Alerte spyware secure

Résolu
oceane1955 -  
Bonjour,
Depuis plusieurs jours, je suis envahie par des fenêtre publicitaires et des alertes virus par spyware secure.
Pouvez-vous m'aider à m'en débarrasser s'il vous plait ?
oceane1955
Configuration: Windows Vista
Internet Explorer 7.0

28 réponses

Résumé de la discussion

Infection par spyware publicitaire et alertes virus apparaissent sur un PC fonctionnant sous Windows Vista avec Internet Explorer 7, notamment Spyware-Secure, perturbant l’affichage et le fonctionnement du système. Des échanges recommandent l’utilisation d’outils de nettoyage comme ComboFix et HijackThis, ainsi que Malwarebytes pour éliminer les composants malveillants et mettre fin aux redirections et aux programmes indésirables. Des détails techniques précisent les emplacements des fichiers suspects et les éléments de démarrage à surveiller, avec des exemples tels que des dossiers Spyware-Secure et des entrées de démarrage. Un témoignage décrit les résultats d’un scan Malwarebytes indiquant la mise en quarantaine et la suppression de Spyware-Secure, et des liens fournis pour télécharger HijackThis ou consulter des tutoriels de décontamination.

Bobot (l’IA à votre service)
  1. Utilisateur anonyme
    Salut

    Désactive le contrôle des comptes utilisateurs (tu le réactiveras après ta désinfection):

    - Vas dans "Démarrer" puis Panneau de configuration.
    - Double Clique sur l'icône Comptes d'utilisateurs et sur Activer ou désactiver le contrôle des comptes d'utilisateurs.
    - Clique sur Continuer.
    - Décoche la case Utiliser le contrôle des comptes d'utilisateurs pour vous aider à protéger votre ordinateur.
    - Valide par OK et redémarre.

    Télécharge maintenant Navilog1 depuis-ce lien :

    http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe

    Enregistrer la cible (du lien) sous... et enregistre-le sur ton bureau.
    Ensuite double clique sur navilog1.exe pour lancer l'installation.
    Une fois l'installation terminée, Fais un Clic-droit sur le raccourci Navilog1 présent sur ton bureau et choisis "Exécuter

    en tant qu'administrateur".

    Au menu principal, Fais le choix 1
    Laisse toi guider et patiente.
    Patiente jusqu'au message :
    *** Analyse Termine le ..... ***
    Appuie sur une touche le blocnote va s'ouvrir.
    Copie-colle l'intégralité du rapport dans une réponse.
    Referme le blocnote
    Le rapport fixnavi.txt est en outre sauvegardé a la racine du disque
    1. oceane1955
      Re bonjour et merci pour la réponse aussi rapide.
      Voici la copie du rapport :
      Search Navipromo version 3.6.0 commencé le 13/07/2008 à 20:13:57,77

      !!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
      !!! Postez ce rapport sur le forum pour le faire analyser !!!
      !!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

      Outil exécuté depuis C:\Program Files\navilog1
      Session actuelle : "NADIA"

      Mise à jour le 27.06.2008 à 23h00 par IL-MAFIOSO

      Microsoft Windows Vista 6.0.6001
      Internet Explorer : 7.0.6001.18000
      Système de fichiers : NTFS

      Recherche executé en mode normal

      *** Recherche Programmes installés ***

      *** Recherche dossiers dans "C:\Windows" ***

      *** Recherche dossiers dans "C:\Program Files" ***

      C:\Program Files\InternetGameBox trouvé !

      *** Recherche dossiers dans "C:\ProgramData" ***

      *** Recherche dossiers dans "c:\progra~2\micros~1\windows\startm~1\programs" ***

      ...\InternetGameBox trouvé !

      *** Recherche dossiers dans "c:\users\nadia\appdata\roaming\micros~1\windows\startm~1\programs" ***

      *** Recherche dossiers dans "C:\Users\NADIA\AppData\Local\virtualstore\Program Files" ***

      ...\InternetGameBox trouvé !

      *** Recherche dossiers dans "C:\Users\NADIA\AppData\Roaming" ***

      *** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
      pour + d'infos : http://www.gmer.net

      Aucun Fichier trouvé

      *** Recherche avec GenericNaviSearch ***
      !!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
      !!! A vérifier impérativement avant toute suppression manuelle !!!

      * Recherche dans "C:\Windows\system32" *

      * Recherche dans "C:\Users\NADIA\AppData\Local\Microsoft" *

      * Recherche dans "C:\Users\NADIA\AppData\Local\virtualstore\windows\system32" *

      * Recherche dans "C:\Users\NADIA\AppData\Local" *

      Fichiers suspects :

      kegww.exe trouvé !
      kegww.dat trouvé !
      kegww_nav.dat trouvé !
      kegww_navps.dat trouvé !

      *** Recherche fichiers ***

      c:\users\public\desktop\InternetGameBox.lnk trouvé !
      C:\Windows\system32\nvs2.inf trouvé !

      *** Recherche clés spécifiques dans le Registre ***

      *** Module de Recherche complémentaire ***
      (Recherche fichiers spécifiques)

      1)Recherche nouveaux fichiers Instant Access :

      2)Recherche Heuristique :

      * Dans "C:\Windows\system32" :

      * Dans "C:\Users\NADIA\AppData\Local\Microsoft" :

      * Dans "C:\Users\NADIA\AppData\Local\virtualstore\windows\system32" :

      * Dans "C:\Users\NADIA\AppData\Local" :

      kegww.dat trouvé !
      kegww_nav.dat trouvé !
      kegww_navps.dat trouvé !

      3)Recherche Certificats :

      Certificat Egroup trouvé !
      Certificat Electronic-Group trouvé !
      Certificat OOO-Favorit trouvé !
      Certificat Sunny-Day-Design-Ltd absent !

      4)Recherche fichiers connus :

      *** Analyse terminée le 13/07/2008 à 20:23:57,31 ***
      1. Utilisateur anonyme
        Veille à ce que le contrôle des comptes utilisateurs (UAC) soit désactivé.
        Fais un Clic-droit sur le raccourci Navilog1 présent sur ton bureau et choisis "Exécuter en tant qu'administrateur".

        Au menu principal, Fais le choix 2
        Laisse toi guider et patiente.
        Le fix va t'informer qu'il va alors redémarrer ton PC
        Ferme toutes les fenêtres ouvertes et enregistre tes documents personnels ouverts
        Appuie sur une touche comme demandé.
        (si ton Pc ne redémarre pas automatiquement, fais-le toi-même)
        Au redémarrage de ton PC, choisis ta session habituelle si nécessaire.
        Patiente jusqu'au message :
        *** Nettoyage Termine le ..... ***
        Le blocnote va s'ouvrir.
        Sauvegarde le rapport de manière à le retrouver
        Referme le blocnote. Ton bureau va réapparaître
        Réactive le contrôle des comptes utilisateurs (UAC)

        PS:Si ton bureau ne réapparaît pas, fais CTRL+ALT+SUPP pour ouvrir le gestionnaire de tâches.
        Puis rends-toi à l'onglet "processus". Clique en haut à gauche sur fichiers et choisis "exécuter"
        Tape explorer et valide. Cela te fera apparaître ton bureau
        1. oceane1955
          J'ai fait le choix 2, le fix m'a informée qu'il allait redémarrer mon PC, j'ai fermé toutes les fenêtres sauf le fix, j'ai appuyé sur une touche mais ça n'a pas redémarré, alors j'ai redémarré moi-même. Je n'ai pas eu le message : Nettoyage terminé le....... et le boc note ne s'est pas ouvert. Mon bureau est réapparu. Je ne sais pas si je peux ractiver le contrôle des comptes utilisateurs vu que je n'ai pas eu le message Nettoyage terminé le... Que dois-je faire maintenant ?
          2. Utilisateur anonyme
            laiisse le controle des comptes eteind

            desactive ton antivirus

            ensuite refais l option 2 de navilog stp
            1. oceane1955
              Bonsoir,
              J'ai désactivé mon antivirus, j'ai refais option 1 et 2 de navilog.
              L'ordinateur a redémarré, mais je n'ai toujours pas le message Nettoyage terminé le.... et le bloc note ne s'ouvre toujours pas.
              Quand le PC a redémarré, l'antivirus était réactivé.
              Il s'est passé autre chose, l'icône de mon imprimante m'indique erreur alors qu'elle fonctionne, et l'icône du réseau est barrée alors que je suis connectée. C'est bizarre.
              1. Utilisateur anonyme
                Télécharge HijackThis ici :

                -> http://www.trendsecure.com/portal/en-US/_download/HJTInstall.exe

                Tutoriel d´instalation : (Merci a Balltrap34 pour cette réalisation)

                -> http://pageperso.aol.fr/balltrap34/Hijenr.gif

                Tutoriel d´utilisation (video) : (Merci a Balltrap34 pour cette réalisation)

                -> http://perso.orange.fr/rginformatique/section%20virus/demohijack.htm

                Post le rapport généré ici stp...
                1. oceane1955 Auteur
                  voici le rapport :

                  Logfile of Trend Micro HijackThis v2.0.2
                  Scan saved at 22:49:08, on 13/07/2008
                  Platform: Windows Vista SP1 (WinNT 6.00.1905)
                  MSIE: Internet Explorer v7.00 (7.00.6001.18000)
                  Boot mode: Normal

                  Running processes:
                  C:\Windows\system32\Dwm.exe
                  C:\Windows\Explorer.EXE
                  C:\Windows\system32\taskeng.exe
                  C:\Program Files\Windows Defender\MSASCui.exe
                  C:\Windows\RtHDVCpl.exe
                  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
                  C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
                  C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe
                  C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
                  C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe
                  C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe
                  C:\Windows\System32\rundll32.exe
                  C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
                  C:\Program Files\Acer\Acer Bio Protection\PdtWzd.exe
                  C:\Windows\PLFSetI.exe
                  C:\Users\NADIA\AppData\Local\Temp\RtkBtMnt.exe
                  C:\Windows\system32\wbem\unsecapp.exe
                  C:\Program Files\Launch Manager\LManager.exe
                  C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe
                  C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe
                  C:\Program Files\Microsoft IntelliPoint\ipoint.exe
                  C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
                  C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe
                  C:\Program Files\Windows Sidebar\sidebar.exe
                  C:\Windows\ehome\ehtray.exe
                  C:\Program Files\Windows Live\Messenger\msnmsgr.exe
                  C:\Program Files\Windows Media Player\wmpnscfg.exe
                  C:\Users\NADIA\AppData\Local\kegww.exe
                  C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
                  C:\Program Files\Acer\Acer VCM\AcerVCM.exe
                  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
                  C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
                  C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
                  C:\Windows\ehome\ehmsas.exe
                  C:\Program Files\Windows Sidebar\sidebar.exe
                  C:\Program Files\IncrediMail\bin\IMApp.exe
                  C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
                  C:\Program Files\Acer\Acer VCM\acp2HID.exe
                  C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
                  C:\Program Files\Acer\Acer VCM\VC.exe
                  C:\Program Files\Internet Explorer\ieuser.exe
                  C:\Program Files\Internet Explorer\iexplore.exe
                  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
                  C:\Windows\system32\Macromed\Flash\FlashUtil9e.exe
                  C:\Program Files\IncrediMail\bin\IncMail.exe
                  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

                  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://portail.free.fr/
                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
                  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
                  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
                  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
                  O1 - Hosts: ::1 localhost
                  O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
                  O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
                  O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coIEPlg.dll
                  O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
                  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                  O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
                  O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                  O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
                  O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll
                  O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
                  O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                  O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll
                  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
                  O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
                  O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
                  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
                  O4 - HKLM\..\Run: [ePower_DMC] C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
                  O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe
                  O4 - HKLM\..\Run: [eAudio] "C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe"
                  O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
                  O4 - HKLM\..\Run: [BkupTray] "C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe"
                  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
                  O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
                  O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
                  O4 - HKLM\..\Run: [ZPdtWzdVitaKey MC3000] "C:\Program Files\Acer\Acer Bio Protection\PdtWzd.exe" show
                  O4 - HKLM\..\Run: [PLFSetI] C:\Windows\PLFSetI.exe
                  O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
                  O4 - HKLM\..\Run: [ArcadeDeluxeAgent] "C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe"
                  O4 - HKLM\..\Run: [PlayMovie] "C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe"
                  O4 - HKLM\..\Run: [WarReg_PopUp] C:\Program Files\Acer\WR_PopUp\WarReg_PopUp.exe
                  O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
                  O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
                  O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
                  O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton 360\osCheck.exe"
                  O4 - HKLM\..\Run: [CLMLServer] "C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe"
                  O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
                  O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
                  O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
                  O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
                  O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
                  O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
                  O4 - HKCU\..\Run: [kegww] c:\users\nadia\appdata\local\kegww.exe kegww
                  O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
                  O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
                  O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
                  O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
                  O4 - Startup: Orion.lnk = C:\Convesoft\Orion\Messenger.exe
                  O4 - Global Startup: Acer VCM.lnk = ?
                  O4 - Global Startup: BTTray.lnk = ?
                  O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
                  O4 - Global Startup: officejet 6100.lnk = ?
                  O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
                  O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
                  O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
                  O8 - Extra context menu item: Envoyer au périphérique &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
                  O8 - Extra context menu item: Envoyer l'&image au périphérique Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
                  O9 - Extra button: Quick-Launching Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Program Files\Acer\Acer Bio Protection\PwdBank.exe
                  O9 - Extra 'Tools' menuitem: Quick-Launching Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Program Files\Acer\Acer Bio Protection\PwdBank.exe
                  O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                  O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                  O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
                  O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
                  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
                  O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
                  O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
                  O13 - Gopher Prefix:
                  O16 - DPF: {E1342154-4889-42B5-BEF6-19237577048F} (OberongamesLoader Object) - http://acerfr.oberon-media.com/online/online2/zuma/oberongamesloader.cab
                  O20 - Winlogon Notify: AWinNotifyVitaKey MC3000 - C:\Program Files\Acer\Acer Bio Protection\WinNotify.dll
                  O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
                  O23 - Service: Planificateur LiveUpdate automatique (Automatic LiveUpdate Scheduler) - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
                  O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
                  O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
                  O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
                  O23 - Service: CLHNService - Unknown owner - C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe
                  O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
                  O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
                  O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
                  O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
                  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                  O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
                  O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
                  O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
                  O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
                  O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
                  O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
                  O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
                  O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
                  O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared files\RichVideo.exe
                  O23 - Service: Raw Socket Service (RS_Service) - Acer Incorporated - C:\Program Files\Acer\Acer VCM\RS_Service.exe
                  O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
                  O23 - Service: Validity Fingerprint Service (vfsFPService) - Validity Sensors, Inc. - C:\Windows\system32\vfsFPService.exe
                  1. Utilisateur anonyme
                    ok navilog n a rien supprimé

                    Télécharge combofix : http://download.bleepingcomputer.com/sUBs/ComboFix.exe

                    -> Double clique combofix.exe.
                    -> Tape sur la touche 1 (Yes) pour démarrer le scan.
                    -> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.

                    NOTE : Le rapport se trouve également ici : C:\Combofix.txt

                    Avant d'utiliser ComboFix :

                    -> Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours.

                    -> Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent géner fortement la procédure de recherche et de nettoyage de l'outil.

                    Une fois fait, sur ton bureau double-clic sur Combofix.exe.

                    - Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc.

                    /!\ Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes.

                    - En fin de scan il est possible que ComboFix ait besoin de redemarrer le pc pour finaliser la désinfection\recherche, laisses-le faire.

                    - Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt)

                    -> Réactive la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet.

                    -> Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.

                    -> Tutoriel https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

                    1. oceane1955 Auteur
                      Bonsoir,
                      J'ai suivi le tutoriel à la lettre, mais à la fin, le fichier log ne s'est pas affiché.
                      Merci encore pour votre patience.
                      oceane1955
                      ps : peut-être parce que l'antivirus s'est réactivé lors du redémarrage du PC ?
                      1. Utilisateur anonyme
                        va dans ordinateur
                        entre dans le disque C
                        cherche : Combofix.txt
                        1. oceane1955 Auteur
                          voilà! je pense que c'est ça.

                          ComboFix 08-07-13.6 - NADIA 2008-07-13 23:54:56.1 - NTFSx86
                          Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.1775 [GMT 2:00]
                          Endroit: C:\Users\NADIA\Desktop\ComboFix.exe
                          * Création d'un nouveau point de restauration
                          .

                          (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
                          .

                          C:\Program Files\internetgamebox
                          C:\Program Files\internetgamebox\InternetGameBox.exe
                          C:\Program Files\internetgamebox\language
                          C:\Program Files\internetgamebox\ressources\AttenteOff.html
                          C:\Program Files\internetgamebox\ressources\AttenteOn.html
                          C:\Program Files\internetgamebox\ressources\configv2_en.xml
                          C:\Program Files\internetgamebox\ressources\configv2_es.xml
                          C:\Program Files\internetgamebox\ressources\configv2_fr.xml
                          C:\Program Files\internetgamebox\ressources\favoris\defaultv2.swf
                          C:\Program Files\internetgamebox\skins\skinv2.skn
                          C:\Program Files\internetgamebox\uninst.exe
                          C:\ProgramData\Microsoft\Windows\Start Menu\Programs\InternetGameBox
                          C:\ProgramData\Microsoft\Windows\Start Menu\Programs\InternetGameBox\Conditions générales.url
                          C:\ProgramData\Microsoft\Windows\Start Menu\Programs\InternetGameBox\Confidentialité.url
                          C:\ProgramData\Microsoft\Windows\Start Menu\Programs\InternetGameBox\Désinstaller.lnk
                          C:\ProgramData\Microsoft\Windows\Start Menu\Programs\InternetGameBox\InternetGameBox.lnk
                          C:\ProgramData\Microsoft\Windows\Start Menu\Programs\InternetGameBox\Website.url
                          c:\Users\NADIA\AppData\Local\kegww.dat
                          c:\users\nadia\appdata\local\kegww.exe
                          C:\Users\NADIA\AppData\Local\kegww_nav.dat
                          c:\Users\NADIA\AppData\Local\kegww_navps.dat
                          C:\Users\NADIA\AppData\Roaming\.#
                          C:\Users\Public\Desktop\internetgamebox.lnk
                          C:\Windows\system32\ACER.exe
                          C:\Windows\system32\nvs2.inf

                          .
                          ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-06-13 to 2008-07-13 ))))))))))))))))))))))))))))))))))))
                          .

                          2008-07-13 23:55 . 2008-07-13 23:55 6,736 --a------ C:\Windows\System32\drivers\PROCEXP90.SYS
                          2008-07-13 23:01 . 2008-07-13 23:52 <REP> d-------- C:\327882R2FWJFW
                          2008-07-13 22:47 . 2008-07-13 22:47 <REP> d-------- C:\Program Files\Trend Micro
                          2008-07-13 20:09 . 2008-07-13 22:04 <REP> d-------- C:\Program Files\Navilog1
                          2008-07-12 12:39 . 2008-06-26 03:45 12,240,896 --a------ C:\Windows\System32\NlsLexicons0007.dll
                          2008-07-12 12:39 . 2008-06-26 03:45 2,644,480 --a------ C:\Windows\System32\NlsLexicons0009.dll
                          2008-07-12 12:38 . 2008-06-26 05:29 801,280 --a------ C:\Windows\System32\NaturalLanguage6.dll
                          2008-07-11 19:05 . 2008-07-11 19:05 <REP> d-------- C:\Users\All Users\Google
                          2008-07-11 19:05 . 2008-07-11 19:05 <REP> d-------- C:\Program Files\Google
                          2008-07-11 18:45 . 2008-07-11 18:45 <REP> d-------- C:\Users\NADIA\Option
                          2008-07-06 20:35 . 2008-07-06 20:35 <REP> d-------- C:\Program Files\Microsoft Silverlight
                          2008-07-05 21:13 . 2008-07-05 21:13 <REP> d-------- C:\Windows\System32\N360_BACKUP
                          2008-06-25 20:20 . 2008-06-30 19:58 <REP> d-------- C:\Program Files\Norton 360
                          2008-06-25 20:19 . 2008-07-06 21:01 <REP> d-------- C:\Program Files\Symantec
                          2008-06-25 20:19 . 2008-07-06 21:01 123,952 --a------ C:\Windows\System32\drivers\SYMEVENT.SYS
                          2008-06-25 20:19 . 2008-07-06 21:01 10,671 --a------ C:\Windows\System32\drivers\SYMEVENT.CAT
                          2008-06-25 20:19 . 2008-07-06 21:01 805 --a------ C:\Windows\System32\drivers\SYMEVENT.INF
                          2008-06-25 20:01 . 2008-06-26 14:58 <REP> d-------- C:\Users\All Users\Symantec
                          2008-06-25 20:01 . 2008-06-26 14:58 <REP> d-------- C:\ProgramData\Symantec
                          2008-06-25 16:33 . 2008-06-25 16:33 <REP> d-------- C:\Users\All Users\Symantec Temporary Files
                          2008-06-25 16:33 . 2008-06-25 16:33 <REP> d-------- C:\ProgramData\Symantec Temporary Files
                          2008-06-25 16:21 . 2008-06-25 16:29 <REP> d-------- C:\Program Files\Spyware-Secure
                          2008-06-24 16:04 . 2008-06-25 20:21 <REP> d-------- C:\Users\NADIA\AppData\Roaming\Symantec
                          2008-06-22 19:21 . 2008-06-22 19:22 <REP> d-------- C:\Windows\System32\Adobe
                          2008-06-22 18:53 . 2008-06-22 18:53 <REP> d-------- C:\Users\NADIA\AppData\Roaming\Acer
                          2008-06-21 21:15 . 2008-06-21 21:15 <REP> d-------- C:\Users\NADIA\AppData\Roaming\Dossier de t‚l‚chargement Share-to-Web
                          2008-06-21 21:15 . 2008-06-21 21:15 <REP> d-------- C:\Users\NADIA\AppData\Roaming\Dossier de t‚l‚chargement Share-to-Web
                          2008-06-21 21:15 . 2008-06-21 21:15 <REP> d-------- C:\Program Files\Common Files\Hewlett-Packard
                          2008-06-21 21:14 . 2008-06-21 21:14 <REP> d-------- C:\Program Files\Hewlett-Packard
                          2008-06-21 21:14 . 2008-06-21 21:14 77,004 --a------ C:\Windows\System32\drivers\AFS.SYS
                          2008-06-21 21:11 . 2002-04-25 17:40 7,765 --------- C:\Windows\hpomdl01.dat
                          2008-06-21 20:46 . 2008-06-21 20:54 <REP> d-------- C:\Program Files\Windows Live Safety Center
                          2008-06-21 20:33 . 2008-06-21 20:33 <REP> d-------- C:\Program Files\Windows Live Toolbar
                          2008-06-21 20:33 . 2008-06-21 20:33 <REP> d-------- C:\Program Files\Windows Live Favorites
                          2008-06-21 20:32 . 2006-11-29 13:06 3,426,072 --a------ C:\Windows\System32\d3dx9_32.dll
                          2008-06-21 20:31 . 2008-06-21 20:31 <REP> d-------- C:\Program Files\Microsoft SQL Server Compact Edition
                          2008-06-21 20:05 . 2008-07-11 16:00 <REP> d-------- C:\Program Files\Windows Live
                          2008-06-21 20:05 . 2008-07-11 16:01 <REP> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
                          2008-06-21 20:04 . 2008-06-21 20:15 <REP> d-------- C:\Users\All Users\WLInstaller
                          2008-06-21 20:04 . 2008-06-21 20:15 <REP> d-------- C:\ProgramData\WLInstaller
                          2008-06-16 17:37 . 2008-06-16 17:37 <REP> d-------- C:\Users\All Users\IncrediMail
                          2008-06-16 17:37 . 2008-06-16 17:37 <REP> d-------- C:\ProgramData\IncrediMail
                          2008-06-16 17:28 . 2008-06-16 17:37 <REP> d-------- C:\Users\All Users\IM
                          2008-06-16 17:28 . 2008-06-16 17:37 <REP> d-------- C:\ProgramData\IM
                          2008-06-16 17:25 . 2008-06-16 17:37 <REP> d-------- C:\Program Files\IncrediMail
                          2008-06-15 19:12 . 2008-06-15 21:13 196,608 --a------ C:\Windows\SPInstall.etl
                          2008-06-15 14:14 . 2008-06-15 14:16 <REP> d-------- C:\Program Files\Microsoft Money 2005
                          2008-06-14 22:41 . 2008-07-11 19:32 <REP> d-a------ C:\Users\All Users\TEMP
                          2008-06-14 22:41 . 2008-07-11 19:32 <REP> d-a------ C:\ProgramData\TEMP
                          2008-06-14 22:41 . 2008-07-13 22:31 27,839 --a------ C:\Users\All Users\nvModes.dat
                          2008-06-14 22:41 . 2008-07-13 22:31 27,839 --a------ C:\ProgramData\nvModes.dat
                          2008-06-14 21:16 . 2008-06-14 21:16 <REP> d-------- C:\Program Files\Microsoft IntelliPoint
                          2008-06-14 19:18 . 2008-06-14 19:18 <REP> d-------- C:\Users\NADIA\Bluetooth Software
                          2008-06-14 19:18 . 2008-07-13 23:59 836 --a------ C:\Windows\bthservsdp.dat
                          2008-06-14 19:14 . 2008-06-14 19:14 <REP> d-------- C:\Users\NADIA\AppData\Roaming\Yahoo!
                          2008-06-14 19:14 . 2008-06-14 19:14 <REP> d-------- C:\Users\All Users\Yahoo! Companion
                          2008-06-14 19:14 . 2008-06-14 19:14 <REP> d-------- C:\ProgramData\Yahoo! Companion
                          2008-06-14 19:13 . 2008-06-21 21:48 <REP> d-------- C:\Users\NADIA\AppData\Roaming\eSobi
                          2008-06-14 17:57 . 2008-06-14 17:57 0 --ah----- C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf
                          2008-06-14 17:55 . 2008-04-23 06:42 428,544 --a------ C:\Windows\System32\EncDec.dll
                          2008-06-14 17:55 . 2008-04-23 06:42 293,376 --a------ C:\Windows\System32\psisdecd.dll
                          2008-06-14 17:55 . 2008-04-23 06:41 218,624 --a------ C:\Windows\System32\psisrndr.ax
                          2008-06-14 17:55 . 2008-04-23 06:41 57,856 --a------ C:\Windows\System32\MSDvbNP.ax
                          2008-06-13 15:02 . 2008-06-13 15:02 <REP> d-------- C:\Program Files\MSXML 4.0
                          2008-06-13 14:14 . 2008-06-13 14:14 24,112 --a------ C:\Windows\System32\drivers\SymIMV.sys
                          2008-06-13 14:14 . 2008-06-13 14:14 13,093 --a------ C:\Windows\System32\drivers\SymRedir.cat
                          2008-06-13 14:14 . 2008-06-13 14:14 1,611 --a------ C:\Windows\System32\drivers\SymRedir.inf
                          2008-06-13 14:13 . 2008-06-13 14:13 184,240 --a------ C:\Windows\System32\drivers\symtdi.sys
                          2008-06-13 14:13 . 2008-06-13 14:13 96,432 --a------ C:\Windows\System32\drivers\symfw.sys
                          2008-06-13 14:13 . 2008-06-13 14:13 41,008 --a------ C:\Windows\System32\drivers\symndisv.sys
                          2008-06-13 14:13 . 2008-06-13 14:13 38,576 --a------ C:\Windows\System32\drivers\symids.sys
                          2008-06-13 14:13 . 2008-06-13 14:13 22,320 --a------ C:\Windows\System32\drivers\symredrv.sys
                          2008-06-13 14:13 . 2008-06-13 14:13 13,616 --a------ C:\Windows\System32\drivers\symdns.sys

                          .
                          (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                          .
                          2008-07-13 20:15 --------- d-----w C:\Program Files\Launch Manager
                          2008-07-13 19:48 --------- d-----w C:\Program Files\Big Kahuna Reef
                          2008-07-11 14:01 --------- d--h--w C:\Program Files\InstallShield Installation Information
                          2008-07-11 14:01 --------- d-----w C:\Program Files\Microsoft Works
                          2008-07-11 14:01 --------- d-----w C:\Program Files\eSobi
                          2008-07-11 14:01 --------- d-----w C:\Program Files\Common Files\Symantec Shared
                          2008-07-11 14:00 --------- d-----w C:\ProgramData\Microsoft Help
                          2008-07-11 14:00 --------- d-----w C:\Program Files\Windows Mail
                          2008-06-21 20:00 --------- d-----w C:\ProgramData\CyberLink
                          2008-06-21 19:58 --------- d-----w C:\Users\NADIA\AppData\Roaming\CyberLink
                          2008-06-21 19:15 --------- d-----w C:\Users\NADIA\AppData\Roaming\Dossier de téléchargement Share-to-Web
                          2008-06-21 19:15 --------- d-----w C:\Users\NADIA\AppData\Roaming\Dossier de téléchargement Share-to-Web
                          2008-06-14 17:13 --------- d-----w C:\ProgramData\eSobi
                          2008-06-12 18:07 --------- d-----w C:\ProgramData\McAfee
                          2008-06-12 15:03 --------- d-----w C:\ProgramData\SiteAdvisor
                          2008-06-11 17:45 --------- d-----w C:\ProgramData\PlayMovie
                          2008-06-11 17:41 --------- d-----w C:\Users\NADIA\AppData\Roaming\Validity
                          2008-06-11 17:39 --------- d-----w C:\Program Files\Acer
                          2008-06-11 17:36 --------- d-sh--w C:\ProgramData\Modèles
                          2008-06-11 17:36 --------- d-sh--w C:\ProgramData\Menu Démarrer
                          2008-06-11 17:36 --------- d-sh--w C:\ProgramData\Favoris
                          2008-06-11 17:36 --------- d-sh--w C:\ProgramData\Bureau
                          2008-06-11 17:36 --------- d-sh--w C:\Program Files\Fichiers communs
                          2008-05-10 03:35 564,736 ----a-w C:\Windows\System32\emdmgmt.dll
                          2008-05-08 21:59 90,112 ----a-w C:\Windows\System32\wshext.dll
                          2008-05-08 21:59 430,080 ----a-w C:\Windows\System32\vbscript.dll
                          2008-05-08 21:59 180,224 ----a-w C:\Windows\System32\scrobj.dll
                          2008-05-08 21:59 172,032 ----a-w C:\Windows\System32\scrrun.dll
                          2008-05-08 21:59 155,648 ----a-w C:\Windows\System32\wscript.exe
                          2008-05-08 21:58 135,168 ----a-w C:\Windows\System32\cscript.exe
                          2008-04-29 03:54 181,760 ----a-w C:\Windows\System32\fsquirt.exe
                          2008-04-26 08:25 3,600,952 ----a-w C:\Windows\System32\ntkrnlpa.exe
                          2008-04-26 08:25 3,549,240 ----a-w C:\Windows\System32\ntoskrnl.exe
                          2008-04-26 08:08 1,314,816 ----a-w C:\Windows\System32\quartz.dll
                          2008-04-25 04:35 826,880 ----a-w C:\Windows\System32\wininet.dll
                          2008-01-21 02:43 174 --sha-w C:\Program Files\desktop.ini
                          .

                          ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
                          .
                          .
                          REGEDIT4
                          *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

                          [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
                          @="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
                          [HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
                          2008-03-05 00:38 121392 --a------ C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll

                          [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayExcluded]
                          @="{4433A54A-1AC8-432F-90FC-85F045CF383C}"
                          [HKEY_CLASSES_ROOT\CLSID\{4433A54A-1AC8-432F-90FC-85F045CF383C}]
                          2008-02-26 10:34 576352 --a------ C:\Program Files\Common Files\Symantec Shared\Backup\buShell.dll

                          [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayPending]
                          @="{F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225}"
                          [HKEY_CLASSES_ROOT\CLSID\{F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225}]
                          2008-02-26 10:34 576352 --a------ C:\Program Files\Common Files\Symantec Shared\Backup\buShell.dll

                          [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayProtected]
                          @="{476D0EA3-80F9-48B5-B70B-05E677C9C148}"
                          [HKEY_CLASSES_ROOT\CLSID\{476D0EA3-80F9-48B5-B70B-05E677C9C148}]
                          2008-02-26 10:34 576352 --a------ C:\Program Files\Common Files\Symantec Shared\Backup\buShell.dll

                          [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                          "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-21 04:23 1233920]
                          "ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-21 04:25 125952]
                          "IncrediMail"="C:\Program Files\IncrediMail\bin\IncMail.exe" [2008-06-12 13:49 243072]
                          "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]
                          "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 04:25 202240]
                          "swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2008-07-11 19:05 171448]
                          "WindowsWelcomeCenter"="oobefldr.dll" [2008-01-21 04:23 2153472 C:\Windows\System32\oobefldr.dll]

                          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                          "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2008-01-18 05:31 1033512]
                          "ePower_DMC"="C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2008-03-11 20:30 397312]
                          "eDataSecurity Loader"="C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe" [2008-03-05 00:38 526896]
                          "eAudio"="C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe" [2008-03-07 04:36 544768]
                          "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-03-08 05:38 40048]
                          "BkupTray"="C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe" [2008-02-25 19:57 34040]
                          "NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2008-03-07 19:55 13527584]
                          "NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2008-03-07 19:55 92704]
                          "IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2007-10-03 14:44 178712]
                          "ZPdtWzdVitaKey MC3000"="C:\Program Files\Acer\Acer Bio Protection\PdtWzd.exe" [2008-04-03 15:00 3642368]
                          "PLFSetI"="C:\Windows\PLFSetI.exe" [2007-10-23 10:56 200704]
                          "LManager"="C:\PROGRA~1\LAUNCH~1\LManager.exe" [2008-03-13 11:24 805384]
                          "ArcadeDeluxeAgent"="C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" [2008-03-05 15:55 147456]
                          "PlayMovie"="C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe" [2008-03-04 21:21 167936]
                          "WarReg_PopUp"="C:\Program Files\Acer\WR_PopUp\WarReg_PopUp.exe" [2008-01-29 09:03 303104]
                          "IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2007-02-06 01:52 849280]
                          "Share-to-Web Namespace Daemon"="C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [2002-04-11 04:19 69632]
                          "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-02-18 13:37 51048]
                          "osCheck"="C:\Program Files\Norton 360\osCheck.exe" [2008-02-26 16:50 988512]
                          "CLMLServer"="C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe" [2008-03-05 15:55 167936]
                          "RtHDVCpl"="RtHDVCpl.exe" [2008-03-11 11:53 5296128 C:\Windows\RtHDVCpl.exe]

                          C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
                          Acer VCM.lnk - C:\Program Files\Acer\Acer VCM\AcerVCM.exe [2008-04-03 15:14:23 1216512]
                          BTTray.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-04-24 18:50:32 723760]
                          hp psc 2000 Series.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe [2002-06-11 10:31:50 323646]
                          officejet 6100.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe [2002-06-11 10:32:22 147456]

                          [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
                          "EnableUIADesktopToggle"= 0 (0x0)

                          [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\AWinNotifyVitaKey MC3000]
                          2008-04-03 15:00 3024384 C:\Program Files\Acer\Acer Bio Protection\WinNotify.dll

                          [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
                          "DisableMonitoring"=dword:00000001

                          [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
                          "DisableMonitoring"=dword:00000001

                          [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
                          "DisableMonitoring"=dword:00000001

                          [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
                          "DisableMonitoring"=dword:00000001

                          [HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
                          "EnableFirewall"= 0 (0x0)

                          [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
                          "{FE015045-F8E4-492E-A03D-0771E64FCC90}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
                          "{94B6DB73-5141-4A2B-85EF-CD29836B2E4E}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
                          "{1847A304-170D-4A97-A2C7-8AC02DA77015}"= C:\Program Files\Cyberlink\PowerDirector\PDR.EXE:CyberLink PowerDirector
                          "{EE5CDDDD-2660-49AD-807E-17179F331E5A}"= UDP:C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe:BackupSvc.exe
                          "{562161D5-6ADE-44C2-BF3F-E68B1BB48BB5}"= TCP:C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe:BackupSvc.exe
                          "{47BF15BC-29DF-4BE5-A1D6-7D52783DBEE8}"= UDP:C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe:AgentSvc.exe
                          "{F00E00D7-6611-4B86-BA3E-352C76FD90D8}"= UDP:C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe:SchedulerSvc.exe
                          "{A111E818-2932-45CF-9513-5F8E30BA71E0}"= TCP:C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe:AgentSvc.exe
                          "{62B21C4E-EF6B-4839-93CF-F820AF071C44}"= TCP:C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe:SchedulerSvc.exe
                          "{E7A74CFB-84F9-4DA7-9659-B43681A4AE1E}"= C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Acer Arcade Deluxe.exe:Acer Arcade Deluxe
                          "{32324F38-F249-4B56-9A7E-657455632E6E}"= C:\Program Files\Acer Arcade Deluxe\PlayMovie\PlayMovie.exe:Acer Play Movie
                          "{050BCBD1-BDED-450A-A67F-5E487BF1AE13}"= C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe:Acer Play Movie Resident Program
                          "{FCF796FD-4256-4C9D-9F3E-78B93E0714CF}"= C:\Program Files\Acer\Acer VCM\VC.exe:Acer VCM
                          "{99DA08E2-1D69-43B9-AFF2-60235E478741}"= Disabled:UDP:C:\Program Files\IncrediMail\bin\ImpCnt.exe:IncrediMail
                          "{493E2805-F57F-4F2D-8C15-5BCC9B57A84F}"= Disabled:TCP:C:\Program Files\IncrediMail\bin\ImpCnt.exe:IncrediMail
                          "{50E89955-8DE5-4C30-9C24-F46DE9E442DE}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
                          "{A4FA563F-E8BD-463E-8E25-F4EAD7636722}"= Disabled:UDP:C:\Program Files\IncrediMail\bin\ImApp.exe:IncrediMail
                          "{B6EDEF9D-57A8-4BAD-85E4-449244B159FA}"= Disabled:TCP:C:\Program Files\IncrediMail\bin\ImApp.exe:IncrediMail
                          "{68DE5C21-4BFC-4662-92DD-090AF63FB722}"= C:\Program Files\Acer Arcade Deluxe\HomeMedia\HomeMedia.exe:Acer HomeMedia
                          "{44ACF0E4-44D7-4DFA-84D8-F763519187F6}"= Disabled:UDP:C:\Program Files\IncrediMail\bin\IncMail.exe:IncrediMail
                          "{E6F4A66F-A75F-49F4-9C5C-174601522178}"= Disabled:TCP:C:\Program Files\IncrediMail\bin\IncMail.exe:IncrediMail
                          "{304B5D97-4A48-470D-9522-6B0850C66803}"= Disabled:UDP:C:\Program Files\IncrediMail\bin\IncMail.exe:IncrediMail
                          "{03877086-C542-49E0-B7A5-494D8F440692}"= Disabled:TCP:C:\Program Files\IncrediMail\bin\IncMail.exe:IncrediMail
                          "{20615FDE-C601-4C55-BD4A-77B780CD0C29}"= Disabled:UDP:C:\Program Files\IncrediMail\bin\ImApp.exe:IncrediMail
                          "{42A22DA7-684F-4F24-AA53-1D41369FFCB7}"= Disabled:TCP:C:\Program Files\IncrediMail\bin\ImApp.exe:IncrediMail

                          [HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
                          "EnableFirewall"= 0 (0x0)

                          [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
                          "EnableFirewall"= 0 (0x0)

                          R0 AFS;AFS;C:\Windows\system32\drivers\AFS.sys [2008-06-21 21:14]
                          R0 AlfaFF;AlfaFF File System mini-filter;C:\Windows\system32\Drivers\AlfaFF.sys [2008-04-03 15:00]
                          R1 IDSvix86;Symantec Intrusion Prevention Driver;C:\PROGRA~2\Symantec\DEFINI~1\SymcData\ipsdefs\20080711.001\IDSvix86.sys [2008-06-03 16:28]
                          R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};C:\Program Files\Acer Arcade Deluxe\PlayMovie\000.fcl [2008-03-05 09:25]
                          R2 NTIPPKernel;NTIPPKernel;C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\NTIPPKernel.sys [2008-01-16 18:35]
                          R3 AVerAF15;AVerMedia BDA Digital Tuner;C:\Windows\system32\Drivers\AVerAF15.sys [2008-01-16 11:27]
                          R3 btwaudio;Périphérique audio Bluetooth;C:\Windows\system32\drivers\btwaudio.sys [2007-03-29 21:46]
                          R3 btwavdt;Bluetooth AVDT;C:\Windows\system32\drivers\btwavdt.sys [2007-02-27 08:20]
                          R3 btwrchid;btwrchid;C:\Windows\system32\DRIVERS\btwrchid.sys [2007-02-27 08:20]
                          R3 itecir;ITECIR Infrared Receiver;C:\Windows\system32\DRIVERS\itecir.sys [2007-12-18 18:12]
                          R3 L1E;NDIS Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller;C:\Windows\system32\DRIVERS\L1E60x86.sys [2008-03-11 13:38]
                          R3 SYMNDISV;SYMNDISV;C:\Windows\system32\Drivers\SYMNDISV.SYS [2008-06-13 14:13]
                          R3 vfs101x;vfs101x;C:\Windows\system32\drivers\vfs101x.sys [2008-02-15 09:09]
                          S3 COH_Mon;COH_Mon;C:\Windows\system32\Drivers\COH_Mon.sys [2008-03-06 21:32]
                          S4 ErrDev;Microsoft Hardware Error Device Driver;C:\Windows\system32\drivers\errdev.sys [2008-01-21 04:23]
                          S4 MegaSR;MegaSR;C:\Windows\system32\drivers\megasr.sys [2008-01-21 04:23]

                          [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
                          bthsvcs REG_MULTI_SZ BthServ

                          *Newly Created Service* - COMHOST
                          .
                          Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
                          "2008-06-21 18:33:14 C:\Windows\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job"
                          1. Utilisateur anonyme
                            ok

                            rebranche tes protection et le compte utilisateur

                            télécharge OTMoveIt http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe (de Old_Timer) sur ton Bureau.
                            double-clique sur OTMoveIt.exe pour le lancer.
                            Assure toi que la case Unregister Dll's and Ocx's soit bien cochée
                            copie la liste qui se trouve en gras ci-dessous,
                            et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved.

                            C:\Program Files\Spyware-Secure

                            clique sur MoveIt! pour lancer la suppression.
                            le résultat apparaitra dans le cadre "Results".
                            clique sur Exit pour fermer.
                            poste le rapport situé dans C:\_OTMoveIt\MovedFiles + un nouveau rapport hijackthis

                            il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes.

                            et dis nous comment va le pc stp
                            1. oceane1955 Auteur
                              voici le nouveau rapport HijackThis

                              Logfile of Trend Micro HijackThis v2.0.2
                              Scan saved at 22:49:08, on 13/07/2008
                              Platform: Windows Vista SP1 (WinNT 6.00.1905)
                              MSIE: Internet Explorer v7.00 (7.00.6001.18000)
                              Boot mode: Normal

                              Running processes:
                              C:\Windows\system32\Dwm.exe
                              C:\Windows\Explorer.EXE
                              C:\Windows\system32\taskeng.exe
                              C:\Program Files\Windows Defender\MSASCui.exe
                              C:\Windows\RtHDVCpl.exe
                              C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
                              C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
                              C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe
                              C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
                              C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe
                              C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe
                              C:\Windows\System32\rundll32.exe
                              C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
                              C:\Program Files\Acer\Acer Bio Protection\PdtWzd.exe
                              C:\Windows\PLFSetI.exe
                              C:\Users\NADIA\AppData\Local\Temp\RtkBtMnt.exe
                              C:\Windows\system32\wbem\unsecapp.exe
                              C:\Program Files\Launch Manager\LManager.exe
                              C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe
                              C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe
                              C:\Program Files\Microsoft IntelliPoint\ipoint.exe
                              C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
                              C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe
                              C:\Program Files\Windows Sidebar\sidebar.exe
                              C:\Windows\ehome\ehtray.exe
                              C:\Program Files\Windows Live\Messenger\msnmsgr.exe
                              C:\Program Files\Windows Media Player\wmpnscfg.exe
                              C:\Users\NADIA\AppData\Local\kegww.exe
                              C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
                              C:\Program Files\Acer\Acer VCM\AcerVCM.exe
                              C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
                              C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
                              C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
                              C:\Windows\ehome\ehmsas.exe
                              C:\Program Files\Windows Sidebar\sidebar.exe
                              C:\Program Files\IncrediMail\bin\IMApp.exe
                              C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
                              C:\Program Files\Acer\Acer VCM\acp2HID.exe
                              C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
                              C:\Program Files\Acer\Acer VCM\VC.exe
                              C:\Program Files\Internet Explorer\ieuser.exe
                              C:\Program Files\Internet Explorer\iexplore.exe
                              C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
                              C:\Windows\system32\Macromed\Flash\FlashUtil9e.exe
                              C:\Program Files\IncrediMail\bin\IncMail.exe
                              C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

                              R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                              R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://portail.free.fr/
                              R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
                              R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                              R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                              R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
                              R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
                              R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
                              R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
                              O1 - Hosts: ::1 localhost
                              O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
                              O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
                              O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coIEPlg.dll
                              O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
                              O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                              O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                              O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
                              O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                              O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
                              O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll
                              O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
                              O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                              O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll
                              O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
                              O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
                              O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
                              O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
                              O4 - HKLM\..\Run: [ePower_DMC] C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
                              O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe
                              O4 - HKLM\..\Run: [eAudio] "C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe"
                              O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
                              O4 - HKLM\..\Run: [BkupTray] "C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe"
                              O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
                              O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
                              O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
                              O4 - HKLM\..\Run: [ZPdtWzdVitaKey MC3000] "C:\Program Files\Acer\Acer Bio Protection\PdtWzd.exe" show
                              O4 - HKLM\..\Run: [PLFSetI] C:\Windows\PLFSetI.exe
                              O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
                              O4 - HKLM\..\Run: [ArcadeDeluxeAgent] "C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe"
                              O4 - HKLM\..\Run: [PlayMovie] "C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe"
                              O4 - HKLM\..\Run: [WarReg_PopUp] C:\Program Files\Acer\WR_PopUp\WarReg_PopUp.exe
                              O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
                              O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
                              O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
                              O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton 360\osCheck.exe"
                              O4 - HKLM\..\Run: [CLMLServer] "C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe"
                              O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
                              O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
                              O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
                              O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
                              O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
                              O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
                              O4 - HKCU\..\Run: [kegww] c:\users\nadia\appdata\local\kegww.exe kegww
                              O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
                              O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
                              O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
                              O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
                              O4 - Startup: Orion.lnk = C:\Convesoft\Orion\Messenger.exe
                              O4 - Global Startup: Acer VCM.lnk = ?
                              O4 - Global Startup: BTTray.lnk = ?
                              O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
                              O4 - Global Startup: officejet 6100.lnk = ?
                              O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
                              O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
                              O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
                              O8 - Extra context menu item: Envoyer au périphérique &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
                              O8 - Extra context menu item: Envoyer l'&image au périphérique Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
                              O9 - Extra button: Quick-Launching Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Program Files\Acer\Acer Bio Protection\PwdBank.exe
                              O9 - Extra 'Tools' menuitem: Quick-Launching Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Program Files\Acer\Acer Bio Protection\PwdBank.exe
                              O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                              O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                              O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
                              O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
                              O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
                              O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
                              O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
                              O13 - Gopher Prefix:
                              O16 - DPF: {E1342154-4889-42B5-BEF6-19237577048F} (OberongamesLoader Object) - http://acerfr.oberon-media.com/online/online2/zuma/oberongamesloader.cab
                              O20 - Winlogon Notify: AWinNotifyVitaKey MC3000 - C:\Program Files\Acer\Acer Bio Protection\WinNotify.dll
                              O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
                              O23 - Service: Planificateur LiveUpdate automatique (Automatic LiveUpdate Scheduler) - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
                              O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
                              O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
                              O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
                              O23 - Service: CLHNService - Unknown owner - C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe
                              O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
                              O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
                              O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
                              O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
                              O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                              O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
                              O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
                              O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
                              O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
                              O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
                              O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
                              O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
                              O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
                              O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared files\RichVideo.exe
                              O23 - Service: Raw Socket Service (RS_Service) - Acer Incorporated - C:\Program Files\Acer\Acer VCM\RS_Service.exe
                              O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
                              O23 - Service: Validity Fingerprint Service (vfsFPService) - Validity Sensors, Inc. - C:\Windows\system32\vfsFPService.exe
                              1. Utilisateur anonyme
                                redémarre le pc

                                ensuite :

                                Telecharge malwarebytes

                                -> http://www.malwarebytes.org/mbam/program/mbam-setup.exe

                                Tu l´instale; le programme va se mettre automatiquement a jour.

                                Une fois a jour, le programme va se lancer; click sur l´onglet parametre, et coche la case : "Arreter internet explorer pendant la suppression".

                                Click maintenant sur l´onglet recherche et coche la case : "executer un examen complet".

                                Puis click sur "rechercher".

                                Laisse le scanner le pc...

                                Si des elements on ete trouvés > click sur supprimer la selection.

                                si il t´es demandé de redemarrer > click sur "yes".

                                A la fin un rapport va s´ouvrir; sauvegarde le de maniere a le retrouver en vu de le poster sur le forum.

                                Copie et colle le rapport stp.

                                ps : les rapport sont aussi rangé dans l onglet rapport/log

                                bonne nuit a demain
                                2. Utilisateur anonyme
                                  de rien océanne demain reviens sur le forum avec le rapport malewarebyte et un nouveau rapport hijackthis

                                  @++
                                  1. oceane1955 Auteur
                                    Salut Chiquitine,
                                    Me revoilà avec le rapport malewarebyte :

                                    Malwarebytes' Anti-Malware 1.20
                                    Version de la base de données: 948
                                    Windows 6.0.6001 Service Pack 1

                                    18:26:32 2008-07-14
                                    mbam-log-7-14-2008 (18-26-32).txt

                                    Type de recherche: Examen complet (C:\|D:\|E:\|)
                                    Eléments examinés: 127524
                                    Temps écoulé: 34 minute(s), 51 second(s)

                                    Processus mémoire infecté(s): 0
                                    Module(s) mémoire infecté(s): 0
                                    Clé(s) du Registre infectée(s): 0
                                    Valeur(s) du Registre infectée(s): 0
                                    Elément(s) de données du Registre infecté(s): 0
                                    Dossier(s) infecté(s): 7
                                    Fichier(s) infecté(s): 48

                                    Processus mémoire infecté(s):
                                    (Aucun élément nuisible détecté)

                                    Module(s) mémoire infecté(s):
                                    (Aucun élément nuisible détecté)

                                    Clé(s) du Registre infectée(s):
                                    (Aucun élément nuisible détecté)

                                    Valeur(s) du Registre infectée(s):
                                    (Aucun élément nuisible détecté)

                                    Elément(s) de données du Registre infecté(s):
                                    (Aucun élément nuisible détecté)

                                    Dossier(s) infecté(s):
                                    C:\Program Files\Spyware-Secure (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                                    C:\Program Files\Spyware-Secure\help (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                                    C:\Program Files\Spyware-Secure\help\help_Trial_FR (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                                    C:\Program Files\Spyware-Secure\help\help_Trial_FR\images (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                                    C:\Program Files\Spyware-Secure\help\help_Trial_FR\images\FR (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                                    C:\Program Files\Spyware-Secure\help\help_Trial_FR\rubs (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                                    C:\Program Files\Spyware-Secure\resources (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.

                                    Fichier(s) infecté(s):
                                    C:\Program Files\Spyware-Secure\config.s3db (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                                    C:\Program Files\Spyware-Secure\Gfx_fr.bin (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                                    C:\Program Files\Spyware-Secure\language (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                                    C:\Program Files\Spyware-Secure\nbmw (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                                    C:\Program Files\Spyware-Secure\quarantine.s3db (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                                    C:\Program Files\Spyware-Secure\skin (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                                    C:\Program Files\Spyware-Secure\Spyware-Secure.url (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                                    C:\Program Files\Spyware-Secure\sqlite3.dll (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                                    C:\Program Files\Spyware-Secure\sws_translations.xml (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                                    C:\Program Files\Spyware-Secure\uninst.exe (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                                    C:\Program Files\Spyware-Secure\unrar.dll (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                                    C:\Program Files\Spyware-Secure\help\help_Trial_FR.zip (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                                    C:\Program Files\Spyware-Secure\help\help_Trial_FR\explo_intro.htm (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                                    C:\Program Files\Spyware-Secure\help\help_Trial_FR\explo_menu.htm (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                                    C:\Program Files\Spyware-Secure\help\help_Trial_FR\file.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                                    C:\Program Files\Spyware-Secure\help\help_Trial_FR\folder.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                                    C:\Program Files\Spyware-Secure\help\help_Trial_FR\folder_f.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                                    C:\Program Files\Spyware-Secure\help\help_Trial_FR\folder_o.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                                    C:\Program Files\Spyware-Secure\help\help_Trial_FR\index.htm (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                                    C:\Program Files\Spyware-Secure\help\help_Trial_FR\menu3.js (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                                    C:\Program Files\Spyware-Secure\help\help_Trial_FR\spy.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                                    C:\Program Files\Spyware-Secure\help\help_Trial_FR\trait_coud.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                                    C:\Program Files\Spyware-Secure\help\help_Trial_FR\trait_droit.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                                    C:\Program Files\Spyware-Secure\help\help_Trial_FR\trait_vert.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                                    C:\Program Files\Spyware-Secure\help\help_Trial_FR\images\fleche.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                                    C:\Program Files\Spyware-Secure\help\help_Trial_FR\images\folder.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                                    C:\Program Files\Spyware-Secure\help\help_Trial_FR\images\key.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                                    C:\Program Files\Spyware-Secure\help\help_Trial_FR\images\menu.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                                    C:\Program Files\Spyware-Secure\help\help_Trial_FR\images\support.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                                    C:\Program Files\Spyware-Secure\help\help_Trial_FR\images\title-hepfile.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                                    C:\Program Files\Spyware-Secure\help\help_Trial_FR\images\FR\dowload-file-antispyware.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                                    C:\Program Files\Spyware-Secure\help\help_Trial_FR\images\FR\menu.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                                    C:\Program Files\Spyware-Secure\help\help_Trial_FR\images\FR\scstep2.gif (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                                    C:\Program Files\Spyware-Secure\help\help_Trial_FR\rubs\3differentscan.htm (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                                    C:\Program Files\Spyware-Secure\help\help_Trial_FR\rubs\contactus.htm (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                                    C:\Program Files\Spyware-Secure\help\help_Trial_FR\rubs\found-objects.htm (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                                    C:\Program Files\Spyware-Secure\help\help_Trial_FR\rubs\lexic.htm (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                                    C:\Program Files\Spyware-Secure\help\help_Trial_FR\rubs\navigtabs.htm (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                                    C:\Program Files\Spyware-Secure\help\help_Trial_FR\rubs\quarantine.htm (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                                    C:\Program Files\Spyware-Secure\help\help_Trial_FR\rubs\register.htm (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                                    C:\Program Files\Spyware-Secure\resources\cookies_1-12.dat (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                                    C:\Program Files\Spyware-Secure\resources\filesDesc_1-12.dat (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                                    C:\Program Files\Spyware-Secure\resources\filesDesc_1-12.dic (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                                    C:\Program Files\Spyware-Secure\resources\filesExt_1-12.dat (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                                    C:\Program Files\Spyware-Secure\resources\filesMulti_1-12.idx (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                                    C:\Program Files\Spyware-Secure\resources\filesSimple_1-12.idx (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                                    C:\Program Files\Spyware-Secure\resources\malwaresDB_1-12 (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
                                    C:\Program Files\Spyware-Secure\resources\register_1-12.dat (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.

                                    et le nouveau rapport hijackthis :

                                    Logfile of Trend Micro HijackThis v2.0.2
                                    Scan saved at 18:42, on 2008-07-14
                                    Platform: Windows Vista SP1 (WinNT 6.00.1905)
                                    MSIE: Internet Explorer v7.00 (7.00.6001.18000)
                                    Boot mode: Normal

                                    Running processes:
                                    C:\Windows\system32\taskeng.exe
                                    C:\Windows\system32\Dwm.exe
                                    C:\Windows\Explorer.EXE
                                    C:\Windows\RtHDVCpl.exe
                                    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
                                    C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
                                    C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe
                                    C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe
                                    C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
                                    C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe
                                    C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
                                    C:\Windows\System32\mobsync.exe
                                    C:\Windows\System32\rundll32.exe
                                    C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
                                    C:\Program Files\Acer\Acer Bio Protection\PdtWzd.exe
                                    C:\Windows\PLFSetI.exe
                                    C:\Users\NADIA\AppData\Local\Temp\RtkBtMnt.exe
                                    C:\Windows\system32\wbem\unsecapp.exe
                                    C:\Program Files\Launch Manager\LManager.exe
                                    C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe
                                    C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe
                                    C:\Program Files\Microsoft IntelliPoint\ipoint.exe
                                    C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
                                    C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe
                                    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
                                    C:\Program Files\Windows Sidebar\sidebar.exe
                                    C:\Windows\ehome\ehtray.exe
                                    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
                                    C:\Program Files\Windows Media Player\wmpnscfg.exe
                                    C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
                                    C:\Program Files\Acer\Acer VCM\AcerVCM.exe
                                    C:\Program Files\Windows Sidebar\sidebar.exe
                                    C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
                                    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
                                    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
                                    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
                                    C:\Windows\ehome\ehmsas.exe
                                    C:\Program Files\IncrediMail\bin\IMApp.exe
                                    C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
                                    C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
                                    C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
                                    C:\Program Files\Acer\Acer VCM\acp2HID.exe
                                    C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
                                    C:\Program Files\Acer\Acer VCM\VC.exe
                                    C:\Windows\system32\SearchFilterHost.exe
                                    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

                                    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://portail.free.fr/
                                    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                                    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                                    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                                    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
                                    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
                                    O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
                                    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
                                    O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coIEPlg.dll
                                    O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
                                    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                                    O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                                    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
                                    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                                    O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
                                    O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll
                                    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
                                    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                                    O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll
                                    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
                                    O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
                                    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
                                    O4 - HKLM\..\Run: [ePower_DMC] C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
                                    O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe
                                    O4 - HKLM\..\Run: [eAudio] "C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe"
                                    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
                                    O4 - HKLM\..\Run: [BkupTray] "C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe"
                                    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
                                    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
                                    O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
                                    O4 - HKLM\..\Run: [ZPdtWzdVitaKey MC3000] "C:\Program Files\Acer\Acer Bio Protection\PdtWzd.exe" show
                                    O4 - HKLM\..\Run: [PLFSetI] C:\Windows\PLFSetI.exe
                                    O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
                                    O4 - HKLM\..\Run: [ArcadeDeluxeAgent] "C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe"
                                    O4 - HKLM\..\Run: [PlayMovie] "C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe"
                                    O4 - HKLM\..\Run: [WarReg_PopUp] C:\Program Files\Acer\WR_PopUp\WarReg_PopUp.exe
                                    O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
                                    O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
                                    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
                                    O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton 360\osCheck.exe"
                                    O4 - HKLM\..\Run: [CLMLServer] "C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe"
                                    O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
                                    O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
                                    O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
                                    O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
                                    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
                                    O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
                                    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
                                    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
                                    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
                                    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
                                    O4 - Startup: Orion.lnk = C:\Convesoft\Orion\Messenger.exe
                                    O4 - Global Startup: Acer VCM.lnk = ?
                                    O4 - Global Startup: BTTray.lnk = ?
                                    O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
                                    O4 - Global Startup: officejet 6100.lnk = ?
                                    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
                                    O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
                                    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
                                    O8 - Extra context menu item: Envoyer au périphérique &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
                                    O8 - Extra context menu item: Envoyer l'&image au périphérique Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
                                    O9 - Extra button: Quick-Launching Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Program Files\Acer\Acer Bio Protection\PwdBank.exe
                                    O9 - Extra 'Tools' menuitem: Quick-Launching Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Program Files\Acer\Acer Bio Protection\PwdBank.exe
                                    O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                                    O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                                    O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
                                    O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
                                    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
                                    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
                                    O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
                                    O13 - Gopher Prefix:
                                    O16 - DPF: {E1342154-4889-42B5-BEF6-19237577048F} (OberongamesLoader Object) - http://acerfr.oberon-media.com/online/online2/zuma/oberongamesloader.cab
                                    O20 - Winlogon Notify: AWinNotifyVitaKey MC3000 - C:\Program Files\Acer\Acer Bio Protection\WinNotify.dll
                                    O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
                                    O23 - Service: Planificateur LiveUpdate automatique (Automatic LiveUpdate Scheduler) - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
                                    O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
                                    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
                                    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
                                    O23 - Service: CLHNService - Unknown owner - C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe
                                    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
                                    O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
                                    O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
                                    O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
                                    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                                    O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
                                    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
                                    O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
                                    O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
                                    O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
                                    O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
                                    O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
                                    O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
                                    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared files\RichVideo.exe
                                    O23 - Service: Raw Socket Service (RS_Service) - Acer Incorporated - C:\Program Files\Acer\Acer VCM\RS_Service.exe
                                    O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
                                    O23 - Service: Validity Fingerprint Service (vfsFPService) - Validity Sensors, Inc. - C:\Windows\system32\vfsFPService.exe
                                    1. Utilisateur anonyme
                                      oui c est bon signe

                                      Rends toi sur ce site :

                                      https://www.virustotal.com/gui/

                                      Clique sur parcourir et cherche ce fichier : C:\Windows\PLFSetI.exe
                                      Clique sur Send File.

                                      Un rapport va s'élaborer ligne à ligne.

                                      Attends la fin. Il doit comprendre la taille du fichier envoyé.

                                      Sauvegarde le rapport avec le bloc-note.

                                      Copie le dans ta réponse.
                                      1. oceane1955 Auteur
                                        et voilà la réponse : je ne sais pas comment sauvegarder avec le bloc note alors j'ai copier coller

                                        Fichier PLFSetI.exe reçu le 2008.07.03 18:53:00 (CET)
                                        Situation actuelle: terminé

                                        Résultat: 0/33 (0.00%)
                                        Formaté Impression des résultats
                                        Antivirus Version Dernière mise à jour Résultat
                                        AhnLab-V3 2008.7.4.0 2008.07.03 -
                                        AntiVir 7.8.0.64 2008.07.03 -
                                        Authentium 5.1.0.4 2008.07.02 -
                                        Avast 4.8.1195.0 2008.07.03 -
                                        AVG 7.5.0.516 2008.07.03 -
                                        BitDefender 7.2 2008.07.03 -
                                        CAT-QuickHeal 9.50 2008.07.03 -
                                        ClamAV 0.93.1 2008.07.03 -
                                        DrWeb 4.44.0.09170 2008.07.03 -
                                        eSafe 7.0.17.0 2008.07.03 -
                                        eTrust-Vet 31.6.5922 2008.07.02 -
                                        Ewido 4.0 2008.07.03 -
                                        F-Prot 4.4.4.56 2008.07.02 -
                                        F-Secure 7.60.13501.0 2008.07.03 -
                                        Fortinet 3.14.0.0 2008.07.03 -
                                        GData 2.0.7306.1023 2008.07.03 -
                                        Ikarus T3.1.1.26.0 2008.07.03 -
                                        Kaspersky 7.0.0.125 2008.07.03 -
                                        McAfee 5331 2008.07.03 -
                                        Microsoft 1.3704 2008.07.03 -
                                        NOD32v2 3239 2008.07.03 -
                                        Norman 5.80.02 2008.07.03 -
                                        Panda 9.0.0.4 2008.07.02 -
                                        Prevx1 V2 2008.07.03 -
                                        Rising 20.51.32.00 2008.07.03 -
                                        Sophos 4.30.0 2008.07.03 -
                                        Sunbelt 3.1.1509.1 2008.07.03 -
                                        Symantec 10 2008.07.03 -
                                        TheHacker 6.2.96.369 2008.07.03 -
                                        TrendMicro 8.700.0.1004 2008.07.03 -
                                        VBA32 3.12.6.8 2008.07.03 -
                                        VirusBuster 4.5.11.0 2008.07.03 -
                                        Webwasher-Gateway 6.6.2 2008.07.03 -
                                        Information additionnelle
                                        File size: 200704 bytes
                                        MD5...: 2ac7f8b8bf0d5d327a3a2a00453222c4
                                        SHA1..: 801b48d7d5739038a7f293dbbf215431f77d8ee9
                                        SHA256: f71b6cfa7f4ae2a13c8ddf296631ef26c72e7c0387d88b9701577dae133ec583
                                        SHA512: d6c16fe3f6a556643f1db7963d1f544a91b7aecc9cbd2d63efffc8234e00d7f9
                                        a87a31e887319c35a67412d3bce6b8854568e36ba5f9f9c58d26d31fc75292ba
                                        PEiD..: Armadillo v1.71
                                        PEInfo: PE Structure information

                                        ( base data )
                                        entrypointaddress.: 0x409fe0
                                        timedatestamp.....: 0x471d62d0 (Tue Oct 23 02:56:16 2007)
                                        machinetype.......: 0x14c (I386)

                                        ( 4 sections )
                                        name viradd virsiz rawdsiz ntrpy md5
                                        .text 0x1000 0x2059f 0x21000 6.52 16d16d5b03dbdba19ce7a207a8c4b332
                                        .rdata 0x22000 0x8720 0x9000 4.58 b67e7269fb7e03bb992b809f7b8b656e
                                        .data 0x2b000 0x6348 0x3000 3.24 7180e1b25d7c9c8c1461a09f8479ffd6
                                        .rsrc 0x32000 0x2490 0x3000 3.86 8fd26e728f6382b0e527cb04d7230d00

                                        ( 11 imports )
                                        > KERNEL32.dll: GetStartupInfoA, GetCommandLineA, ExitProcess, TerminateProcess, HeapFree, HeapAlloc, RaiseException, HeapReAlloc, HeapSize, GetACP, GetTimeZoneInformation, LCMapStringA, LCMapStringW, UnhandledExceptionFilter, FreeEnvironmentStringsA, FreeEnvironmentStringsW, GetEnvironmentStrings, GetEnvironmentStringsW, SetHandleCount, RtlUnwind, GetFileType, HeapDestroy, HeapCreate, VirtualFree, VirtualAlloc, IsBadWritePtr, SetUnhandledExceptionFilter, GetStringTypeA, GetStringTypeW, IsBadReadPtr, IsBadCodePtr, SetStdHandle, CompareStringA, CompareStringW, SetEnvironmentVariableA, FormatMessageA, GetProfileStringA, GetTickCount, FileTimeToLocalFileTime, FileTimeToSystemTime, SetErrorMode, GetFileTime, GetFileSize, GetFileAttributesA, GetOEMCP, GetCPInfo, SizeofResource, GetProcessVersion, WritePrivateProfileStringA, GlobalFlags, TlsGetValue, LocalReAlloc, TlsSetValue, EnterCriticalSection, GlobalReAlloc, LeaveCriticalSection, TlsFree, GlobalHandle, DeleteCriticalSection, TlsAlloc, InitializeCriticalSection, LocalFree, LocalAlloc, GetThreadLocale, GetFullPathNameA, lstrcpynA, GetVolumeInformationA, FindFirstFileA, FindClose, SetEndOfFile, UnlockFile, LockFile, FlushFileBuffers, SetFilePointer, WriteFile, ReadFile, CreateFileA, GetCurrentProcess, DuplicateHandle, GetLastError, MulDiv, SetLastError, MultiByteToWideChar, lstrlenA, InterlockedIncrement, InterlockedDecrement, LoadLibraryA, FreeLibrary, GetVersion, lstrcatA, GlobalGetAtomNameA, GlobalAddAtomA, GlobalFindAtomA, lstrcpyA, GetModuleHandleA, GetProcAddress, GlobalUnlock, GlobalFree, LockResource, FindResourceA, LoadResource, CloseHandle, GetModuleFileNameA, GlobalLock, GlobalAlloc, GlobalDeleteAtom, lstrcmpA, lstrcmpiA, GetCurrentThread, GetCurrentThreadId, lstrcpyW, WideCharToMultiByte, GetWindowsDirectoryA, Sleep, GetStdHandle, GetSystemDefaultLCID
                                        > USER32.dll: SetRect, GetNextDlgGroupItem, MessageBeep, InvalidateRect, InflateRect, RegisterClipboardFormatA, PostThreadMessageA, GetSysColor, SetFocus, AdjustWindowRectEx, ScreenToClient, CopyRect, GetTopWindow, IsChild, GetCapture, WinHelpA, wsprintfA, GetClassInfoA, RegisterClassA, GetMenu, GetMenuItemCount, GetSubMenu, GetMenuItemID, GetWindowTextLengthA, GetWindowTextA, GetDlgCtrlID, DefWindowProcA, CreateWindowExA, GetClassLongA, SetPropA, UnhookWindowsHookEx, GetPropA, CallWindowProcA, RemovePropA, CopyAcceleratorTableA, GetMessagePos, GetClassNameA, SetForegroundWindow, SetWindowLongA, RegisterWindowMessageA, OffsetRect, IntersectRect, SystemParametersInfoA, GetWindowPlacement, GetWindowRect, MapDialogRect, SetWindowPos, GetWindow, SetWindowContextHelpId, EndDialog, SetActiveWindow, IsWindow, CreateDialogIndirectParamA, GetDlgItem, GetMenuCheckMarkDimensions, LoadBitmapA, GetMenuState, ModifyMenuA, SetMenuItemBitmaps, CheckMenuItem, EnableMenuItem, GetFocus, GetNextDlgTabItem, GetMessageA, TranslateMessage, DispatchMessageA, GetActiveWindow, GetKeyState, CallNextHookEx, ValidateRect, IsWindowVisible, PeekMessageA, GetCursorPos, LoadIconA, SendMessageA, AppendMenuA, UnregisterClassA, HideCaret, ShowCaret, ExcludeUpdateRgn, DrawFocusRect, SetWindowsHookExA, GetParent, GetLastActivePopup, IsWindowEnabled, GetWindowLongA, MessageBoxA, SetCursor, PostQuitMessage, PostMessageA, EnableWindow, IsIconic, GetSystemMetrics, CharNextA, GetSysColorBrush, GetMessageTime, GetClientRect, DrawIcon, DefDlgProcA, IsWindowUnicode, GetSystemMenu, GetDesktopWindow, LoadCursorA, CharUpperA, GrayStringA, DrawTextA, TabbedTextOutA, EndPaint, BeginPaint, GetWindowDC, ReleaseDC, GetDC, ClientToScreen, DestroyMenu, LoadStringA, ShowWindow, MoveWindow, SetWindowTextA, IsDialogMessageA, MapWindowPoints, UpdateWindow, DestroyWindow, PtInRect, GetForegroundWindow, SendDlgItemMessageA
                                        > GDI32.dll: SetMapMode, SetViewportOrgEx, OffsetViewportOrgEx, SetViewportExtEx, ScaleViewportExtEx, SetWindowExtEx, ScaleWindowExtEx, IntersectClipRect, DeleteObject, GetDeviceCaps, GetViewportExtEx, GetWindowExtEx, CreateSolidBrush, PtVisible, RectVisible, TextOutA, ExtTextOutA, Escape, GetTextColor, GetBkColor, DPtoLP, LPtoDP, GetMapMode, PatBlt, SetBkMode, GetStockObject, SelectObject, RestoreDC, SaveDC, DeleteDC, GetObjectA, SetBkColor, SetTextColor, GetClipBox, CreateDIBitmap, GetTextExtentPointA, BitBlt, CreateCompatibleDC, CreateBitmap
                                        > comdlg32.dll: GetFileTitleA
                                        > WINSPOOL.DRV: ClosePrinter, DocumentPropertiesA, OpenPrinterA
                                        > ADVAPI32.dll: RegCloseKey, RegSetValueExA, RegCreateKeyExA, RegQueryValueExA, RegOpenKeyExA
                                        > COMCTL32.dll: -
                                        > oledlg.dll: -
                                        > ole32.dll: CoFreeUnusedLibraries, OleUninitialize, CoTaskMemAlloc, CoTaskMemFree, CreateILockBytesOnHGlobal, StgCreateDocfileOnILockBytes, StgOpenStorageOnILockBytes, CoGetClassObject, CLSIDFromString, CLSIDFromProgID, CoCreateInstance, CoInitialize, CoUninitialize, CoRegisterMessageFilter, CoRevokeClassObject, OleFlushClipboard, OleIsCurrentClipboard, OleInitialize
                                        > OLEPRO32.DLL: -
                                        > OLEAUT32.dll: -, -, -, -, -, -, -, -, -

                                        ( 0 exports )

                                        ATTENTION: VirusTotal est un service gratuit offert par Hispasec Sistemas. Il n'y a aucune garantie quant à la disponibilité et la continuité de ce service. Bien que le taux de détection permis par l'utilisation de multiples moteurs antivirus soit bien supérieur à celui offert par seulement un produit, ces résultats NE garantissent PAS qu'un fichier est sans danger. Il n'y a actuellement aucune solution qui offre un taux d'efficacité de 100% pour la détection des virus et malwares.

                                        VirusTotal © Hispasec Sistemas - Blog - Contact: info@virustotal.com - Terms of Service & Privacy Policy
                                        • 1
                                        • 2

                                        Discussions similaires

                                        suite au message "secure boot violation" impossible d'accéder à window
                                        Walloute

                                        9 réponses
                                        Comment créer une alerte leboncoin
                                        Marc L.

                                        19 réponses
                                        se debarasser de fausses alerte virus
                                        Evka

                                        1 réponse