Rapport highjackthis

Bonjour,

Me faire ceci pour un examen de ton PC.

▶ Télécharge Random's System Information Tool (RSIT).

▶ Un tutoriel est à ta disposition pour l'installer et l'utiliser correctement ici

▶ Double clique sur RSIT.exe pour lancer l'outil.

▶ Clique sur 'Continue' à l'écran Disclaimer.

▶ Si l'outil Hijackthis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera et tu devras accepter la licence.

▶ Une fois le scan fini , 2 rapports vont apparaitre. ▶ Héberge le contenu des 2 rapports.

( C:\RSIT\log.txt et C:\RSIT\info.txt )

CTRL A pour sélectionner tout, CTRL C pour copier et puis CTRL V pour coller

Petite chose à faire pour les rapports générés par RSIT avant de continuer

▶ Vous devez fusionner les deux rapports.
▶ C'est-à-dire, copier/coller le contenu du rapport info.txt à la suite du rapport log.txt dans un bloc note pour ne faire qu'un seul rapport.
▶ Ensuite enregistrer le rapport log.txt.

Ensuite :

▶ Rendez-vous à cette adresse d'hébergement gratuit : http://www.cijoint.fr/

▶ Cliquez sur parcourir, chercher le rapport log.txt puis cliquez sur ici pour déposer le fichier

▶ Une fois le lien crée, faite un clique droit dessus et copier l'adresse du lien pour venir le coller dans votre réponse

Bonsoir,

Pour bien configurer avira : Tuto de configuration en vidéo (Merci Nico)

Ensuite ceci :

Il y a des infections LOP dans ton PC.
Elles s'installent via certains programmes, dont ceux-ci :

● Le sponsor de Messenger Plus!
● Bittorent
● BitDownload
● BitGrabber
● NetPumper
● BitRoll
● TorrentQ
● Torrent101

/!\ Fais attention de ne pas faire la même erreur, donc évite ces programmes /!\

▶ Télécharger et enregistrer lopSD sur le Bureau

▶ Double-clic Lop S&D

▶ Faire l'installation

▶ Fermer toutes les applications

▶ Le lancer par un double-clic sur le raccourci qui est sur le bureau

▶ Avec VISTA => clic-droit et => Exécuter en tant qu'administrateur

▶ Taper F pour français , puis presser entrée

▶ Taper 1

▶ Presser Entrée

▶ Le PC va redémarrer

* Note : si l'antivirus annonce une infection dans TEMP , l'ignorer

▶ Attendre l'apparition du rapport

▶ Copier le rapport et le coller dans la réponse

* le rapport se trouve aussi à C:\lopR

Salut,
Je t'envoie le rapport (je vois que tu travaille jsuque tard dans la nuit). Je ne vois pas les programmes que tu m'as cités mais je crois savoir d'ou ils viennent.
Merci encore.
--------------------\\ Lop S&D 4.2.5-0 XP/Vista

Microsoft® Windows Vista™ Édition Familiale Premium ( v6.0.6002 ) Service Pack 2
X86-based PC ( Multiprocessor Free : AMD Phenom(tm) 9500 Quad-Core Processor )
BIOS : Phoenix - AwardBIOS v6.00PG
USER : max ( Not Administrator ! )
BOOT : Normal boot
C:\ (Local Disk) - NTFS - Total:228 Go (Free:3 Go)
D:\ (Local Disk) - NTFS - Total:227 Go (Free:127 Go)
E:\ (CD or DVD)
F:\ (USB)
G:\ (USB)
H:\ (USB) - FAT - Total:1963 Mo (Free:1 Go)
I:\ (USB)
K:\ (CD or DVD)
N:\ (Local Disk) - NTFS - Total:149 Go (Free:29 Go)

"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
Option : [1] ( 29/10/2009|15:10 )

[ UAC => 1 ]

--------------------\\ Listing des dossiers dans Local

[08/02/2008|18:32] C:\Users\max\AppData\Local\{7148F0A6-6813-11D6-A77B-00B0D0142050}
[01/02/2008|18:50] C:\Users\max\AppData\Local\Adobe
[08/03/2008|13:12] C:\Users\max\AppData\Local\Ahead
[17/04/2008|16:04] C:\Users\max\AppData\Local\Apple
[10/10/2009|19:30] C:\Users\max\AppData\Local\Apple Computer
[27/01/2008|21:46] C:\Users\max\AppData\Local\Application Data
[09/09/2009|16:27] C:\Users\max\AppData\Local\ApplicationHistory
[11/02/2008|11:12] C:\Users\max\AppData\Local\Apps
[27/01/2008|21:48] C:\Users\max\AppData\Local\ATI
[28/06/2009|22:10] C:\Users\max\AppData\Local\Boss Media
[27/10/2009|14:35] C:\Users\max\AppData\Local\d3d9caps.dat
[05/07/2009|20:23] C:\Users\max\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[10/02/2008|09:28] C:\Users\max\AppData\Local\eMule
[22/03/2009|23:05] C:\Users\max\AppData\Local\FullTiltPoker
[02/04/2008|15:22] C:\Users\max\AppData\Local\fusioncache.dat
[25/10/2009|22:11] C:\Users\max\AppData\Local\GDIPFONTCACHEV1.DAT
[07/06/2009|12:06] C:\Users\max\AppData\Local\Google
[27/01/2008|21:46] C:\Users\max\AppData\Local\Historique
[29/10/2009|00:57] C:\Users\max\AppData\Local\IconCache.db
[17/11/2008|00:09] C:\Users\max\AppData\Local\Microsoft
[16/03/2008|18:21] C:\Users\max\AppData\Local\Microsoft Help
[27/01/2008|23:24] C:\Users\max\AppData\Local\Mozilla
[12/02/2009|13:24] C:\Users\max\AppData\Local\Native Instruments
[17/02/2009|22:30] C:\Users\max\AppData\Local\Nero
[04/06/2009|20:59] C:\Users\max\AppData\Local\Neuf
[27/01/2008|21:47] C:\Users\max\AppData\Local\PlayMovie
[30/08/2009|12:03] C:\Users\max\AppData\Local\PokerStars
[27/01/2008|21:47] C:\Users\max\AppData\Local\PowerCinema
[02/04/2008|15:35] C:\Users\max\AppData\Local\Sony
[29/10/2009|15:10] C:\Users\max\AppData\Local\Temp
[27/01/2008|21:46] C:\Users\max\AppData\Local\Temporary Internet Files
[27/01/2008|23:24] C:\Users\max\AppData\Local\VirtualStore
[26/10/2009|23:04] C:\Users\max\AppData\Local\xobni_installer_updater.log

--------------------\\ Tâches planifiées dans C:\Windows\tasks

[29/10/2009 15:04][--a------] C:\Windows\tasks\PCConfidential.job
[29/10/2009 15:04][--a------] C:\Windows\tasks\RPCReminder.job
[29/10/2009 15:05][--a------] C:\Windows\tasks\RegPowerClean.job
[29/10/2009 14:18][--a------] C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[29/10/2009 15:04][--a------] C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[29/10/2009 14:13][--a------] C:\Windows\tasks\Google Software Updater.job
[29/12/2008 17:17][--a------] C:\Windows\tasks\yxzqrmnk.job
[29/10/2009 15:04][--a------] C:\Windows\tasks\AutoSmartDefrag.job
[22/10/2009 12:59][--a------] C:\Windows\tasks\At3.job
[22/05/2009 07:00][--a------] C:\Windows\tasks\At2.job
[22/10/2009 18:59][--a------] C:\Windows\tasks\At1.job
[29/10/2009 14:11][--ah-----] C:\Windows\tasks\SA.DAT
[29/10/2009 00:58][--a------] C:\Windows\tasks\SCHEDLGU.TXT

--------------------\\ Listing des dossiers dans C:\ProgramData

[06/05/2007|20:22] C:\ProgramData\{174892B1-CBE7-44F5-86FF-AB555EFD73A3}
[16/09/2009|12:46] C:\ProgramData\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[03/04/2009|18:26] C:\ProgramData\{7D88804A-CB1E-43FE-88E8-53F833ADBB43}
[26/08/2009|16:45] C:\ProgramData\1C338
[10/02/2008|19:30] C:\ProgramData\addr_file.html
[09/02/2008|16:42] C:\ProgramData\Adobe
[21/06/2008|12:42] C:\ProgramData\Apple
[25/11/2008|11:44] C:\ProgramData\Apple Computer
[02/11/2006|14:02] C:\ProgramData\Application Data
[13/07/2009|17:15] C:\ProgramData\ArtsAcoustic
[07/12/2007|08:43] C:\ProgramData\ATI
[27/06/2008|09:11] C:\ProgramData\Avira
[10/05/2009|21:24] C:\ProgramData\BOONTY
[28/06/2009|22:10] C:\ProgramData\Boss Media
[27/01/2008|21:42] C:\ProgramData\Bureau
[17/09/2008|14:15] C:\ProgramData\ConeXware
[27/01/2008|21:54] C:\ProgramData\CyberLink
[02/11/2006|14:02] C:\ProgramData\Desktop
[02/11/2006|14:02] C:\ProgramData\Documents
[09/03/2008|01:07] C:\ProgramData\Downloaded Installations
[10/02/2008|09:29] C:\ProgramData\eMule
[27/01/2008|21:53] C:\ProgramData\eSobi
[27/01/2008|21:42] C:\ProgramData\Favoris
[02/11/2006|14:02] C:\ProgramData\Favorites
[19/08/2008|09:27] C:\ProgramData\fssg
[30/08/2009|13:11] C:\ProgramData\Google
[28/10/2009|20:12] C:\ProgramData\Google Updater
[29/12/2008|22:37] C:\ProgramData\ICQ
[28/10/2009|20:12] C:\ProgramData\KONAMI
[18/07/2008|14:54] C:\ProgramData\Lavasoft
[08/03/2008|13:13] C:\ProgramData\LightScribe
[23/01/2009|17:47] C:\ProgramData\Malwarebytes
[27/01/2008|21:42] C:\ProgramData\Menu D‚marrer
[25/10/2009|11:32] C:\ProgramData\Microsoft
[29/10/2009|14:22] C:\ProgramData\Microsoft Help
[27/01/2008|21:42] C:\ProgramData\ModŠles
[30/08/2009|13:10] C:\ProgramData\Nero
[05/07/2009|20:21] C:\ProgramData\ntuser.pol
[10/08/2009|18:13] C:\ProgramData\ntusers.log
[07/10/2009|06:40] C:\ProgramData\Office Genuine Advantage
[19/09/2008|14:04] C:\ProgramData\Pinnacle
[29/02/2008|02:50] C:\ProgramData\QuickTime
[28/08/2009|22:05] C:\ProgramData\Spybot - Search & Destroy
[02/11/2006|14:02] C:\ProgramData\Start Menu
[27/01/2008|22:06] C:\ProgramData\Symantec
[10/08/2009|23:27] C:\ProgramData\SymplisIT
[02/05/2008|20:24] C:\ProgramData\Syncrosoft
[31/05/2008|16:21] C:\ProgramData\TEMP
[02/11/2006|14:02] C:\ProgramData\Templates
[26/10/2009|23:09] C:\ProgramData\Winferno
[08/02/2008|20:32] C:\ProgramData\WLInstaller
[12/02/2008|09:35] C:\ProgramData\Yahoo!

--------------------\\ Listing des dossiers dans C:\Program Files

[26/08/2009|22:13] C:\Program Files\8085 Simulator v 3.0.0
[31/12/2008|17:55] C:\Program Files\Ableton
[27/01/2008|21:56] C:\Program Files\Acer Arcade Live
[07/12/2007|08:38] C:\Program Files\Acer Inc
[06/05/2007|20:22] C:\Program Files\Activation Assistant for the 2007 Microsoft Office suites
[06/05/2007|20:23] C:\Program Files\Adobe
[27/06/2008|08:55] C:\Program Files\Alwil Software
[22/10/2008|19:08] C:\Program Files\Apple Software Update
[07/12/2007|08:33] C:\Program Files\ATI
[07/12/2007|08:34] C:\Program Files\ATI Technologies
[19/09/2008|16:11] C:\Program Files\Audacity 1.3 Beta (Unicode)
[13/03/2008|19:34] C:\Program Files\AviSynth 2.5
[27/01/2009|20:46] C:\Program Files\BitComet
[23/12/2008|10:50] C:\Program Files\Bonjour
[10/05/2009|21:05] C:\Program Files\BoontyGames
[10/02/2008|11:48] C:\Program Files\Canon
[11/01/2009|02:40] C:\Program Files\CasinoOnNet
[26/10/2009|23:04] C:\Program Files\Common Files
[17/06/2008|15:46] C:\Program Files\Conduit
[29/01/2008|19:31] C:\Program Files\DAEMON Tools Lite
[07/06/2009|12:03] C:\Program Files\DivX
[02/05/2008|22:43] C:\Program Files\dpp
[22/03/2008|23:10] C:\Program Files\eMule
[13/03/2008|19:33] C:\Program Files\eRightSoft
[27/01/2008|21:57] C:\Program Files\eSobi
[27/01/2008|21:42] C:\Program Files\Fichiers communs [C:\Program Files\Common Files]
[22/03/2008|10:45] C:\Program Files\FLV Player
[27/10/2009|10:26] C:\Program Files\Free Offers from Freeze.com
[30/08/2009|13:12] C:\Program Files\Full Tilt Poker
[27/01/2008|22:16] C:\Program Files\Glary Utilities
[30/08/2009|13:11] C:\Program Files\Google
[10/02/2008|12:40] C:\Program Files\Guitar Pro 5
[29/12/2008|22:37] C:\Program Files\ICQ6Toolbar
[26/08/2009|16:45] C:\Program Files\iMeshMediabarTb
[30/08/2009|13:12] C:\Program Files\InstallShield Installation Information
[10/08/2009|18:13] C:\Program Files\Intel
[18/05/2008|15:06] C:\Program Files\InterActual
[28/10/2009|22:11] C:\Program Files\Internet Explorer
[11/05/2008|10:19] C:\Program Files\IObit
[16/09/2009|12:45] C:\Program Files\iPod
[03/10/2008|07:37] C:\Program Files\IsoBuster
[16/09/2009|12:46] C:\Program Files\iTunes
[13/09/2009|09:42] C:\Program Files\Java
[09/02/2008|17:35] C:\Program Files\K-Lite Codec Pack
[28/10/2009|20:12] C:\Program Files\KONAMI
[18/07/2008|14:54] C:\Program Files\Lavasoft
[11/02/2008|10:29] C:\Program Files\Le Robert
[17/08/2009|14:25] C:\Program Files\Malwarebytes' Anti-Malware
[08/02/2008|22:03] C:\Program Files\Microsoft CAPICOM 2.1.0.2
[02/11/2006|13:37] C:\Program Files\Microsoft Games
[25/10/2009|11:32] C:\Program Files\Microsoft Office
[25/10/2009|11:13] C:\Program Files\Microsoft Office2
[09/09/2009|16:12] C:\Program Files\Microsoft Silverlight
[02/04/2008|15:29] C:\Program Files\Microsoft SQL Server
[19/02/2008|10:10] C:\Program Files\Microsoft Visual Studio
[17/10/2009|08:37] C:\Program Files\Microsoft Works
[19/02/2008|10:09] C:\Program Files\Microsoft.NET
[26/09/2009|10:29] C:\Program Files\Movie Maker
[26/10/2009|23:14] C:\Program Files\Mozilla Firefox
[25/10/2009|11:32] C:\Program Files\MSBuild
[08/02/2008|21:56] C:\Program Files\MSXML 4.0
[31/08/2009|16:39] C:\Program Files\Native Instruments
[28/08/2008|21:56] C:\Program Files\Navilog1
[30/08/2009|13:01] C:\Program Files\Nero
[14/01/2009|23:03] C:\Program Files\Neuf
[06/05/2007|20:18] C:\Program Files\NewTech Infosystems
[18/07/2008|12:53] C:\Program Files\Panda Security
[06/10/2008|23:07] C:\Program Files\Pinnacle
[26/10/2009|23:05] C:\Program Files\Playalot Games
[30/08/2009|12:50] C:\Program Files\PokerStars
[07/02/2009|22:32] C:\Program Files\PowerArchiver
[10/02/2008|13:00] C:\Program Files\PowerTracks DirectX Plugins
[23/11/2008|18:06] C:\Program Files\Pro Evolution Soccer 2008
[20/05/2008|00:42] C:\Program Files\PSP VintageWarmer
[16/09/2009|12:44] C:\Program Files\QuickTime
[27/01/2008|23:37] C:\Program Files\RALINK
[10/02/2008|16:22] C:\Program Files\Real
[07/12/2007|08:32] C:\Program Files\Realtek
[04/08/2009|21:26] C:\Program Files\REAPER
[02/11/2006|13:37] C:\Program Files\Reference Assemblies
[04/06/2009|20:58] C:\Program Files\SFR
[11/02/2008|17:09] C:\Program Files\Smart HDD
[24/09/2008|00:00] C:\Program Files\Smart Projects
[26/10/2009|23:02] C:\Program Files\Smart-Shopper
[04/05/2008|11:47] C:\Program Files\Sony
[02/04/2008|15:31] C:\Program Files\Sony Setup
[18/02/2009|18:20] C:\Program Files\Spectrasonics
[23/01/2009|19:09] C:\Program Files\Spybot - Search & Destroy
[08/02/2009|18:11] C:\Program Files\Steinberg
[24/08/2008|15:53] C:\Program Files\Sun
[10/08/2009|23:27] C:\Program Files\SymplisIT
[02/12/2008|12:14] C:\Program Files\Syncrosoft
[28/10/2009|16:47] C:\Program Files\Trend Micro
[10/05/2009|21:13] C:\Program Files\Ubisoft
[13/07/2009|17:15] C:\Program Files\Uninstall Information
[08/02/2008|18:23] C:\Program Files\Universalis
[16/09/2009|12:47] C:\Program Files\Utilitaire de configuration iPhone
[15/08/2009|12:37] C:\Program Files\Vstplugins
[27/01/2008|22:19] C:\Program Files\Webteh
[27/01/2008|22:18] C:\Program Files\Winamp
[26/09/2009|10:29] C:\Program Files\Windows Calendar
[26/09/2009|10:29] C:\Program Files\Windows Collaboration
[26/09/2009|10:29] C:\Program Files\Windows Defender
[26/09/2009|10:29] C:\Program Files\Windows Journal
[08/02/2008|20:37] C:\Program Files\Windows Live
[17/10/2009|09:57] C:\Program Files\Windows Mail
[28/10/2009|22:08] C:\Program Files\Windows Media Player
[27/01/2008|21:42] C:\Program Files\Windows NT
[26/09/2009|10:29] C:\Program Files\Windows Photo Gallery
[26/09/2009|10:29] C:\Program Files\Windows Sidebar
[26/10/2009|23:04] C:\Program Files\Winferno
[10/02/2008|10:18] C:\Program Files\WinRAR
[15/04/2008|16:47] C:\Program Files\Xvid
[24/08/2009|20:13] C:\Program Files\Yahoo!

--------------------\\ Listing des dossiers dans C:\Program Files\Common Files

[09/02/2008|16:42] C:\Program Files\Common Files\Adobe
[16/09/2009|12:45] C:\Program Files\Common Files\Apple
[19/02/2008|10:10] C:\Program Files\Common Files\DESIGNER
[01/05/2008|20:16] C:\Program Files\Common Files\Digidesign
[07/06/2009|12:03] C:\Program Files\Common Files\DivX Shared
[06/05/2007|20:30] C:\Program Files\Common Files\InstallShield
[08/02/2008|18:33] C:\Program Files\Common Files\Java
[06/05/2007|20:17] C:\Program Files\Common Files\LightScribe
[25/10/2009|11:32] C:\Program Files\Common Files\microsoft shared
[06/05/2007|20:17] C:\Program Files\Common Files\muvee Technologies
[31/08/2009|16:40] C:\Program Files\Common Files\Native Instruments
[30/08/2009|13:11] C:\Program Files\Common Files\Nero
[06/05/2007|20:18] C:\Program Files\Common Files\NewTech Infosystems
[15/03/2008|17:36] C:\Program Files\Common Files\PX Storage Engine
[10/02/2008|16:22] C:\Program Files\Common Files\Real
[27/06/2008|08:23] C:\Program Files\Common Files\Scanner
[02/11/2006|12:18] C:\Program Files\Common Files\Services
[02/11/2006|12:18] C:\Program Files\Common Files\SpeechEngines
[27/01/2008|22:07] C:\Program Files\Common Files\Symantec Shared
[29/10/2009|14:17] C:\Program Files\Common Files\System
[08/02/2008|20:37] C:\Program Files\Common Files\WindowsLiveInstaller
[26/10/2009|23:04] C:\Program Files\Common Files\Winferno
[10/02/2008|16:22] C:\Program Files\Common Files\xing shared

--------------------\\ Process

( 62 Processes )

iexplore.exe ~ [PID:2704]
iexplore.exe ~ [PID:5272]

--------------------\\ Recherche avec S_Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Recherche de Fichiers / Dossiers Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Verification du Registre

..... OK !

--------------------\\ Verification du fichier Hosts

Fichier Hosts PROPRE

--------------------\\ Recherche de fichiers avec Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-29 15:10:55
Windows 5.1.2600 Service Pack 2 NTFS
detected NTDLL code modification:
ZwEnumerateKey, ZwQueryKey, ZwOpenKey, ZwClose, ZwEnumerateValueKey, ZwQueryValueKey, ZwOpenFile, ZwQueryDirectoryFile, ZwQuerySystemInformation
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 704

--------------------\\ Recherche d'autres infections

C:\Windows\Tasks\At1.job
C:\Windows\Tasks\At2.job
C:\Windows\Tasks\At3.job

--------------------\\ Cracks & Keygens ..

C:\Users\max\AppData\Local\VirtualStore\Program Files\BitComet\Downloads\Spyware.Doctor.5xx AIO [www.canucrackit.tk].rar.bc!
C:\Users\max\AppData\Local\VirtualStore\Program Files\Native Instruments\Guitar Combos\AC Box Combo\Library\Presets\Audio Effects\Vinyl Distortion\Crack.adv
C:\Users\max\Desktop\MUSIQUE PROG\Library\Presets\Audio Effects\Vinyl Distortion\Crack.adv
C:\Users\max\Desktop\MUSIQUE PROG\My Sample Collection\Nu Jazz\Library-0\Presets\Audio Effects\Vinyl Distortion\Crack.adv
C:\Users\max\Favorites\Native Instruments Guitar Rig V3 0 And Crack[TCRG] Torrent.url

[F:71][D:55]-> C:\Users\max\AppData\Local\Temp
[F:52][D:1]-> C:\Users\max\AppData\Roaming\MICROS~1\Windows\Cookies
[F:227][D:7]-> C:\Users\max\AppData\Local\MICROS~1\Windows\TEMPOR~1\content.IE5
[F:54][D:3]-> C:\$Recycle.Bin

1 - "C:\Lop SD\LopR_1.txt" - 29/10/2009|15:13 - Option : [1]

--------------------\\ Fin du rapport a 15:13:07
[ UAC => 1 ]

Salut,
Je t'envoie le rapport (je vois que tu travaille jsuque tard dans la nuit). Je ne vois pas les programmes que tu m'as cités mais je crois savoir d'ou ils viennent.
Merci encore.
--------------------\\ Lop S&D 4.2.5-0 XP/Vista

Microsoft® Windows Vista™ Édition Familiale Premium ( v6.0.6002 ) Service Pack 2
X86-based PC ( Multiprocessor Free : AMD Phenom(tm) 9500 Quad-Core Processor )
BIOS : Phoenix - AwardBIOS v6.00PG
USER : max ( Not Administrator ! )
BOOT : Normal boot
C:\ (Local Disk) - NTFS - Total:228 Go (Free:3 Go)
D:\ (Local Disk) - NTFS - Total:227 Go (Free:127 Go)
E:\ (CD or DVD)
F:\ (USB)
G:\ (USB)
H:\ (USB) - FAT - Total:1963 Mo (Free:1 Go)
I:\ (USB)
K:\ (CD or DVD)
N:\ (Local Disk) - NTFS - Total:149 Go (Free:29 Go)

"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
Option : [1] ( 29/10/2009|15:10 )

[ UAC => 1 ]

--------------------\\ Listing des dossiers dans Local

[08/02/2008|18:32] C:\Users\max\AppData\Local\{7148F0A6-6813-11D6-A77B-00B0D0142050}
[01/02/2008|18:50] C:\Users\max\AppData\Local\Adobe
[08/03/2008|13:12] C:\Users\max\AppData\Local\Ahead
[17/04/2008|16:04] C:\Users\max\AppData\Local\Apple
[10/10/2009|19:30] C:\Users\max\AppData\Local\Apple Computer
[27/01/2008|21:46] C:\Users\max\AppData\Local\Application Data
[09/09/2009|16:27] C:\Users\max\AppData\Local\ApplicationHistory
[11/02/2008|11:12] C:\Users\max\AppData\Local\Apps
[27/01/2008|21:48] C:\Users\max\AppData\Local\ATI
[28/06/2009|22:10] C:\Users\max\AppData\Local\Boss Media
[27/10/2009|14:35] C:\Users\max\AppData\Local\d3d9caps.dat
[05/07/2009|20:23] C:\Users\max\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[10/02/2008|09:28] C:\Users\max\AppData\Local\eMule
[22/03/2009|23:05] C:\Users\max\AppData\Local\FullTiltPoker
[02/04/2008|15:22] C:\Users\max\AppData\Local\fusioncache.dat
[25/10/2009|22:11] C:\Users\max\AppData\Local\GDIPFONTCACHEV1.DAT
[07/06/2009|12:06] C:\Users\max\AppData\Local\Google
[27/01/2008|21:46] C:\Users\max\AppData\Local\Historique
[29/10/2009|00:57] C:\Users\max\AppData\Local\IconCache.db
[17/11/2008|00:09] C:\Users\max\AppData\Local\Microsoft
[16/03/2008|18:21] C:\Users\max\AppData\Local\Microsoft Help
[27/01/2008|23:24] C:\Users\max\AppData\Local\Mozilla
[12/02/2009|13:24] C:\Users\max\AppData\Local\Native Instruments
[17/02/2009|22:30] C:\Users\max\AppData\Local\Nero
[04/06/2009|20:59] C:\Users\max\AppData\Local\Neuf
[27/01/2008|21:47] C:\Users\max\AppData\Local\PlayMovie
[30/08/2009|12:03] C:\Users\max\AppData\Local\PokerStars
[27/01/2008|21:47] C:\Users\max\AppData\Local\PowerCinema
[02/04/2008|15:35] C:\Users\max\AppData\Local\Sony
[29/10/2009|15:10] C:\Users\max\AppData\Local\Temp
[27/01/2008|21:46] C:\Users\max\AppData\Local\Temporary Internet Files
[27/01/2008|23:24] C:\Users\max\AppData\Local\VirtualStore
[26/10/2009|23:04] C:\Users\max\AppData\Local\xobni_installer_updater.log

--------------------\\ Tâches planifiées dans C:\Windows\tasks

[29/10/2009 15:04][--a------] C:\Windows\tasks\PCConfidential.job
[29/10/2009 15:04][--a------] C:\Windows\tasks\RPCReminder.job
[29/10/2009 15:05][--a------] C:\Windows\tasks\RegPowerClean.job
[29/10/2009 14:18][--a------] C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[29/10/2009 15:04][--a------] C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[29/10/2009 14:13][--a------] C:\Windows\tasks\Google Software Updater.job
[29/12/2008 17:17][--a------] C:\Windows\tasks\yxzqrmnk.job
[29/10/2009 15:04][--a------] C:\Windows\tasks\AutoSmartDefrag.job
[22/10/2009 12:59][--a------] C:\Windows\tasks\At3.job
[22/05/2009 07:00][--a------] C:\Windows\tasks\At2.job
[22/10/2009 18:59][--a------] C:\Windows\tasks\At1.job
[29/10/2009 14:11][--ah-----] C:\Windows\tasks\SA.DAT
[29/10/2009 00:58][--a------] C:\Windows\tasks\SCHEDLGU.TXT

--------------------\\ Listing des dossiers dans C:\ProgramData

[06/05/2007|20:22] C:\ProgramData\{174892B1-CBE7-44F5-86FF-AB555EFD73A3}
[16/09/2009|12:46] C:\ProgramData\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[03/04/2009|18:26] C:\ProgramData\{7D88804A-CB1E-43FE-88E8-53F833ADBB43}
[26/08/2009|16:45] C:\ProgramData\1C338
[10/02/2008|19:30] C:\ProgramData\addr_file.html
[09/02/2008|16:42] C:\ProgramData\Adobe
[21/06/2008|12:42] C:\ProgramData\Apple
[25/11/2008|11:44] C:\ProgramData\Apple Computer
[02/11/2006|14:02] C:\ProgramData\Application Data
[13/07/2009|17:15] C:\ProgramData\ArtsAcoustic
[07/12/2007|08:43] C:\ProgramData\ATI
[27/06/2008|09:11] C:\ProgramData\Avira
[10/05/2009|21:24] C:\ProgramData\BOONTY
[28/06/2009|22:10] C:\ProgramData\Boss Media
[27/01/2008|21:42] C:\ProgramData\Bureau
[17/09/2008|14:15] C:\ProgramData\ConeXware
[27/01/2008|21:54] C:\ProgramData\CyberLink
[02/11/2006|14:02] C:\ProgramData\Desktop
[02/11/2006|14:02] C:\ProgramData\Documents
[09/03/2008|01:07] C:\ProgramData\Downloaded Installations
[10/02/2008|09:29] C:\ProgramData\eMule
[27/01/2008|21:53] C:\ProgramData\eSobi
[27/01/2008|21:42] C:\ProgramData\Favoris
[02/11/2006|14:02] C:\ProgramData\Favorites
[19/08/2008|09:27] C:\ProgramData\fssg
[30/08/2009|13:11] C:\ProgramData\Google
[28/10/2009|20:12] C:\ProgramData\Google Updater
[29/12/2008|22:37] C:\ProgramData\ICQ
[28/10/2009|20:12] C:\ProgramData\KONAMI
[18/07/2008|14:54] C:\ProgramData\Lavasoft
[08/03/2008|13:13] C:\ProgramData\LightScribe
[23/01/2009|17:47] C:\ProgramData\Malwarebytes
[27/01/2008|21:42] C:\ProgramData\Menu D‚marrer
[25/10/2009|11:32] C:\ProgramData\Microsoft
[29/10/2009|14:22] C:\ProgramData\Microsoft Help
[27/01/2008|21:42] C:\ProgramData\ModŠles
[30/08/2009|13:10] C:\ProgramData\Nero
[05/07/2009|20:21] C:\ProgramData\ntuser.pol
[10/08/2009|18:13] C:\ProgramData\ntusers.log
[07/10/2009|06:40] C:\ProgramData\Office Genuine Advantage
[19/09/2008|14:04] C:\ProgramData\Pinnacle
[29/02/2008|02:50] C:\ProgramData\QuickTime
[28/08/2009|22:05] C:\ProgramData\Spybot - Search & Destroy
[02/11/2006|14:02] C:\ProgramData\Start Menu
[27/01/2008|22:06] C:\ProgramData\Symantec
[10/08/2009|23:27] C:\ProgramData\SymplisIT
[02/05/2008|20:24] C:\ProgramData\Syncrosoft
[31/05/2008|16:21] C:\ProgramData\TEMP
[02/11/2006|14:02] C:\ProgramData\Templates
[26/10/2009|23:09] C:\ProgramData\Winferno
[08/02/2008|20:32] C:\ProgramData\WLInstaller
[12/02/2008|09:35] C:\ProgramData\Yahoo!

--------------------\\ Listing des dossiers dans C:\Program Files

[26/08/2009|22:13] C:\Program Files\8085 Simulator v 3.0.0
[31/12/2008|17:55] C:\Program Files\Ableton
[27/01/2008|21:56] C:\Program Files\Acer Arcade Live
[07/12/2007|08:38] C:\Program Files\Acer Inc
[06/05/2007|20:22] C:\Program Files\Activation Assistant for the 2007 Microsoft Office suites
[06/05/2007|20:23] C:\Program Files\Adobe
[27/06/2008|08:55] C:\Program Files\Alwil Software
[22/10/2008|19:08] C:\Program Files\Apple Software Update
[07/12/2007|08:33] C:\Program Files\ATI
[07/12/2007|08:34] C:\Program Files\ATI Technologies
[19/09/2008|16:11] C:\Program Files\Audacity 1.3 Beta (Unicode)
[13/03/2008|19:34] C:\Program Files\AviSynth 2.5
[27/01/2009|20:46] C:\Program Files\BitComet
[23/12/2008|10:50] C:\Program Files\Bonjour
[10/05/2009|21:05] C:\Program Files\BoontyGames
[10/02/2008|11:48] C:\Program Files\Canon
[11/01/2009|02:40] C:\Program Files\CasinoOnNet
[26/10/2009|23:04] C:\Program Files\Common Files
[17/06/2008|15:46] C:\Program Files\Conduit
[29/01/2008|19:31] C:\Program Files\DAEMON Tools Lite
[07/06/2009|12:03] C:\Program Files\DivX
[02/05/2008|22:43] C:\Program Files\dpp
[22/03/2008|23:10] C:\Program Files\eMule
[13/03/2008|19:33] C:\Program Files\eRightSoft
[27/01/2008|21:57] C:\Program Files\eSobi
[27/01/2008|21:42] C:\Program Files\Fichiers communs [C:\Program Files\Common Files]
[22/03/2008|10:45] C:\Program Files\FLV Player
[27/10/2009|10:26] C:\Program Files\Free Offers from Freeze.com
[30/08/2009|13:12] C:\Program Files\Full Tilt Poker
[27/01/2008|22:16] C:\Program Files\Glary Utilities
[30/08/2009|13:11] C:\Program Files\Google
[10/02/2008|12:40] C:\Program Files\Guitar Pro 5
[29/12/2008|22:37] C:\Program Files\ICQ6Toolbar
[26/08/2009|16:45] C:\Program Files\iMeshMediabarTb
[30/08/2009|13:12] C:\Program Files\InstallShield Installation Information
[10/08/2009|18:13] C:\Program Files\Intel
[18/05/2008|15:06] C:\Program Files\InterActual
[28/10/2009|22:11] C:\Program Files\Internet Explorer
[11/05/2008|10:19] C:\Program Files\IObit
[16/09/2009|12:45] C:\Program Files\iPod
[03/10/2008|07:37] C:\Program Files\IsoBuster
[16/09/2009|12:46] C:\Program Files\iTunes
[13/09/2009|09:42] C:\Program Files\Java
[09/02/2008|17:35] C:\Program Files\K-Lite Codec Pack
[28/10/2009|20:12] C:\Program Files\KONAMI
[18/07/2008|14:54] C:\Program Files\Lavasoft
[11/02/2008|10:29] C:\Program Files\Le Robert
[17/08/2009|14:25] C:\Program Files\Malwarebytes' Anti-Malware
[08/02/2008|22:03] C:\Program Files\Microsoft CAPICOM 2.1.0.2
[02/11/2006|13:37] C:\Program Files\Microsoft Games
[25/10/2009|11:32] C:\Program Files\Microsoft Office
[25/10/2009|11:13] C:\Program Files\Microsoft Office2
[09/09/2009|16:12] C:\Program Files\Microsoft Silverlight
[02/04/2008|15:29] C:\Program Files\Microsoft SQL Server
[19/02/2008|10:10] C:\Program Files\Microsoft Visual Studio
[17/10/2009|08:37] C:\Program Files\Microsoft Works
[19/02/2008|10:09] C:\Program Files\Microsoft.NET
[26/09/2009|10:29] C:\Program Files\Movie Maker
[26/10/2009|23:14] C:\Program Files\Mozilla Firefox
[25/10/2009|11:32] C:\Program Files\MSBuild
[08/02/2008|21:56] C:\Program Files\MSXML 4.0
[31/08/2009|16:39] C:\Program Files\Native Instruments
[28/08/2008|21:56] C:\Program Files\Navilog1
[30/08/2009|13:01] C:\Program Files\Nero
[14/01/2009|23:03] C:\Program Files\Neuf
[06/05/2007|20:18] C:\Program Files\NewTech Infosystems
[18/07/2008|12:53] C:\Program Files\Panda Security
[06/10/2008|23:07] C:\Program Files\Pinnacle
[26/10/2009|23:05] C:\Program Files\Playalot Games
[30/08/2009|12:50] C:\Program Files\PokerStars
[07/02/2009|22:32] C:\Program Files\PowerArchiver
[10/02/2008|13:00] C:\Program Files\PowerTracks DirectX Plugins
[23/11/2008|18:06] C:\Program Files\Pro Evolution Soccer 2008
[20/05/2008|00:42] C:\Program Files\PSP VintageWarmer
[16/09/2009|12:44] C:\Program Files\QuickTime
[27/01/2008|23:37] C:\Program Files\RALINK
[10/02/2008|16:22] C:\Program Files\Real
[07/12/2007|08:32] C:\Program Files\Realtek
[04/08/2009|21:26] C:\Program Files\REAPER
[02/11/2006|13:37] C:\Program Files\Reference Assemblies
[04/06/2009|20:58] C:\Program Files\SFR
[11/02/2008|17:09] C:\Program Files\Smart HDD
[24/09/2008|00:00] C:\Program Files\Smart Projects
[26/10/2009|23:02] C:\Program Files\Smart-Shopper
[04/05/2008|11:47] C:\Program Files\Sony
[02/04/2008|15:31] C:\Program Files\Sony Setup
[18/02/2009|18:20] C:\Program Files\Spectrasonics
[23/01/2009|19:09] C:\Program Files\Spybot - Search & Destroy
[08/02/2009|18:11] C:\Program Files\Steinberg
[24/08/2008|15:53] C:\Program Files\Sun
[10/08/2009|23:27] C:\Program Files\SymplisIT
[02/12/2008|12:14] C:\Program Files\Syncrosoft
[28/10/2009|16:47] C:\Program Files\Trend Micro
[10/05/2009|21:13] C:\Program Files\Ubisoft
[13/07/2009|17:15] C:\Program Files\Uninstall Information
[08/02/2008|18:23] C:\Program Files\Universalis
[16/09/2009|12:47] C:\Program Files\Utilitaire de configuration iPhone
[15/08/2009|12:37] C:\Program Files\Vstplugins
[27/01/2008|22:19] C:\Program Files\Webteh
[27/01/2008|22:18] C:\Program Files\Winamp
[26/09/2009|10:29] C:\Program Files\Windows Calendar
[26/09/2009|10:29] C:\Program Files\Windows Collaboration
[26/09/2009|10:29] C:\Program Files\Windows Defender
[26/09/2009|10:29] C:\Program Files\Windows Journal
[08/02/2008|20:37] C:\Program Files\Windows Live
[17/10/2009|09:57] C:\Program Files\Windows Mail
[28/10/2009|22:08] C:\Program Files\Windows Media Player
[27/01/2008|21:42] C:\Program Files\Windows NT
[26/09/2009|10:29] C:\Program Files\Windows Photo Gallery
[26/09/2009|10:29] C:\Program Files\Windows Sidebar
[26/10/2009|23:04] C:\Program Files\Winferno
[10/02/2008|10:18] C:\Program Files\WinRAR
[15/04/2008|16:47] C:\Program Files\Xvid
[24/08/2009|20:13] C:\Program Files\Yahoo!

--------------------\\ Listing des dossiers dans C:\Program Files\Common Files

[09/02/2008|16:42] C:\Program Files\Common Files\Adobe
[16/09/2009|12:45] C:\Program Files\Common Files\Apple
[19/02/2008|10:10] C:\Program Files\Common Files\DESIGNER
[01/05/2008|20:16] C:\Program Files\Common Files\Digidesign
[07/06/2009|12:03] C:\Program Files\Common Files\DivX Shared
[06/05/2007|20:30] C:\Program Files\Common Files\InstallShield
[08/02/2008|18:33] C:\Program Files\Common Files\Java
[06/05/2007|20:17] C:\Program Files\Common Files\LightScribe
[25/10/2009|11:32] C:\Program Files\Common Files\microsoft shared
[06/05/2007|20:17] C:\Program Files\Common Files\muvee Technologies
[31/08/2009|16:40] C:\Program Files\Common Files\Native Instruments
[30/08/2009|13:11] C:\Program Files\Common Files\Nero
[06/05/2007|20:18] C:\Program Files\Common Files\NewTech Infosystems
[15/03/2008|17:36] C:\Program Files\Common Files\PX Storage Engine
[10/02/2008|16:22] C:\Program Files\Common Files\Real
[27/06/2008|08:23] C:\Program Files\Common Files\Scanner
[02/11/2006|12:18] C:\Program Files\Common Files\Services
[02/11/2006|12:18] C:\Program Files\Common Files\SpeechEngines
[27/01/2008|22:07] C:\Program Files\Common Files\Symantec Shared
[29/10/2009|14:17] C:\Program Files\Common Files\System
[08/02/2008|20:37] C:\Program Files\Common Files\WindowsLiveInstaller
[26/10/2009|23:04] C:\Program Files\Common Files\Winferno
[10/02/2008|16:22] C:\Program Files\Common Files\xing shared

--------------------\\ Process

( 62 Processes )

iexplore.exe ~ [PID:2704]
iexplore.exe ~ [PID:5272]

--------------------\\ Recherche avec S_Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Recherche de Fichiers / Dossiers Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Verification du Registre

..... OK !

--------------------\\ Verification du fichier Hosts

Fichier Hosts PROPRE

--------------------\\ Recherche de fichiers avec Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-29 15:10:55
Windows 5.1.2600 Service Pack 2 NTFS
detected NTDLL code modification:
ZwEnumerateKey, ZwQueryKey, ZwOpenKey, ZwClose, ZwEnumerateValueKey, ZwQueryValueKey, ZwOpenFile, ZwQueryDirectoryFile, ZwQuerySystemInformation
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 704

--------------------\\ Recherche d'autres infections

C:\Windows\Tasks\At1.job
C:\Windows\Tasks\At2.job
C:\Windows\Tasks\At3.job

--------------------\\ Cracks & Keygens ..

C:\Users\max\AppData\Local\VirtualStore\Program Files\BitComet\Downloads\Spyware.Doctor.5xx AIO [www.canucrackit.tk].rar.bc!
C:\Users\max\AppData\Local\VirtualStore\Program Files\Native Instruments\Guitar Combos\AC Box Combo\Library\Presets\Audio Effects\Vinyl Distortion\Crack.adv
C:\Users\max\Desktop\MUSIQUE PROG\Library\Presets\Audio Effects\Vinyl Distortion\Crack.adv
C:\Users\max\Desktop\MUSIQUE PROG\My Sample Collection\Nu Jazz\Library-0\Presets\Audio Effects\Vinyl Distortion\Crack.adv
C:\Users\max\Favorites\Native Instruments Guitar Rig V3 0 And Crack[TCRG] Torrent.url

[F:71][D:55]-> C:\Users\max\AppData\Local\Temp
[F:52][D:1]-> C:\Users\max\AppData\Roaming\MICROS~1\Windows\Cookies
[F:227][D:7]-> C:\Users\max\AppData\Local\MICROS~1\Windows\TEMPOR~1\content.IE5
[F:54][D:3]-> C:\$Recycle.Bin

1 - "C:\Lop SD\LopR_1.txt" - 29/10/2009|15:13 - Option : [1]

--------------------\\ Fin du rapport a 15:13:07
[ UAC => 1 ]

A supprimer :

C:\Users\max\AppData\Local\VirtualStore\Program Files\BitComet\Downloads\Spyware.Doctor.5xx AIO [www.canucrackit.tk].rar.bc!
C:\Users\max\AppData\Local\VirtualStore\Program Files\Native Instruments\Guitar Combos\AC Box Combo\Library\Presets\Audio Effects\Vinyl Distortion\Crack.adv
C:\Users\max\Desktop\MUSIQUE PROG\Library\Presets\Audio Effects\Vinyl Distortion\Crack.adv
C:\Users\max\Desktop\MUSIQUE PROG\My Sample Collection\Nu Jazz\Library-0\Presets\Audio Effects\Vinyl Distortion\Crack.adv
C:\Users\max\Favorites\Native Instruments Guitar Rig V3 0 And Crack[TCRG] Torrent.url

ensuite :

Sous Vista : ▶ Désactive le contrôle des comptes utilisateurs (tu le réactiveras après ta désinfection):

▶ Clique sur Démarrer puis sur panneau de configuration
▶ Double Clique sur l'icône "Comptes d'utilisateurs"
▶ Clique ensuite sur désactiver et valide.
▶ Redémarre le PC.

Option 1 - Recherche :

▶ télécharge smitfraudfix et enregistre le sur le bureau

▶ Sous XP : Double clique sur smitfraudfix puis exécuter

▶ sous vista : Clic-droit sur SmitfraudFix présent sur le bureau et choisis "Exécuter en tant qu'administrateur"

▶ Sélectionner 1 pour créer un rapport des fichiers responsables de l'infection.

(attention : N utilises pas l option 2 si je ne te l ai pas demandé !!)

▶ copier/coller le rapport dans la réponse.

Voici un tutoriel sonore et animé en cas de problème d'utilisation

(Attention : "process.exe", un composant de l'outil, est détecté par certains antivirus comme étant un "RiskTool".
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. Mis entre de mauvaises mains,
cet utilitaire pourrait arrêter des logiciels de sécurité.)

RE
Voici le rapport smitfraudfix
SmitFraudFix v2.424

Scan done at 20:03:13,01, 29/10/2009
Run from C:\Users\max\Desktop\SmitfraudFix
OS: Microsoft Windows [version 6.0.6002] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Le Robert\Le Petit Robert\PRHYPER.EXE
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Native Instruments\Audio Kontrol 1\Audio Kontrol 1.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\RALINK\RT2500 USB Wireless LAN Card\Installer\WIN2K\RaConfig2500.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10c.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SndVol.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\conime.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\wbem\wmiprvse.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows

C:\Windows\Tasks\At?.job FOUND !
C:\Windows\Tasks\At??.job FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32

»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32\LogFiles

»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\max

»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\max\AppData\Local\Temp

»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\max\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Start Menu

»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\max\FAVORI~1

»»»»»»»»»»»»»»»»»»»»»»»» Desktop

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys

»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, following keys are not inevitably infected!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix
!!!Attention, following keys are not inevitably infected!!!

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, following keys are not inevitably infected!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""
"LoadAppInit_DLLs"=dword:00000000

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\Windows\\system32\\userinit.exe,"

»»»»»»»»»»»»»»»»»»»»»»»» RK

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]

»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Marvell Yukon 88E8056 PCI-E Gigabit Ethernet Controller
DNS Server Search Order: 192.168.1.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{130B8CB1-F13A-4CC3-8BF5-7FE7473752B1}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{130B8CB1-F13A-4CC3-8BF5-7FE7473752B1}: NameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{5CC353A2-3C1D-4702-A7C9-085525EEDF90}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{AFAD59BE-C41A-45AB-89FC-DFDF4AA02322}: DhcpNameServer=84.103.237.145 86.64.145.145
HKLM\SYSTEM\CS1\Services\Tcpip\..\{130B8CB1-F13A-4CC3-8BF5-7FE7473752B1}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{130B8CB1-F13A-4CC3-8BF5-7FE7473752B1}: NameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{5CC353A2-3C1D-4702-A7C9-085525EEDF90}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{AFAD59BE-C41A-45AB-89FC-DFDF4AA02322}: DhcpNameServer=84.103.237.145 86.64.145.145
HKLM\SYSTEM\CS3\Services\Tcpip\..\{130B8CB1-F13A-4CC3-8BF5-7FE7473752B1}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{130B8CB1-F13A-4CC3-8BF5-7FE7473752B1}: NameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{5CC353A2-3C1D-4702-A7C9-085525EEDF90}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{AFAD59BE-C41A-45AB-89FC-DFDF4AA02322}: DhcpNameServer=84.103.237.145 86.64.145.145
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1

»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection

»»»»»»»»»»»»»»»»»»»»»»»» End

Option 2 - Nettoyage :

▶ Redémarre le PC en mode sans échec

▶ Relance smitfraudfix

▶ Sélectionner 2 pour supprimer les fichiers responsables de l'infection.

▶ A la question Voulez-vous nettoyer le registre ? répondre O (oui) afin de débloquer le fond d'écran et supprimer les clés de démarrage automatique de l'infection.

Le fix déterminera si le fichier wininet.dll est infecté. A la question Corriger le fichier infecté ? répondre O (oui) pour remplacer le fichier corrompu.

▶ Enregistre le rapport sur ton bureau

▶ Redémarrer en mode normal et poster le rapport.

Salut,
Voici le rapport après nettoyage.
A noter ( c'est peut être normal a ce stade des opérations) que le probleme persiste et que dans l'onglet outils de mon navigateur apparait toujours cette saloperie nommée PC Confidential.
Merci .

SmitFraudFix v2.424

Scan done at 8:01:00,85, 30/10/2009
Run from C:\Users\max\Desktop\SmitfraudFix
OS: Microsoft Windows [version 6.0.6002] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process

»»»»»»»»»»»»»»»»»»»»»»»» hosts

127.0.0.1 localhost
::1 localhost
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
...

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

C:\Windows\Tasks\At?.job Deleted

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» 404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» RK

»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{130B8CB1-F13A-4CC3-8BF5-7FE7473752B1}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{130B8CB1-F13A-4CC3-8BF5-7FE7473752B1}: NameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{5CC353A2-3C1D-4702-A7C9-085525EEDF90}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{AFAD59BE-C41A-45AB-89FC-DFDF4AA02322}: DhcpNameServer=84.103.237.145 86.64.145.145
HKLM\SYSTEM\CS1\Services\Tcpip\..\{130B8CB1-F13A-4CC3-8BF5-7FE7473752B1}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{130B8CB1-F13A-4CC3-8BF5-7FE7473752B1}: NameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{5CC353A2-3C1D-4702-A7C9-085525EEDF90}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{AFAD59BE-C41A-45AB-89FC-DFDF4AA02322}: DhcpNameServer=84.103.237.145 86.64.145.145
HKLM\SYSTEM\CS3\Services\Tcpip\..\{130B8CB1-F13A-4CC3-8BF5-7FE7473752B1}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{130B8CB1-F13A-4CC3-8BF5-7FE7473752B1}: NameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{5CC353A2-3C1D-4702-A7C9-085525EEDF90}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{AFAD59BE-C41A-45AB-89FC-DFDF4AA02322}: DhcpNameServer=84.103.237.145 86.64.145.145
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1

»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

»»»»»»»»»»»»»»»»»»»»»»»» RK.2

»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» End

Parfais, Ensuite :

▶ Téléchargez Dr.Web CureIt! sur ton Bureau :

▶ Double-cliquez sur drweb-cureit.exe et cliquez sur Commencer le scan.

▶ Ce scan rapide permet l'analyse des processus chargés en mémoire; s'il trouve des processus infectés, cliquez sur le bouton Oui pour Tout à l'invite.

▶ Lorsque le scan rapide est terminé, cliquez sur Options > Changer la configuration.

▶ Choisissez l'onglet Scanner, et décochez Analyse heuristique.

▶ De retour à la fenêtre principale : choisissez Analyse complète.

▶ Cliquez la flèche verte sur la droite et le scan débutera. Une publicité apparaît quelquefois, fermez-la.

▶ Cliquez Oui pour Tout si un fichier est détecté.

▶ A la fin du scan, si des infections sont trouvées, cliquez sur Tout sélectionner, puis sur Désinfecter. Si la désinfection est impossible, cliquez sur Quarantaine.

▶ Au menu principal de l'outil, en haut à gauche, cliquez sur le menu Fichier et choisissez Enregistrer le rapport.

▶ Sauvegardez le rapport sur votre Bureau. Ce dernier se nommera DrWeb.csv.

▶ Fermez Dr.Web CureIt!

▶ Redémarrez votre ordinateur (très important) car certains fichiers peuvent être déplacés/réparés au redémarrage.

▶ Postez (Copiez/Collez) le contenu du rapport de l'outil Dr.Web dans un bloc note

Ensuite :

▶ Rendez-vous à cette adresse d'hébergement gratuit : http://www.cijoint.fr/

▶ Cliquez sur parcourir, chercher rapport DrWeb.txt puis sur cliquez ici pour déposer le fichier

▶ Une fois le lien crée, faite un clique droit dessus et copier l'adresse du lien pour venir le coller dans votre réponse

Bonjour,

Je poste ici le rapport Dr Web car il n'est pas reconnu sur ci-joint.fr (un message m'indique que je n'ai pas choisi de fichier!)

Merci.

Process.exe;C:\Windows\system32;Tool.Prockill;Irréparable.Quarantaine.;
RegUBP2b-max.reg;C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Snapshots2;Trojan.StartPage.1505;Supprimé.;
SmitfraudFix.exe\SmitfraudFix\Process.exe;C:\Documents and Settings\max\Desktop\SmitfraudFix.exe;Tool.Prockill;;
SmitfraudFix.exe\SmitfraudFix\restart.exe;C:\Documents and Settings\max\Desktop\SmitfraudFix.exe;Tool.ShutDown.14;;
SmitfraudFix.exe;C:\Documents and Settings\max\Desktop;L'archive contient des éléments infectés;Quarantaine.;
Process.exe;C:\Documents and Settings\max\Desktop\SmitfraudFix;Tool.Prockill;Irréparable.Quarantaine.;
restart.exe;C:\Documents and Settings\max\Desktop\SmitfraudFix;Tool.ShutDown.14;Irréparable.Quarantaine.;
SmitfraudFix.exe\SmitfraudFix\Process.exe;C:\Documents and Settings\max\DoctorWeb\Quarantine\SmitfraudFix.exe;Tool.Prockill;;
SmitfraudFix.exe\SmitfraudFix\restart.exe;C:\Documents and Settings\max\DoctorWeb\Quarantine\SmitfraudFix.exe;Tool.ShutDown.14;;
SmitfraudFix.exe;C:\Documents and Settings\max\DoctorWeb\Quarantine;L'archive contient des éléments infectés;Quarantaine.;
pskill.exe;C:\Program Files\Smart HDD\GPIO;Program.PsKill.101;Irréparable.Quarantaine.;
Process.exe;C:\Users\max\Desktop\SmitfraudFix;Tool.Prockill;Chemin invalide pour le fichier ;
restart.exe;C:\Users\max\Desktop\SmitfraudFix;Tool.ShutDown.14;Chemin invalide pour le fichier ;
Process.exe;C:\Windows\System32;Tool.Prockill;Chemin invalide pour le fichier ;
AutoRun.exe\svchost.exe;D:\Mp3\Classique\Prokofiev\Concerti\AutoRun.exe;Trojan.DownLoad.23093;;
AutoRun.exe;D:\Mp3\Classique\Prokofiev\Concerti;L'archive contient des éléments infectés;Quarantaine.;

Regarde dans le dossier ou est stocker drweb il doit y avoir la quarantaine, supprimer tout ce que tu vois dedans.

Salut Pimprenelle,

J'ai supprimé tout ce qui était dans le dossier de quarantaine. Mais, Pc confidential apparait toujours dans l'onglet "outil" d'internet explorer et ce navigateur web a toujours les memes problèmes notamment à la fermeture d'une fenetre (alors que Mozilla fonctionne correctement). Dois-je envisager un reformatage ?

Merci à toi en tout cas.

on a pas fini refais moi un nouveau RSIT.

Salut,
Voila le nouveau rapport RSIT

Run by max at 2009-11-03 19:24:36
Microsoft® Windows Vista™ Édition Familiale Premium Service Pack 2
System drive C: has 24 GB (10%) free of 234 GB
Total RAM: 3327 MB (60% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:24:44, on 03/11/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18828)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Le Robert\Le Petit Robert\PRHYPER.EXE
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Native Instruments\Audio Kontrol 1\Audio Kontrol 1.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\RALINK\RT2500 USB Wireless LAN Card\Installer\WIN2K\RaConfig2500.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Windows\System32\mobsync.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\eMule\emule.exe
C:\Users\max\Desktop\RSIT.exe
C:\Program Files\trend micro\max.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - - (no file)
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: PCCBHO.CPCCBHO - {22FC6CE8-7D47-479F-B74A-BFBB04ADB9AF} - C:\Program Files\Winferno\PC Confidential\PCCBHO.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: MediaBar - {ABB49B3B-AB7D-4ED0-9135-93FD5AA4F69F} - C:\Program Files\iMeshMediabarTb\iMeshMediaBarDx.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: MediaBar - {ABB49B3B-AB7D-4ED0-9135-93FD5AA4F69F} - C:\Program Files\iMeshMediabarTb\iMeshMediaBarDx.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKCU\..\Run: [Le Petit Robert Hyperappel] C:\Program Files\Le Robert\Le Petit Robert\prhyper.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Audio Kontrol 1] C:\Program Files\Native Instruments\Audio Kontrol 1\Audio Kontrol 1.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Global Startup: RaConfig2500.lnk = C:\Program Files\RALINK\RT2500 USB Wireless LAN Card\Installer\WIN2K\RaConfig2500.exe
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: SmartShopper - Compare product prices - {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEBF} - (no file)
O9 - Extra button: SmartShopper - Compare travel rates - {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEC0} - (no file)
O9 - Extra button: (no name) - {53F6FCCD-9E22-4d71-86EA-6E43136192AB} - C:\Program Files\Winferno\PC Confidential\PCConfidential.exe (file missing)
O9 - Extra 'Tools' menuitem: PC Confidential - {53F6FCCD-9E22-4d71-86EA-6E43136192AB} - C:\Program Files\Winferno\PC Confidential\PCConfidential.exe (file missing)
O9 - Extra button: PC Confidential - {925DAB62-F9AC-4221-806A-057BFB1014AA} - C:\Program Files\Winferno\PC Confidential\PCConfidential.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI8CBC~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O17 - HKLM\System\CCS\Services\Tcpip\..\{130B8CB1-F13A-4CC3-8BF5-7FE7473752B1}: NameServer = 192.168.1.1
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: Service Google Update (gupdate1c9e75f971307a1) (gupdate1c9e75f971307a1) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Unknown owner - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe (file missing)
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe

▶ Télécharge OTM (de Old_Timer) sur ton Bureau

▶ Double-clique sur OTM.exe pour le lancer.

▶ Assure toi que la case Unregister Dll's and Ocx's soit bien cochée.

▶ Copie la liste qui se trouve en gras dans la citation ci-dessous et colle-la dans le cadre de gauche de OTM sous "Paste instructions for item to be moved".

-----------------------------------------------------------------------------

:files
C:\Windows\system32\tmp.txt
C:\Program Files\Smart-Shopper

:Commands
[purity]
[emptytemp]
[Reboot]


-----------------------------------------------------------------------------

▶ clique sur MoveIt! pour lancer la suppression.

▶ Le résultat apparaitra dans le cadre "Results".

▶ Clique sur Exit pour fermer.

▶ Poste le rapport situé dans C:\_OTMoveIt\MovedFiles.

▶ Il te sera peut-être demandé de redémarrer le pc pour achever la suppression. Si c'est le cas accepte par Yes.

Salut, j'epsere que c'est bien le rapport demandé.
All processes killed
========== FILES ==========
C:\Windows\system32\tmp.txt moved successfully.
Folder move failed. C:\Program Files\Smart-Shopper\Bin\2.5.1 scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Smart-Shopper\Bin scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Smart-Shopper scheduled to be moved on reboot.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
File delete failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QXJTUXAX\desktop.ini scheduled to be deleted on reboot.
File delete failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IQ13B79T\desktop.ini scheduled to be deleted on reboot.
File delete failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IOXIVW61\desktop.ini scheduled to be deleted on reboot.
File delete failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5LCDVG7P\desktop.ini scheduled to be deleted on reboot.
File delete failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini scheduled to be deleted on reboot.
File delete failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 33170 bytes

User: Default User
->Temp folder emptied: 0 bytes
File delete failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QXJTUXAX\desktop.ini scheduled to be deleted on reboot.
File delete failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IQ13B79T\desktop.ini scheduled to be deleted on reboot.
File delete failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IOXIVW61\desktop.ini scheduled to be deleted on reboot.
File delete failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5LCDVG7P\desktop.ini scheduled to be deleted on reboot.
File delete failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini scheduled to be deleted on reboot.
File delete failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 33170 bytes

User: freenet

User: max
->Temp folder emptied: 13187218 bytes
File delete failed. C:\Users\max\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 524751335 bytes
->Java cache emptied: 57447261 bytes
->FireFox cache emptied: 60416514 bytes
->Google Chrome cache emptied: 6797392 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
File delete failed. C:\Windows\temp\fwtsqmfile00.sqm scheduled to be deleted on reboot.
File delete failed. C:\Windows\temp\fwtsqmfile01.sqm scheduled to be deleted on reboot.
Windows Temp folder emptied: 14682 bytes
RecycleBin emptied: 205714028 bytes

Total Files Cleaned = 828,17 mb

OTM by OldTimer - Version 3.0.0.6 log created on 11032009_221702

Files moved on Reboot...
Folder move failed. C:\Program Files\Smart-Shopper\Bin\2.5.1 scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Smart-Shopper\Bin\2.5.1 scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Smart-Shopper\Bin scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Smart-Shopper\Bin\2.5.1 scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Smart-Shopper\Bin scheduled to be moved on reboot.
Folder move failed. C:\Program Files\Smart-Shopper scheduled to be moved on reboot.
File move failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QXJTUXAX\desktop.ini scheduled to be moved on reboot.
File move failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IQ13B79T\desktop.ini scheduled to be moved on reboot.
File move failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IOXIVW61\desktop.ini scheduled to be moved on reboot.
File move failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5LCDVG7P\desktop.ini scheduled to be moved on reboot.
File move failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini scheduled to be moved on reboot.
File move failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini scheduled to be moved on reboot.
File move failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QXJTUXAX\desktop.ini scheduled to be moved on reboot.
File move failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IQ13B79T\desktop.ini scheduled to be moved on reboot.
File move failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IOXIVW61\desktop.ini scheduled to be moved on reboot.
File move failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5LCDVG7P\desktop.ini scheduled to be moved on reboot.
File move failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini scheduled to be moved on reboot.
File move failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini scheduled to be moved on reboot.
File move failed. C:\Windows\temp\fwtsqmfile00.sqm scheduled to be moved on reboot.
File move failed. C:\Windows\temp\fwtsqmfile01.sqm scheduled to be moved on reboot.

Registry entries deleted on Reboot...

parfais c'est tout bon.

▶ Télécharge Toolbar-S&D (de Team IDN) sur ton Bureau

▶ Lance l'installation du programme en exécutant le fichier téléchargé.

▶ Sous XP : Double-clique sur le raccourci de Toolbar-S&D.

▶ Sous Vista : Fais un clic droit sur ToolbarSD et sélectionne "Exécuter en tant qu'administrateur".

▶ Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.

▶ Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche.

▶ Poste le rapport généré. (C:\TB.txt)

Salut,
dernier rapport en date

-----------\\ ToolBar S&D 1.2.9 XP/Vista

Microsoft® Windows Vista™ Édition Familiale Premium ( v6.0.6002 ) Service Pack 2
X86-based PC ( Multiprocessor Free : AMD Phenom(tm) 9500 Quad-Core Processor )
BIOS : Phoenix - AwardBIOS v6.00PG
USER : max ( Not Administrator ! )
BOOT : Normal boot
C:\ (Local Disk) - NTFS - Total:228 Go (Free:16 Go)
D:\ (Local Disk) - NTFS - Total:227 Go (Free:126 Go)
E:\ (CD or DVD)
F:\ (USB)
G:\ (USB)
H:\ (USB) - FAT - Total:1963 Mo (Free:1 Go)
I:\ (USB)
K:\ (CD or DVD)
N:\ (Local Disk) - NTFS - Total:149 Go (Free:29 Go)

"C:\ToolBar SD" ( MAJ : 22-08-2009|18:42 )
Option : [1] ( 04/11/2009|23:56 )

[ UAC => 1 ]

-----------\\ Recherche de Fichiers / Dossiers ...

C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Playalot Games
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\SmartShopper
C:\Program Files\Smart-Shopper
C:\Program Files\Smart-Shopper\Bin
C:\Program Files\Smart-Shopper\Uninst.exe
C:\Program Files\Smart-Shopper\Bin\2.5.1

-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
"Local Page"="C:\\windows\\system32\\blank.htm"
"ICQ Search"="http://www.icq.com/search/results.php?q={searchTerms}&ch_id=osd"
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Url"="https://www.msn.com/fr-fr/actualite/"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home"
"Default_Page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
"Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Local Page"="C:\\windows\\system32\\blank.htm"

--------------------\\ Recherche d'autres infections

Aucune autre infection trouvée !

[ UAC => 1 ]

1 - "C:\ToolBar SD\TB_1.txt" - 04/11/2009|23:39 - Option : [1]
2 - "C:\ToolBar SD\TB_2.txt" - 04/11/2009|23:56 - Option : [1]

-----------\\ Fin du rapport a 23:56:37,41

encore parfais :

▶ Relance Toolbar-S&D.

▶ Tape sur "2" puis valide en appuyant sur "Entrée".

/!\ Ne ferme pas la fenêtre lors de la suppression /!\

▶ Un rapport sera généré, poste son contenu ici.

NOTE : Si ton Bureau ne réapparait pas, appuie simultanément sur Ctrl+Alt+Suppr pour ouvrir le Gestionnaire des tâches.
Rends-toi sur l'onglet "Processus". Clique en haut à gauche sur Fichier et choisis "Exécuter..."
Tape explorer puis valide.

Ce qu'il faut savoir sur les toolbars (barres d'outils)

Salut,
nouveau rapport :

-----------\\ ToolBar S&D 1.2.9 XP/Vista

Microsoft® Windows Vista™ Édition Familiale Premium ( v6.0.6002 ) Service Pack 2
X86-based PC ( Multiprocessor Free : AMD Phenom(tm) 9500 Quad-Core Processor )
BIOS : Phoenix - AwardBIOS v6.00PG
USER : max ( Not Administrator ! )
BOOT : Normal boot
C:\ (Local Disk) - NTFS - Total:228 Go (Free:16 Go)
D:\ (Local Disk) - NTFS - Total:227 Go (Free:126 Go)
E:\ (CD or DVD)
F:\ (USB)
G:\ (USB)
H:\ (USB) - FAT - Total:1963 Mo (Free:1 Go)
I:\ (USB)
K:\ (CD or DVD)
N:\ (Local Disk) - NTFS - Total:149 Go (Free:29 Go)

"C:\ToolBar SD" ( MAJ : 22-08-2009|18:42 )
Option : [2] ( 05/11/2009|11:12 )

[ UAC => 1 ]

-----------\\ SUPPRESSION

Supprime! - C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Playalot Games
Supprime! - C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\SmartShopper
Supprime! - C:\Program Files\Smart-Shopper\Bin
Supprime! - C:\Program Files\Smart-Shopper\Uninst.exe
Supprime! - C:\Program Files\Smart-Shopper

-----------\\ Recherche de Fichiers / Dossiers ...

-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
"Local Page"="C:\\windows\\system32\\blank.htm"
"ICQ Search"="http://www.icq.com/search/results.php?q={searchTerms}&ch_id=osd"
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Url"="https://www.msn.com/fr-fr/actualite/"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Start Page"="https://www.msn.com/fr-fr/"
"Default_Page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
"Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Local Page"="C:\\windows\\system32\\blank.htm"

--------------------\\ Recherche d'autres infections

Aucune autre infection trouvée !

[ UAC => 1 ]

1 - "C:\ToolBar SD\TB_1.txt" - 04/11/2009|23:39 - Option : [1]
2 - "C:\ToolBar SD\TB_2.txt" - 04/11/2009|23:56 - Option : [1]
3 - "C:\ToolBar SD\TB_3.txt" - 05/11/2009|11:13 - Option : [2]