Aide pour Cheval de troie TR\Dropper.Gen

Salut Gen-hackman,

voici le rapport de Ad-remover :

.
======= RAPPORT D'AD-REMOVER 1.1.4.5_O | UNIQUEMENT XP/VISTA/SEVEN =======
.
Mit à jour par C_XX le 24/06/2009 à 7:10 PM
Contact: AdRemover.contact@gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Lancé à: 14:38:40, 07/07/2009 | Mode Normal | Option: CLEAN
Exécuté de: C:\Program Files\Ad-remover\
Système d'exploitation: Microsoft® Windows XP™ Service Pack 3 v5.1.2600
Nom du PC: KIK | Utilisateur actuel: mathieu
.
Administrateur: Administrateur
N'est pas administrateur: HelpAssistant *Desactive*
N'est pas administrateur: Invité
Administrateur: mathieu
N'est pas administrateur: SUPPORT_388945a0 *Desactive*
.
============== ÉLÉMENT(S) NEUTRALISÉ(S) ==============
.
.
HKCR\SearchSettings.BHO
HKCR\SearchSettings.BHO.1
HKCU\Software\Grand Virtual
HKLM\Software\Dealio
HKLM\Software\Microsoft\Internet Explorer\Extensions\{E908B145-C847-4e85-B315-07E2E70DECF8}
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Everest Poker
HKLM\Software\Search Settings
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\SearchSettings
HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\\{4D25F926-B9FE-4682-BF72-8AB8210D6D75}
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F}
HKCR\CLSID\{6A87B991-A31F-4130-AE72-6D0C294BF082}
HKCR\CLSID\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
.
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\res
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\temp
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\res\alerts.gif
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\res\alerts_over.gif
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\res\alerts_rec.gif
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\res\alerts_rec_over.gif
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\res\chevron-small.gif
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\res\DealioSearch.html
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\res\deals-leftcap.gif
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\res\deal_report.jpg
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\res\ebay_login.jpg
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\res\err_mainwindow.html
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\res\err_toolbar.html
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\res\global_scripts.js
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\res\headerbgthin.jpg
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\res\highlight-bg.png
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\res\logo.gif
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\res\logo_over.gif
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\res\man_toolbar.css
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\res\man_toolbar.html
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\res\man_toolbar.js
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\res\man_toolbarl.js
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\res\post-this-deal.gif
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\res\post-this-deal_over.gif
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\res\scripts.js
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\res\scroller.js
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\res\search-chevron.gif
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\res\search-chevron_over.gif
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\res\search_bg_blink.gif
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\res\separator.gif
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\res\settings.gif
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\res\settings_over.gif
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\res\yahoo-search.png
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\index.76.35
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.10.76
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.109.43
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.110.43
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.12.52
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.13.58
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.130.58
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.135.50
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.153.44
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.155.43
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.156.49
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.16.60
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.161.52
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.178.66
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.184.55
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.188.52
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.189.45
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.196.43
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.198.56
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.199.43
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.200.53
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.201.43
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.202.43
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.203.71
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.205.62
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.213.71
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.214.49
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.215.43
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.216.67
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.217.67
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.218.52
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.219.43
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.220.43
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.221.57
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.222.43
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.223.68
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.226.68
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.227.43
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.228.62
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.229.76
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.23.63
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.239.43
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.24.43
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.240.43
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.241.43
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.242.43
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.243.43
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.244.63
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.245.43
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.247.43
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.248.43
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.249.43
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.250.43
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.251.43
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.252.43
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.253.43
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.254.43
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.255.43
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.256.43
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.257.43
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.279.43
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.28.58
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.282.75
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.283.43
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.284.43
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.289.67
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.290.62
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.291.61
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.296.43
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.297.43
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.304.43
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.307.43
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.308.75
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.31.47
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.310.46
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.311.43
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.315.43
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.316.43
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.317.43
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.318.43
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.319.49
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.32.48
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.334.44
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.335.60
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.336.44
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.337.44
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.338.75
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.339.47
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.34.43
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.340.47
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.341.47
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.349.50
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.35.48
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.350.50
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.351.51
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.352.54
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.353.51
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.354.51
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.357.62
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.358.52
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.359.52
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.360.53
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.361.54
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.362.68
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.363.58
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.364.54
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.365.53
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.367.56
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.368.58
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.369.55
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.370.56
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.371.56
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.372.57
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.373.55
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.375.56
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.376.57
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.377.55
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.378.65
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.384.58
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.386.71
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.387.59
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.388.59
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.389.59
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.390.60
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.391.60
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.392.60
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.393.60
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.394.60
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.396.61
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.397.61
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.398.60
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.399.60
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.403.61
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.404.63
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.405.61
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.406.61
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.407.76
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.408.63
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.409.61
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.412.62
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.413.62
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.414.62
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.415.62
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.416.62
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.417.62
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.418.62
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.419.62
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.420.62
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.421.62
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.423.63
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.424.63
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.425.63
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.426.63
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.427.63
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.428.65
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.429.63
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.430.63
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.432.65
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.433.64
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.434.65
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.435.64
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.436.76
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.437.64
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.438.71
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.439.71
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.440.75
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.442.73
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.443.73
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.444.73
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.445.68
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.446.69
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.450.67
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.451.67
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.452.68
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.453.68
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.454.69
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.456.69
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.457.75
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.458.70
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.459.70
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.460.69
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.462.74
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.463.69
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.464.70
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.465.68
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.468.70
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.469.70
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.470.70
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.471.73
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.472.70
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.478.74
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.479.73
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.480.68
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.481.71
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.482.74
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.49.67
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.50.43
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.500.71
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.501.74
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.502.71
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.51.69
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.52.72
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.520.76
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.521.76
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.522.76
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.53.51
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.531.76
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.532.75
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.534.75
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.54.47
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.55.45
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.56.69
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.57.43
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.58.47
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.593.76
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.595.76
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.63.57
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.66.47
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.70.75
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\rules\rules.1.71.43
C:\DOCUME~1\mathieu\APPLIC~1\Dealio\kb127\temp\dod_cache.xml
C:\DOCUME~1\mathieu\APPLIC~1\Dealio
C:\DOCUME~1\mathieu\APPLIC~1\Search Settings\kb127
C:\DOCUME~1\mathieu\APPLIC~1\Search Settings\kb127\res
C:\DOCUME~1\mathieu\APPLIC~1\Search Settings\kb127\temp
C:\DOCUME~1\mathieu\APPLIC~1\Search Settings\kb127\temp\ws-14429.log
C:\DOCUME~1\mathieu\APPLIC~1\Search Settings\kb127\temp\ws-14430.log
C:\DOCUME~1\mathieu\APPLIC~1\Search Settings\kb127\temp\ws-14431.log
C:\DOCUME~1\mathieu\APPLIC~1\Search Settings\kb127\temp\ws-14432.log
C:\DOCUME~1\mathieu\APPLIC~1\Search Settings
C:\Program Files\Dealio\kb127
C:\Program Files\Dealio\kb127\Dealio.dll
C:\Program Files\Dealio\kb127\DealioRes409.dll
C:\Program Files\Dealio
C:\Program Files\MyWaySA\SrchAsDe
C:\Program Files\MyWaySA\SrchAsDe\deSrcAs.dll
C:\Program Files\MyWaySA
C:\Program Files\Search Settings\kb127
C:\Program Files\Search Settings\SearchSettings.exe
C:\Program Files\Search Settings\kb127\res
C:\Program Files\Search Settings\kb127\SearchSettings.dll
C:\Program Files\Search Settings\kb127\SearchSettingsRes409.dll
C:\Program Files\Search Settings\kb127\temp
C:\Program Files\Search Settings
C:\WINDOWS\Installer\bc0532.msi
C:\WINDOWS\Installer\bc0538.msi
C:\DOCUME~1\mathieu\Cookies\mathieu@dellfr.myway[1].txt
C:\DOCUME~1\mathieu\Cookies\mathieu@myway[1].txt
C:\DOCUME~1\mathieu\Cookies\mathieu@rotator.adjuggler[1].txt

(!) -- Fichiers temporaires supprimés.

.
============== Scan additionnel ==============
.

* Mozilla FireFox Version 3.5 *

Nom du profil: 2tgf7htn.default (mathieu)
.
(Prefs.js) user_pref("browser.startup.homepage", "hxxp://fr.yahoo.com/r/hf");
(Prefs.js) user_pref("browser.startup.homepage_override.mstone", "rv:1.9.1");
.
.

* Internet Explorer Version 7.0.5730.11 *

[HKEY_CURRENT_USER\..\Internet Explorer\Main]

Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://search.msn.com/spbasic.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://fr.msn.com/

[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

Tabs: res://ieframe.dll/tabswelcome.htm

============== Suspect (Cracks, Serials ... ) ==============

.
.
===================================
.
20939 Octet(s) - C:\Ad-Report-CLEAN.log
.
93 Fichier(s) - C:\DOCUME~1\mathieu\LOCALS~1\Temp
1178 Fichier(s) - C:\WINDOWS\Temp
.
19 Fichier(s) - C:\Program Files\Ad-remover\BACKUP
11 Fichier(s) - C:\Program Files\Ad-remover\QUARANTINE
.
Fin à: 15:00:11 | 07/07/2009
.
============== E.O.F ==============
.

Voici les 2 fichiers obtenus après le scan OTL

OTL.txt : http://www.cijoint.fr/cjlink.php?file=cj200907/cijLkLswQc.txt

Extras.txt : http://www.cijoint.fr/cjlink.php?file=cj200907/cijCKOkrrB.txt

Merci pour ton aide !!

Je viens d'effectuer toutes les manips que tu m'as énoncé mais le problème persiste...

Voici le résultat obtenu en utilisant Virus Total pour le fichier 87BE00AA43.sys :

Fichier 87BE00AA43.sys reçu le 2009.07.07 15:55:02 (UTC)
Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.18 2009.07.07 -
AhnLab-V3 5.0.0.2 2009.07.07 -
AntiVir 7.9.0.204 2009.07.07 -
Antiy-AVL 2.0.3.1 2009.07.07 -
Authentium 5.1.2.4 2009.07.07 -
Avast 4.8.1335.0 2009.07.06 -
AVG 8.5.0.386 2009.07.07 -
BitDefender 7.2 2009.07.07 -
CAT-QuickHeal 10.00 2009.07.07 -
ClamAV 0.94.1 2009.07.07 -
Comodo 1538 2009.07.02 -
DrWeb 5.0.0.12182 2009.07.07 -
eSafe 7.0.17.0 2009.07.07 -
eTrust-Vet 31.6.6601 2009.07.07 -
F-Prot 4.4.4.56 2009.07.06 -
F-Secure 8.0.14470.0 2009.07.07 -
Fortinet 3.117.0.0 2009.07.03 -
GData 19 2009.07.07 -
Ikarus T3.1.1.64.0 2009.07.07 -
Jiangmin 11.0.706 2009.07.07 -
K7AntiVirus 7.10.786 2009.07.07 -
Kaspersky 7.0.0.125 2009.07.07 -
McAfee 5668 2009.07.06 -
McAfee+Artemis 5668 2009.07.06 -
McAfee-GW-Edition 6.8.5 2009.07.07 -
Microsoft 1.4803 2009.07.07 -
NOD32 4222 2009.07.07 -
Norman 6.01.09 2009.07.07 -
nProtect 2009.1.8.0 2009.07.07 -
Panda 10.0.0.14 2009.07.06 -
PCTools 4.4.2.0 2009.07.07 -
Rising 21.37.14.00 2009.07.07 -
Sophos 4.43.0 2009.07.07 -
Sunbelt 3.2.1858.2 2009.07.07 -
Symantec 1.4.4.12 2009.07.07 -
TheHacker 6.3.4.3.364 2009.07.06 -
TrendMicro 8.950.0.1094 2009.07.07 -
VBA32 3.12.10.7 2009.07.07 -
ViRobot 2009.7.7.1822 2009.07.07 -
VirusBuster 4.6.5.0 2009.07.06 -
Information additionnelle
File size: 56 bytes
MD5   : 8665b4a51b5a3df4611b97167d8c4884
SHA1  : 165913dee92c5f36257dcc5ac2a2d02e13cbd24f
SHA256: 93c6a726cfc5beafb4c8f33166bc88e9bad94df37500c00d2a213c3e683f82bd
TrID  : File type identification<br>-
ssdeep: 3:/ls6z3P/tPUXBVnn:GYX+Tnn
PEiD  : -
RDS   : NSRL Reference Data Set<br>-

Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.18 2009.07.07 -
AhnLab-V3 5.0.0.2 2009.07.07 -
AntiVir 7.9.0.204 2009.07.07 -
Antiy-AVL 2.0.3.1 2009.07.07 -
Authentium 5.1.2.4 2009.07.07 -
Avast 4.8.1335.0 2009.07.06 -
AVG 8.5.0.386 2009.07.07 -
BitDefender 7.2 2009.07.07 -
CAT-QuickHeal 10.00 2009.07.07 -
ClamAV 0.94.1 2009.07.07 -
Comodo 1538 2009.07.02 -
DrWeb 5.0.0.12182 2009.07.07 -
eSafe 7.0.17.0 2009.07.07 -
eTrust-Vet 31.6.6601 2009.07.07 -
F-Prot 4.4.4.56 2009.07.06 -
F-Secure 8.0.14470.0 2009.07.07 -
Fortinet 3.117.0.0 2009.07.03 -
GData 19 2009.07.07 -
Ikarus T3.1.1.64.0 2009.07.07 -
Jiangmin 11.0.706 2009.07.07 -
K7AntiVirus 7.10.786 2009.07.07 -
Kaspersky 7.0.0.125 2009.07.07 -
McAfee 5668 2009.07.06 -
McAfee+Artemis 5668 2009.07.06 -
McAfee-GW-Edition 6.8.5 2009.07.07 -
Microsoft 1.4803 2009.07.07 -
NOD32 4222 2009.07.07 -
Norman 6.01.09 2009.07.07 -
nProtect 2009.1.8.0 2009.07.07 -
Panda 10.0.0.14 2009.07.06 -
PCTools 4.4.2.0 2009.07.07 -
Rising 21.37.14.00 2009.07.07 -
Sophos 4.43.0 2009.07.07 -
Sunbelt 3.2.1858.2 2009.07.07 -
Symantec 1.4.4.12 2009.07.07 -
TheHacker 6.3.4.3.364 2009.07.06 -
TrendMicro 8.950.0.1094 2009.07.07 -
VBA32 3.12.10.7 2009.07.07 -
ViRobot 2009.7.7.1822 2009.07.07 -
VirusBuster 4.6.5.0 2009.07.06 -

Information additionnelle
File size: 56 bytes
MD5   : 8665b4a51b5a3df4611b97167d8c4884
SHA1  : 165913dee92c5f36257dcc5ac2a2d02e13cbd24f
SHA256: 93c6a726cfc5beafb4c8f33166bc88e9bad94df37500c00d2a213c3e683f82bd
TrID  : File type identification<br>-
ssdeep: 3:/ls6z3P/tPUXBVnn:GYX+Tnn
PEiD  : -
RDS   : NSRL Reference Data Set<br>-







Voici le résultat obtenu en utilisant Virus Total pour le fichier 796DBB6BFD.sys :

Fichier 796DBB6BFD.sys reçu le 2009.07.07 15:58:39 (UTC)
Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.18 2009.07.07 -
AhnLab-V3 5.0.0.2 2009.07.07 -
AntiVir 7.9.0.204 2009.07.07 -
Antiy-AVL 2.0.3.1 2009.07.07 -
Authentium 5.1.2.4 2009.07.07 -
Avast 4.8.1335.0 2009.07.06 -
AVG 8.5.0.386 2009.07.07 -
BitDefender 7.2 2009.07.07 -
CAT-QuickHeal 10.00 2009.07.07 -
ClamAV 0.94.1 2009.07.07 -
Comodo 1538 2009.07.02 -
DrWeb 5.0.0.12182 2009.07.07 -
eSafe 7.0.17.0 2009.07.07 -
eTrust-Vet 31.6.6601 2009.07.07 -
F-Prot 4.4.4.56 2009.07.06 -
F-Secure 8.0.14470.0 2009.07.07 -
Fortinet 3.117.0.0 2009.07.03 -
GData 19 2009.07.07 -
Ikarus T3.1.1.64.0 2009.07.07 -
Jiangmin 11.0.706 2009.07.07 -
K7AntiVirus 7.10.786 2009.07.07 -
Kaspersky 7.0.0.125 2009.07.07 -
McAfee 5668 2009.07.06 -
McAfee+Artemis 5668 2009.07.06 -
McAfee-GW-Edition 6.8.5 2009.07.07 -
Microsoft 1.4803 2009.07.07 -
NOD32 4222 2009.07.07 -
Norman 6.01.09 2009.07.07 -
nProtect 2009.1.8.0 2009.07.07 -
Panda 10.0.0.14 2009.07.06 -
PCTools 4.4.2.0 2009.07.07 -
Rising 21.37.14.00 2009.07.07 -
Sophos 4.43.0 2009.07.07 -
Sunbelt 3.2.1858.2 2009.07.07 -
Symantec 1.4.4.12 2009.07.07 -
TheHacker 6.3.4.3.364 2009.07.06 -
TrendMicro 8.950.0.1094 2009.07.07 -
VBA32 3.12.10.7 2009.07.07 -
ViRobot 2009.7.7.1822 2009.07.07 -
VirusBuster 4.6.5.0 2009.07.06 -
Information additionnelle
File size: 88 bytes
MD5...: 7746eb86a6679d44e7a666bd1cc5e692
SHA1..: 3fe5fd98a592166fb0d65eb12623c1fb8e360738
SHA256: 986bdca0a1e7751ff96d70763d20c7d6a2c211d29128dc903573756b597f56fd
ssdeep: 3:hl/L/zprj:fLFj<br>
PEiD..: -
TrID..: File type identification<br>-
PEInfo: -
PDFiD.: -
RDS...: NSRL Reference Data Set<br>-

Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.18 2009.07.07 -
AhnLab-V3 5.0.0.2 2009.07.07 -
AntiVir 7.9.0.204 2009.07.07 -
Antiy-AVL 2.0.3.1 2009.07.07 -
Authentium 5.1.2.4 2009.07.07 -
Avast 4.8.1335.0 2009.07.06 -
AVG 8.5.0.386 2009.07.07 -
BitDefender 7.2 2009.07.07 -
CAT-QuickHeal 10.00 2009.07.07 -
ClamAV 0.94.1 2009.07.07 -
Comodo 1538 2009.07.02 -
DrWeb 5.0.0.12182 2009.07.07 -
eSafe 7.0.17.0 2009.07.07 -
eTrust-Vet 31.6.6601 2009.07.07 -
F-Prot 4.4.4.56 2009.07.06 -
F-Secure 8.0.14470.0 2009.07.07 -
Fortinet 3.117.0.0 2009.07.03 -
GData 19 2009.07.07 -
Ikarus T3.1.1.64.0 2009.07.07 -
Jiangmin 11.0.706 2009.07.07 -
K7AntiVirus 7.10.786 2009.07.07 -
Kaspersky 7.0.0.125 2009.07.07 -
McAfee 5668 2009.07.06 -
McAfee+Artemis 5668 2009.07.06 -
McAfee-GW-Edition 6.8.5 2009.07.07 -
Microsoft 1.4803 2009.07.07 -
NOD32 4222 2009.07.07 -
Norman 6.01.09 2009.07.07 -
nProtect 2009.1.8.0 2009.07.07 -
Panda 10.0.0.14 2009.07.06 -
PCTools 4.4.2.0 2009.07.07 -
Rising 21.37.14.00 2009.07.07 -
Sophos 4.43.0 2009.07.07 -
Sunbelt 3.2.1858.2 2009.07.07 -
Symantec 1.4.4.12 2009.07.07 -
TheHacker 6.3.4.3.364 2009.07.06 -
TrendMicro 8.950.0.1094 2009.07.07 -
VBA32 3.12.10.7 2009.07.07 -
ViRobot 2009.7.7.1822 2009.07.07 -
VirusBuster 4.6.5.0 2009.07.06 -

Information additionnelle
File size: 88 bytes
MD5...: 7746eb86a6679d44e7a666bd1cc5e692
SHA1..: 3fe5fd98a592166fb0d65eb12623c1fb8e360738
SHA256: 986bdca0a1e7751ff96d70763d20c7d6a2c211d29128dc903573756b597f56fd
ssdeep: 3:hl/L/zprj:fLFj<br>
PEiD..: -
TrID..: File type identification<br>-
PEInfo: -
PDFiD.: -
RDS...: NSRL Reference Data Set<br>-








Voici le rapport du RunFix de OTL :


All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
No active process named iexplore.exe was found!
No active process named firefox.exe was found!
No active process named msnmsgr.exe was found!
No active process named TeaTimer.exe was found!
========== SERVICES/DRIVERS ==========
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{0BF43445-2F28-4351-9252-17FE6E806AA0} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0BF43445-2F28-4351-9252-17FE6E806AA0}\ not found.
Registry value HKEY_USERS\S-1-5-21-339521165-2991531459-3914896407-1005\Software\Microsoft\Windows\CurrentVersion\Run\\Picasa Media Detector deleted successfully.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Compare Prices with &Dealio\ deleted successfully.
Starting removal of ActiveX control {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21}
C:\WINDOWS\Downloaded Program Files\mcinsctl.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ipp\ deleted successfully.
File Protocol\Handler\ipp - No CLSID value found not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\msdaipp\ deleted successfully.
File Protocol\Handler\msdaipp - No CLSID value found not found.
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Adobe Reader Speed Launcher deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\HP Software Update deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ISUSScheduler deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\QuickTime Task deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\SigmatelSysTrayApp deleted successfully.
========== FILES ==========
DllUnregisterServer procedure not found in C:\WINDOWS\System32\Smab0.dll
C:\WINDOWS\System32\Smab0.dll NOT unregistered.
C:\WINDOWS\System32\Smab0.dll moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrateur
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32768 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32768 bytes

User: LocalService
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 112094 bytes

User: mathieu
->Temp folder emptied: 109590075 bytes
->Temporary Internet Files folder emptied: 104259996 bytes
->Java cache emptied: 32476656 bytes
->FireFox cache emptied: 88994983 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 19569 bytes
%systemroot%\System32 .tmp files removed: 7323648 bytes
Windows Temp folder emptied: 72966163 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 396,55 mb


OTL by OldTimer - Version 3.0.6.5 log created on 07072009_175652

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

Voici le rapport de Findykill :


############################## | FindyKill V6.003 |

# User : mathieu (Administrateurs) # KIK
# Update on 07/07/09 by Chiquitine29 & C_XX
# Start at: 18:22:56 | 07/07/2009
# Website : http://pagesperso-orange.fr/NosTools/index.html

# Intel(R) Pentium(R) D CPU 2.80GHz
# Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 7.0.5730.11
# Windows Firewall Status : Enabled
# AV : AntiVir Desktop 9.0.1.26 [ Enabled | Updated ]

# C:\ # Disque fixe local # 134,52 Go (9,86 Go free) # NTFS
# D:\ # Disque CD-ROM
# E:\ # Disque CD-ROM
# F:\ # Disque fixe local # 465,65 Go (339,87 Go free) [IOMEGA_HDD] # FAT32
# G:\ # Disque amovible # 968,38 Mo (540,69 Mo free) # FAT

############################## | Processus actifs |

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology\ELService.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\WINDOWS\V0220Mon.exe
C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\SearchFilterHost.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Documents and Settings\mathieu\mathieu.exe

################## | Registre Startup |

HKCU_Main: "Local Page"="C:\\WINDOWS\\system32\\blank.htm"
HKCU_Main: "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
HKCU_Main: "Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
HKCU_Main: "Window Title"=""
HKLM_logon: "Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
HKLM_logon: "DefaultUserName"="mathieu"
HKLM_logon: "AltDefaultUserName"="mathieu"
HKLM_logon: "LegalNoticeCaption"=""
HKLM_logon: "LegalNoticeText"=""
HKLM_Run: ehTray=C:\WINDOWS\ehome\ehtray.exe
HKLM_Run: NvCplDaemon=RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
HKLM_Run: IAAnotif=C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
HKLM_Run: DMXLauncher=C:\Program Files\Dell\Media Experience\DMXLauncher.exe
HKLM_Run: ISUSPM Startup="C:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" -startup
HKLM_Run: DLA=C:\WINDOWS\System32\DLA\DLACTRLW.EXE
HKLM_Run: V0220Mon.exe=C:\WINDOWS\V0220Mon.exe
HKLM_Run: AVFX Engine=C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe
HKLM_Run: SunJavaUpdateSched="C:\Program Files\Java\jre6\bin\jusched.exe"
HKLM_Run: avgnt="C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
HKLM_Run: HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents=
HKCU_Run: MSMSGS="C:\Program Files\Messenger\msmsgs.exe" /background
HKCU_Run: Creative Live! Cam Manager="C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe"
HKCU_Run: ctfmon.exe=C:\WINDOWS\system32\ctfmon.exe
HKCU_Run: Creative Detector=C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
HKCU_Run: CTSyncU.exe="C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
HKCU_Run: mathieu=C:\Documents and Settings\mathieu\mathieu.exe /i

################## | Fichiers # Dossiers infectieux |

Présent ! C:\WINDOWS\system32\autorun.inf

################## | C:\Documents and Settings\mathieu\Temporary Internet Files |


################## | All Drives ... |


################## | Registre # Clés Run infectieuses |

Présent ! HKLM\software\microsoft\security center "AntiVirusDisableNotify" ( 0x1 )
Présent ! HKLM\software\microsoft\security center "FirewallDisableNotify" ( 0x1 )

################## | Registre # Mountpoints2 |


################## | Etat / Services / Informations |

# Affichage des fichiers cachés : OK

# Mode sans echec : OK

# Ndisuio -> Start = 3 ( Good = 3 | Bad = 4 )
# EapHost -> Start = 3 ( Good = 2 | Bad = 4 )
# Ip6Fw -> Start = 3 ( Good = 2 | Bad = 4 )
# SharedAccess -> Start = 2 ( Good = 2 | Bad = 4 )
# wuauserv -> Start = 2 ( Good = 2 | Bad = 4 )
# wscsvc -> Start = 2 ( Good = 2 | Bad = 4 )

################## | Cracks / Keygens / Serials |


################## | ! Fin du rapport # FindyKill V6.003 ! |

Non j'en ai aucune idée...

Tu pense que le problème pourrait venir de là ?

taille 22,4 Ko (22 941 octets)
taille sur le disque 24,0 Ko (24 576 octets)

Créé le : lundi 6 juillet 2009, 20:39:01
Modifié le : lundi 6 juillet 2009, 20:04:22
dernier accès le : mardi 7 juillet 2009, 18:34:11


Je sais pas si c'est ces infos que tu voulais avoir ?
désolé je suis loin d'être un expert en informatique...

Pas de souci pour hier soir. Tu m'as déjà beaucoup aidé sur ce coup là et je t'en remercie.

Par contre hier soir Antivir détectait un autre cheval de Troie. Je ne sais pas si c'est intelligent mais j'ai refait un contrôle du système avec antivir et du coup il m'a mis en quarantaine 3 fichiers. Depuis plus aucun problème ! J'ai l'impression que je me suis débarrasser des fichiers infectés.

Merci encore pour ton aide !

La suppression avec findykill est faite. Voici le rapport :


############################## | FindyKill V6.003 |

# User : mathieu (Administrateurs) # KIK
# Update on 07/07/09 by Chiquitine29 & C_XX
# Start at: 13:33:34 | 08/07/2009
# Website : http://pagesperso-orange.fr/NosTools/index.html

# Intel(R) Pentium(R) D CPU 2.80GHz
# Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 7.0.5730.11
# Windows Firewall Status : Enabled
# AV : AntiVir Desktop 9.0.1.26 [ Enabled | Updated ]

# C:\ # Disque fixe local # 134,52 Go (9,72 Go free) # NTFS
# D:\ # Disque CD-ROM
# E:\ # Disque CD-ROM
# F:\ # Disque fixe local # 465,65 Go (339,87 Go free) [IOMEGA_HDD] # FAT32
# G:\ # Disque amovible # 968,38 Mo (540,69 Mo free) # FAT

############################## | Processus actifs |

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology\ELService.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\WINDOWS\system32\SearchFilterHost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe

################## | Fichiers # Dossiers infectieux |

Supprimé ! C:\WINDOWS\system32\autorun.inf

################## | C:\Documents and Settings\mathieu\Temporary Internet Files |


################## | All Drives ... |


################## | Autres ... |


################## | Registre # Clés Run infectieuses |

# HKLM\software\microsoft\security center "AntiVirusDisableNotify" # -> Reset sucessfully !
# HKLM\software\microsoft\security center "FirewallDisableNotify" # -> Reset sucessfully !

################## | Registre # Mountpoints2 |


################## | Listing des fichiers présent |

[07/07/2009 15:00|--a------|21259] - C:\Ad-Report-CLEAN.log
[01/09/2005 07:17|--a------|0] - C:\AUTOEXEC.BAT
[30/05/2006 18:56|---hs----|209] - C:\boot.ini
[10/08/2004 13:00|-rahs----|4952] - C:\Bootfont.bin
[01/09/2005 07:17|--a------|0] - C:\CONFIG.SYS
[05/01/2007 21:47|--a------|12120] - C:\debug.log
[26/05/2006 14:27|-rah-----|5386] - C:\dell.sdr
[31/12/2007 14:40|--ahs----|753664] - C:\ehthumbs.db
[08/07/2009 13:52|--a------|3108] - C:\FindyKill.txt
[||] - C:\hiberfil.sys
[30/05/2006 19:58|--a------|4128] - C:\INFCACHE.1
[01/09/2005 07:17|--ah-----|0] - C:\IO.SYS
[26/05/2006 14:47|--ah-----|841] - C:\IPH.PH
[01/09/2005 07:17|--ah-----|0] - C:\MSDOS.SYS
[10/08/2004 13:00|-rahs----|47564] - C:\NTDETECT.COM
[01/09/2008 11:25|-rahs----|252240] - C:\ntldr
[||] - C:\pagefile.sys
[07/07/2009 10:48|--a------|918] - C:\rapport_clean.txt
[07/07/2009 10:52|--a------|194] - C:\resultat_clean.txt
[06/05/2009 23:12|--a------|594] - C:\updatedatfix.log
[07/07/2009 10:44|--a------|17825688] - C:\upload_moi_KIK.tar.gz
[07/07/2009 14:15|--a------|135] - C:\VundoFix.txt
[06/04/2008 16:55|--a------|561] - F:\Mes dossiers de partage.lnk
[14/02/2009 13:48|--ah-----|512] - G:\NIKON001.DSC

################## | Vaccination |

# C:\autorun.inf ( # Not infected ) -> Folder created by FindyKill.
# F:\autorun.inf ( # Not infected ) -> Folder created by FindyKill.

################## | Etat / Services / Informations |

# Mode sans echec : OK


# Affichage des fichiers cachés : OK

# Ndisuio -> Start = 3 ( Good = 3 | Bad = 4 )
# EapHost -> Start = 2 ( Good = 2 | Bad = 4 )
# Ip6Fw -> Start = 2 ( Good = 2 | Bad = 4 )
# SharedAccess -> Start = 2 ( Good = 2 | Bad = 4 )
# wuauserv -> Start = 2 ( Good = 2 | Bad = 4 )
# wscsvc -> Start = 2 ( Good = 2 | Bad = 4 )

################## | PEH ... |


################## | Cracks / Keygens / Serials |


################## | ! Fin du rapport # FindyKill V6.003 ! |

Oui tout à l'air normal maintenant !

Je n'ai plus qu'a te remercier car sans toi je n'aurais jamais pu m'en sortir tout seul.

Merci !!!

En fait j'ai trouver l'option dans les préférences de Antivir et la recherche des rootkits est bien cochée. Le scan est parti. Je te posterai le rapport dès qu'il aura fini.

Voila j'ai tout nettoyé comme indiqué dans ton message précèdent.

Je te remercie encore d'avoir pris le temps de m'aider. J'aurais été incapable de le faire tout seul.

Un grand merci !