.msn.be%2f%3f
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.aldi.com/
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
      R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
      R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
      O1 - Hosts: ::1 localhost
      O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
      O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
      O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
      O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
      O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll
      O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
      O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
      O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
      O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
      O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
      O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
      O4 - HKLM\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
      O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
      O4 - HKLM\..\Run: [toolbar_eula_launcher] C:\Program Files\GoogleEULA\EULALauncher.exe
      O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
      O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
      O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
      O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
      O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
      O4 - HKLM\..\Run: [ExtraFilmHemmaAgent] "C:\Users\Patrick\ExtraFilm PhotoAssistant\Agent.exe"
      O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
      O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
      O4 - HKLM\..\Run: [D-Link D-Link Wireless N DWA-140] C:\Program Files\D-Link\D-Link Wireless N DWA-140\AirNCFG.exe
      O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
      O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
      O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
      O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
      O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
      O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon
      O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
      O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
      O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
      O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
      O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
      O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
      O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
      O9 - Extra 'Tools' menuitem: Verz&enden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
      O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
      O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
      O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
      O13 - Gopher Prefix:
      O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
      O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://www.extrafilm.be/ImageUploader5.cab
      O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
      O16 - DPF: {A73BAEFA-EE65-494D-BEDB-DD3E5A34FA98} (Image Uploader) - http://www.extrafilm.be/ImageUploader4.cab
      O16 - DPF: {AE2B937E-EA7D-4A8D-888C-B68D7F72A3C4} (IPSUploader4 Control) - http://as.photoprintit.de/ips-opdata/74914091/activex/IPSUploader4.cab
      O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game03.zylom.com/activex/zylomgamesplayer.cab
      O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
      O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
      O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
      O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
      O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
      O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
      O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
      O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
      O23 - Service: ExtraFilm upload service (EFUploadSrv) - Textalk AB - C:\Program Files\ExtraFilm Designer BE NL\EFUploadSrv.exe
      O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktopManager.exe
      O23 - Service: Google Updateservice (gupdate1c9f35e5f7ee078) (gupdate1c9f35e5f7ee078) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
      O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
      O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
      O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
      O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
      O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
      O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
      O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
      1. Contributeur sécurité
        à première vu rien de spécial. Fais le reste et donne les caractéristiques du pc
        1. scan de chez panda (kapersky ne voulait pas se lancer...

          ;***********************************************************************************************************************************************************************************
          ANALYSIS: 2009-08-19 13:38:26
          PROTECTIONS: 4
          MALWARE: 45
          SUSPECTS: 2
          ;***********************************************************************************************************************************************************************************
          PROTECTIONS
          Description Version Active Updated
          ;===================================================================================================================================================================================
          avast! antivirus 4.8.1335 [VPS 090818-0] 4.8.1335 No Yes
          Spybot - Search and Destroy 1.0.0.6 No Yes
          Windows Defender 1.1.1505.0 No Yes
          avast! antivirus 4.8.1335 [VPS 090818-0] 4.8.1335 No Yes
          ;===================================================================================================================================================================================
          MALWARE
          Id Description Type Active Severity Disinfectable Disinfected Location
          ;===================================================================================================================================================================================
          00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Cookies\Low\patrick@trafficmp[1].txt
          00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Cookies\Low\patrick@casalemedia[1].txt
          00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Cookies\Low\patrick@doubleclick[2].txt
          00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Cookies\Low\patrick@atdmt[1].txt
          00145393 Cookie/Tradedoubler TrackingCookie No 0 Yes No C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Cookies\Low\patrick@tradedoubler[1].txt
          00145405 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Cookies\Low\patrick@247realmedia[2].txt
          00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Cookies\Low\patrick@fastclick[1].txt
          00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Cookies\Low\patrick@tribalfusion[1].txt
          00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Cookies\Low\patrick@mediaplex[1].txt
          00147036 Cookie/Adverserve TrackingCookie No 0 Yes No C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Cookies\Low\patrick@adverserve[1].txt
          00147816 Cookie/Beweb TrackingCookie No 0 Yes No C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Cookies\Low\patrick@beweb[1].txt
          00147824 Cookie/Clickbank TrackingCookie No 0 Yes No C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Cookies\Low\patrick@clickbank[2].txt
          00159564 Cookie/WUpd TrackingCookie No 0 Yes No C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Cookies\Low\patrick@revenue[2].txt
          00167704 Cookie/Xiti TrackingCookie No 0 Yes No C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Cookies\Low\patrick@xiti[1].txt
          00167704 Cookie/Xiti TrackingCookie No 0 Yes No C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Cookies\patrick@xiti[1].txt
          00167709 Cookie/fe.lea.lycos TrackingCookie No 0 Yes No C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Cookies\Low\patrick@fe.lea.lycos[1].txt
          00167747 Cookie/Azjmp TrackingCookie No 0 Yes No C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Cookies\Low\patrick@azjmp[1].txt
          00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Cookies\Low\patrick@statcounter[1].txt
          00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Cookies\Low\patrick@ad.yieldmanager[2].txt
          00168058 Cookie/Sextracker TrackingCookie No 0 Yes No C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Cookies\Low\patrick@counter4.sextracker[1].txt
          00168061 Cookie/Apmebf TrackingCookie No 0 Yes No C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Cookies\Low\patrick@apmebf[1].txt
          00168076 Cookie/BurstNet TrackingCookie No 0 Yes No C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Cookies\Low\patrick@burstnet[1].txt
          00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Cookies\Low\patrick@serving-sys[1].txt
          00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Cookies\Low\patrick@serving-sys[2].txt
          00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Cookies\Low\patrick@bs.serving-sys[2].txt
          00168106 Cookie/Weborama TrackingCookie No 0 Yes No C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Cookies\Low\patrick@weborama[1].txt
          00168109 Cookie/Adtech TrackingCookie No 0 Yes No C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Cookies\Low\patrick@adtech[1].txt
          00168114 Cookie/onestat.com TrackingCookie No 0 Yes No C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Cookies\Low\patrick@stat.onestat[2].txt
          00168116 Cookie/Comclick TrackingCookie No 0 Yes No C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Cookies\Low\patrick@fl01.ct2.comclick[1].txt
          00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Cookies\Low\patrick@advertising[1].txt
          00169286 Cookie/Sextracker TrackingCookie No 0 Yes No C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Cookies\Low\patrick@sextracker[1].txt
          00170304 Cookie/WebtrendsLive TrackingCookie No 0 Yes No C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Cookies\Low\patrick@statse.webtrendslive[2].txt
          00170554 Cookie/Overture TrackingCookie No 0 Yes No C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Cookies\Low\patrick@overture[1].txt
          00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Cookies\Low\patrick@realmedia[2].txt
          00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Cookies\Low\patrick@questionmarket[1].txt
          00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Cookies\Low\patrick@zedo[2].txt
          00172449 Cookie/MetriWeb TrackingCookie No 0 Yes No C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Cookies\Low\patrick@metriweb[2].txt
          00172449 Cookie/MetriWeb TrackingCookie No 0 Yes No C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Cookies\patrick@metriweb[1].txt
          00184846 Cookie/Adrevolver TrackingCookie No 0 Yes No C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Cookies\Low\patrick@adrevolver[2].txt
          00187950 Cookie/bravenetA TrackingCookie No 0 Yes No C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Cookies\Low\patrick@bravenet[2].txt
          00194327 Cookie/Go TrackingCookie No 0 Yes No C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Cookies\Low\patrick@go[1].txt
          00199984 Cookie/Searchportal TrackingCookie No 0 Yes No C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Cookies\Low\patrick@searchportal.information[1].txt
          00207936 Cookie/Adviva TrackingCookie No 0 Yes No C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Cookies\Low\patrick@adviva[2].txt
          00262020 Cookie/Atwola TrackingCookie No 0 Yes No C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Cookies\Low\patrick@atwola[1].txt
          00273339 Cookie/Smartadserver TrackingCookie No 0 Yes No C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Cookies\Low\patrick@smartadserver[1].txt
          00286738 Cookie/Cgi-bin TrackingCookie No 0 Yes No C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Cookies\Low\patrick@www1.addfreestats[1].txt
          00286739 Cookie/Hitbox TrackingCookie No 0 Yes No C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Cookies\Low\patrick@ehg-dig.hitbox[2].txt
          01606636 Cookie/Adserver TrackingCookie No 0 Yes No C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Cookies\Low\patrick@adserver.easyad[1].txt
          ;===================================================================================================================================================================================
          SUSPECTS
          Sent Location ��hS����9
          ;===================================================================================================================================================================================
          No C:\Users\Patrick\AppData\Local\Zylom Games\Delicious 2 Deluxe\delicious2.dll ��hS����9
          No C:\Users\Patrick\AppData\Local\Zylom Games\Rainbow Web Deluxe\rainbowweb.dll ��hS����9
          ;===================================================================================================================================================================================
          VULNERABILITIES
          Id Severity Description ��hS����9
          ;===================================================================================================================================================================================
          ;===================================================================================================================================================================================

          PC : médion
          athlon 64x2 5000+ 2,6ghz
          1go ram
          Radeon x1200

          DD sata mais je sais pas plus sur lui
          1. j'avais mis deux fois le dernier message, j'ai pas vu comment supprimer le deuxième, je l'ai donc édité :)

            si j'ai tout suivit, le PC est propre alors ?