Logiciel espion

Salut,

Télécharge http://sd-1.archive-host.com/membres/up/16506160323759868/AD-R.exe (de Cyrildu17 / C_XX) sur ton Bureau.

Déconnecte-toi du net et ferme toutes applications en cours.

1. Double-clique sur le programme d'installation ; laisse-le
s’ installer par défaut (C:\Program files).
2. Double-clique sur l'icône AD-Remover située sur ton Bureau.
(Pour Vista : clique droit > "Exécuter en tant qu'administrateur")
3. Au menu principal, choisis l'option L.
L’ outil débute sa recherche … Laisse-le travailler !
Le scan achevé, une fenêtre va s’ afficher.
4. Poste (copie-colle) le rapport qui apparaît à la fin.

(Tu trouveras aussi le rapport sous C:\Ad-report(date).log)
(CTRL+A pour tout sélectionner, CTRL+C pour copier et CTRL+V pour coller)

Note : "Process.exe", une composante de l'outil peut être
détecté par certains antivirus comme une infection ; donc, ne pas en tenir compte :
il s'agit d'un faux positif.

<gras>j'ai fait ceque vous m'avez demandé et voila le rapport :</gras>

.
======= RAPPORT D'AD-REMOVER 1.1.4.5_Q | UNIQUEMENT XP/VISTA/SEVEN =======
.
Mit à jour par C_XX le 26/08/2009 à 6:37 PM
Contact: AdRemover.contact@gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Lancé à: 19:49:02, 30/08/2009 | Mode Normal | Option: SCAN
Exécuté de: C:\Program Files\Ad-remover\
Système d'exploitation: Microsoft® Windows Vista™ v6.0.6001
Nom du PC: PC-HIBA | Utilisateur actuel: HIBA
.
.
============== ÉLÉMENT(S) TROUVÉ(S) ==============
.
.
HKCR\Interface\{cf54be1c-9359-4395-8533-1657cf209cfe}
HKCR\Typelib\{D518921A-4A03-425E-9873-B9A71756821E}
HKCU\Software\AppDataLow\Software\MyWebSearch
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF1-072E-44CF-8957-5838F569A31D}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA9-A523-4961-B6BB-170DE4475CCA}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EAB-A523-4961-B6BB-170DE4475CCA}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{25560540-9571-4D7B-9389-0F166788785A}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9FF05104-B030-46FC-94B8-81276E4E27DF}
HKLM\Software\Classes\Typelib\{D518921A-4A03-425E-9873-B9A71756821E}
HKLM\Software\Classes\Typelib\{D518921A-4A03-425E-9873-B9A71756821E}
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59C7FC09-1C83-4648-B3E6-003D2BBC7481}
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68AF847F-6E91-45DD-9B68-D6A12C30E5D7}
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170B96C-28D4-4626-8358-27E6CAEEF907}
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D1A71FA0-FF48-48DD-9B6D-7A13A3E42127}
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DDB1968E-EAD6-40FD-8DAE-FF14757F60C7}
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F138D901-86F0-4383-99B6-9CDD406036DA}
HKLM\Software\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\AskSearchAsst.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Ask.com Search Assistant
HKU\S-1-5-21-3066969076-1937047056-318044926-1000\Software\Appdatalow\Software\Fun Web Products
HKU\S-1-5-21-3066969076-1937047056-318044926-1000\Software\Appdatalow\Software\MyWebSearch
.
C:\Users\HIBA\AppData\LocalLow\FunWebProducts
C:\Users\HIBA\AppData\LocalLow\MyWebSearch
C:\Program Files\Ask Search Assistant
C:\Users\HIBA\Desktop\SweetImSetup.exe
C:\Program Files\Windows Live\Messenger\Riched20.dll
C:\Users\HIBA\AppData\Roaming\MICROS~1\Windows\Cookies\hiba@zwinky[2].txt
.
============== Scan additionnel ==============
.
.
.
.
* Internet Explorer Version 8.0.6001.18372 *
.
[HKEY_CURRENT_USER\..\Internet Explorer\Main]
.
Search Page: hxxp://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*hxxp://www.yahoo.com
Start Page: hxxp://www.tattoodle.com?tid={7D64F8F9-B856-4d90-B933-4268F81386E5}&v=12
Default_Page_URL: hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=040c&s=2&o=vp32&d=1008&m=aspire_5735
Search Bar: hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*hxxp://www.yahoo.com/ext/search/search.html
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]
.
Start Page: hxxp://www.yahoo.com/
Default_Search_URL: hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*hxxp://www.yahoo.com
Search Page: hxxp://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*hxxp://www.yahoo.com
Default_Page_URL: hxxp://www.yahoo.com/
Search Bar: hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*hxxp://www.yahoo.com/ext/search/search.html
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]
.
Tabs: hxxp://www.fastbrowsersearch.com/new-tab/?v=18&tid={7D64F8F9-B856-4d90-B933-4268F81386E5}
.
===================================
.
4182 Octet(s) - C:\Ad-Report-SCAN.log
.
2104 Fichier(s) - C:\Users\HIBA\AppData\Local\Temp
1768 Fichier(s) - C:\Windows\Temp
.
0 Fichier(s) - C:\Program Files\Ad-remover\BACKUP
0 Fichier(s) - C:\Program Files\Ad-remover\QUARANTINE
.
Fin à: 19:56:21 | 30/08/2009
.
============== E.O.F ==============
.

..

C' est parfait.

Je vois "Eléments trouvés" mais, ... pas "Neutralisés" !

Tu as bien fais le choix "L" (Lancer le nettoyage) ?

---
Maintenant, télécharge, installe et mets à jour Malwarebytes Anti-Malwares …
http://forum.telecharger.01net.com/... puis, lance un scan COMPLET et poste le rapport.

PS : si MalwareByte's a détecté des infections, clique sur Afficher les résultats,
puis sur Supprimer la sélection.

Ensuite, ...

Fais un scan HijackThis :
http://forum.telecharger.01net.com/... ... et poste le rapport.

---
PS : essaie de poster les deux rapports dans la même réponse.

Vous avez raison j'ai fait "S"au lieu de"L"

je viens de faire : voila le rapport et merci infiniment pour votre suivi :)

.
======= RAPPORT D'AD-REMOVER 1.1.4.5_Q | UNIQUEMENT XP/VISTA/SEVEN =======
.
Mit à jour par C_XX le 26/08/2009 à 6:37 PM
Contact: AdRemover.contact@gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Lancé à: 23:49:56, 30/08/2009 | Mode Normal | Option: CLEAN
Exécuté de: C:\Program Files\Ad-remover\
Système d'exploitation: Microsoft® Windows Vista™ v6.0.6001
Nom du PC: PC-HIBA | Utilisateur actuel: HIBA
.
.
============== ÉLÉMENT(S) NEUTRALISÉ(S) ==============
.
.
HKCR\Interface\{cf54be1c-9359-4395-8533-1657cf209cfe}
HKCR\Typelib\{D518921A-4A03-425E-9873-B9A71756821E}
HKCU\Software\AppDataLow\Software\MyWebSearch
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF1-072E-44CF-8957-5838F569A31D}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA9-A523-4961-B6BB-170DE4475CCA}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EAB-A523-4961-B6BB-170DE4475CCA}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{25560540-9571-4D7B-9389-0F166788785A}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9FF05104-B030-46FC-94B8-81276E4E27DF}
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59C7FC09-1C83-4648-B3E6-003D2BBC7481}
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68AF847F-6E91-45DD-9B68-D6A12C30E5D7}
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170B96C-28D4-4626-8358-27E6CAEEF907}
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D1A71FA0-FF48-48DD-9B6D-7A13A3E42127}
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DDB1968E-EAD6-40FD-8DAE-FF14757F60C7}
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F138D901-86F0-4383-99B6-9CDD406036DA}
HKLM\Software\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\AskSearchAsst.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Ask.com Search Assistant
HKU\S-1-5-21-3066969076-1937047056-318044926-1000\Software\Appdatalow\Software\Fun Web Products
.
C:\Users\HIBA\AppData\LocalLow\FunWebProducts\Data
C:\Users\HIBA\AppData\LocalLow\FunWebProducts\Installr
C:\Users\HIBA\AppData\LocalLow\FunWebProducts\Shared
C:\Users\HIBA\AppData\LocalLow\FunWebProducts\Data\avatar.dat
C:\Users\HIBA\AppData\LocalLow\FunWebProducts\Data\outfit.dat
C:\Users\HIBA\AppData\LocalLow\FunWebProducts\Data\register.dat
C:\Users\HIBA\AppData\LocalLow\FunWebProducts\Data\zbucks.dat
C:\Users\HIBA\AppData\LocalLow\FunWebProducts\Installr\Cache
C:\Users\HIBA\AppData\LocalLow\FunWebProducts\Installr\Cache\064AD5E5.exe
C:\Users\HIBA\AppData\LocalLow\FunWebProducts\Installr\Cache\files.ini
C:\Users\HIBA\AppData\LocalLow\FunWebProducts
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Avatar
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Cache
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\History
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Message
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Settings
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Avatar\COMMON
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Avatar\COMMON\avatar.htm
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Avatar\COMMON\bgfadel.gif
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Avatar\COMMON\bgfader.gif
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Avatar\COMMON\common-x.css
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Avatar\COMMON\common.css
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Avatar\COMMON\cornerbl.gif
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Avatar\COMMON\cornerbr.gif
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Avatar\COMMON\ext_def.gif
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Avatar\COMMON\ext_roll.gif
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Avatar\COMMON\include.js
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Avatar\COMMON\index.htm
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Avatar\COMMON\loader.htm
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Avatar\COMMON\loading.gif
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Avatar\COMMON\logo.gif
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Avatar\COMMON\max_def.gif
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Avatar\COMMON\max_roll.gif
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Avatar\COMMON\min_def.gif
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Avatar\COMMON\min_roll.gif
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Avatar\COMMON\noflash.htm
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Avatar\COMMON\res_def.gif
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Avatar\COMMON\res_roll.gif
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Avatar\COMMON\spacer.gif
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Avatar\COMMON\spacer.swf
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Avatar\COMMON\topgrad.gif
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Avatar\COMMON\window.ico
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Cache\064B1FEF
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Cache\064B255B
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Cache\064B31D9
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Cache\064B3321.bin
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Cache\064B3449.bin
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Cache\064B35FE.bin
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Cache\064B37E2.bin
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Cache\064B3929.bin
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Cache\0678FD91.bin
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Cache\0678FEAA.bin
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Cache\0678FFC3.bin
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Cache\067900DC.bin
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Cache\files.ini
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\History\search3
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Message\COMMON
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Message\COMMON\ask_logo.gif
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Message\COMMON\autoup.gif
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Message\COMMON\autoup.htm
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Message\COMMON\center.htm
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Message\COMMON\index.htm
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Message\COMMON\mid_dots.gif
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Message\COMMON\mws_logo.gif
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Message\COMMON\protect.htm
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Message\COMMON\shocked.gif
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Message\COMMON\stop.gif
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Message\COMMON\systray.htm
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Message\COMMON\systrayp.htm
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Message\COMMON\tp_grad.gif
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Message\COMMON\warn.gif
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Settings\prevcfg2.htm
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Settings\setting2.htm
C:\Users\HIBA\AppData\LocalLow\MyWebSearch\bar\Settings\settings.dat
C:\Users\HIBA\AppData\LocalLow\MyWebSearch
C:\Program Files\Ask Search Assistant\ask.ico
C:\Program Files\Ask Search Assistant\AskSearchAsst.ini
C:\Program Files\Ask Search Assistant\Install.asa.log
C:\Program Files\Ask Search Assistant\uninst.exe
C:\Program Files\Ask Search Assistant
C:\Users\HIBA\Desktop\SweetImSetup.exe
C:\Program Files\Windows Live\Messenger\riched20.dll
C:\Users\HIBA\AppData\Roaming\MICROS~1\Windows\Cookies\hiba@zwinky[2].txt

(!) -- Fichiers temporaires supprimés.

.
============== Scan additionnel ==============
.
.
.
.
* Internet Explorer Version 8.0.6001.18372 *
.
[HKEY_CURRENT_USER\..\Internet Explorer\Main]
.
Search Page: hxxp://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*hxxp://www.yahoo.com
Start Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Search Bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Default_search_url: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]
.
Start Page: hxxp://fr.msn.com/
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Search Bar: hxxp://search.msn.com/spbasic.htm
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]
.
Tabs: res://ieframe.dll/tabswelcome.htm
.
===================================
.
9250 Octet(s) - C:\Ad-Report-CLEAN.log
4499 Octet(s) - C:\Ad-Report-SCAN.log
.
2044 Fichier(s) - C:\Users\HIBA\AppData\Local\Temp
55 Fichier(s) - C:\Windows\Temp
.
20 Fichier(s) - C:\Program Files\Ad-remover\BACKUP
11 Fichier(s) - C:\Program Files\Ad-remover\QUARANTINE
.
Fin à: 23:57:48 | 30/08/2009
.
============== E.O.F ==============
.

...

Je préfère cela ...

Fais la suite et ça devrait être bon.

Je vais finir demain soir, je vais DODO mnt :) j'espère que je vais réussir à nettoyer mon pc

Merci bcp bcp

à demain

Bonsoir,

Voila les deux rapport mon cher expert :) :)

le 1er rapport :
Malwarebytes' Anti-Malware 1.40
Version de la base de données: 2722
Windows 6.0.6001 Service Pack 1

31/08/2009 22:10:21
mbam-log-2009-08-31 (22-10-21).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 227569
Temps écoulé: 1 hour(s), 13 minute(s), 41 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 5

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Program Files\Ad-remover\QUARANTINE\PROGRA~1\WI1F86~1\MESSEN~1\riched20.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\JetAudio\jetUpdate.exe (Rogue.MalwareSweeper) -> Quarantined and deleted successfully.
C:\Users\Public\Favorites\netservice.exe (Backdoor.Agent) -> Delete on reboot.
C:\Users\Public\Favorites\NginuL_na.exe (Worm.AutoRun) -> Delete on reboot.
C:\Users\Public\Favorites\plug\001.dll (Backdoor.Agent) -> Delete on reboot.

le 2ème rapport :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:20:09, on 31/08/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18372)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\PLFSetI.exe
C:\Users\HIBA\AppData\Local\Temp\RtkBtMnt.exe
C:\Program Files\Launch Manager\LManager.exe
C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe
C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Athan\Athan.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Nokia\PC Internet Access\NPCIA.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\igfxext.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10b.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\PC Connectivity Solution\Transports\NclIrSrv.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.microsoft.com/fwlink/?linkid=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://recherche.neuf.fr/ie/default.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: SearchHelper Class - {91C18ED5-5E1C-4AE5-A148-A861DE8C8E16} - C:\Program Files\SGPSA\mtwb3sh.dll (file missing)
O1 - Hosts: ::1 localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Search Assistant - {F0626A63-410B-45E2-99A1-3F2475B2D695} - C:\Program Files\SGPSA\BHO.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [BkupTray] "C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKLM\..\Run: [PLFSetI] C:\Windows\PLFSetI.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe
O4 - HKLM\..\Run: [ePower_DMC] C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [ProductReg] "C:\Program Files\Acer\WR_PopUp\ProductReg.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Athan] C:\Program Files\Athan\Athan.exe
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe" /NoDialog
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [NokiaPCInternetAccess] "C:\Program Files\Nokia\PC Internet Access\NPCIA.exe" /b
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Showbalm] "C:\ProgramData\jump program program.j0etxb"
O4 - HKCU\..\Run: [ANTI LITE TITLE DEBUG] "C:\ProgramData\option dupe tool.63g5px8"
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {04CB5B64-5915-4629-B869-8945CEBADD21} (Module de délivrance de certificat MINEFI) - https://static.impots.gouv.fr/abos/static/securite/certdgi1.cab
O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerVistaADP-2.0.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Service Google Update (gupdate1c9d52578b6163a) (gupdate1c9d52578b6163a) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

Salut,

Désactive les protections résidentes (Antivirus, etc...).
Tu les réactiveras par la suite.

* Télécharger Lop S&D (par Eric71) sur ton bureau :
http://eric.71.mespages.googlepages.com/LopSD.exe

* Double-clique dessus pour lancer l'installation
* Puis, double-clique sur le raccourci Lop S&D présent sur le bureau
* Choisis la langue souhaitée, puis choisir l'Option 1.
* Patiente jusqu'à la fin du scan.
* Poster le rapport généré (C:\lopR.txt)

PS : si le Bureau ne réapparait pas, fais Ctrl/Alt/Suppr, onglet "Fichier",
Nouvelle tâche, tape explorer.exe et valide.

Bonsoir mon cher expert :)

voilà le rapport :


--------------------\\ Lop S&D 4.2.5-0 XP/Vista

Microsoft® Windows Vista™ Édition Familiale Premium ( v6.0.6001 ) Service Pack 1
X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) Dual CPU T3200 @ 2.00GHz )
BIOS : Ver 1.00PARTTBL
USER : HIBA ( Administrator )
BOOT : Normal boot
C:\ (Local Disk) - NTFS - Total:69 Go (Free:30 Go)
D:\ (Local Disk) - NTFS - Total:69 Go (Free:68 Go)
E:\ (CD or DVD) - CDFS - Total:0 Go (Free:0 Go)

"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
Option : [1] ( 01/09/2009|21:24 )

[ UAC => 1 ]

--------------------\\ Listing des dossiers dans Local

[13/03/2009|13:50] C:\Users\HIBA\AppData\Local\Adobe
[13/01/2009|00:05] C:\Users\HIBA\AppData\Local\Apple
[13/01/2009|00:32] C:\Users\HIBA\AppData\Local\Apple Computer
[29/10/2008|22:48] C:\Users\HIBA\AppData\Local\Application Data
[31/03/2009|00:06] C:\Users\HIBA\AppData\Local\d3d9caps.dat
[03/06/2009|11:38] C:\Users\HIBA\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[02/03/2009|02:00] C:\Users\HIBA\AppData\Local\GDIPFONTCACHEV1.DAT
[11/07/2009|06:14] C:\Users\HIBA\AppData\Local\Google
[29/10/2008|22:48] C:\Users\HIBA\AppData\Local\Historique
[01/09/2009|18:02] C:\Users\HIBA\AppData\Local\IconCache.db
[18/02/2009|22:26] C:\Users\HIBA\AppData\Local\IsolatedStorage
[27/08/2009|00:54] C:\Users\HIBA\AppData\Local\Microsoft
[05/11/2008|15:06] C:\Users\HIBA\AppData\Local\Microsoft Help
[18/02/2009|22:59] C:\Users\HIBA\AppData\Local\MyPhotoFun
[01/09/2009|21:23] C:\Users\HIBA\AppData\Local\Temp
[29/10/2008|22:48] C:\Users\HIBA\AppData\Local\Temporary Internet Files
[21/12/2008|22:50] C:\Users\HIBA\AppData\Local\VirtualStore
[28/04/2009|01:55] C:\Users\HIBA\AppData\Local\Yahoo

--------------------\\ Tâches planifiées dans C:\Windows\tasks

[01/09/2009 21:19][--a------] C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[01/09/2009 19:19][--a------] C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[01/09/2009 19:19][--ah-----] C:\Windows\tasks\SA.DAT
[01/09/2009 18:02][--a------] C:\Windows\tasks\SCHEDLGU.TXT

--------------------\\ Listing des dossiers dans C:\ProgramData

[08/05/2008|08:15] C:\ProgramData\{174892B1-CBE7-44F5-86FF-AB555EFD73A3}
[13/01/2009|00:08] C:\ProgramData\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
[02/03/2009|01:54] C:\ProgramData\Adobe
[13/01/2009|00:04] C:\ProgramData\Apple
[13/01/2009|00:07] C:\ProgramData\Apple Computer
[02/11/2006|15:02] C:\ProgramData\Application Data
[09/03/2009|12:47] C:\ProgramData\Avira
[29/10/2008|22:44] C:\ProgramData\Bureau
[04/11/2008|23:34] C:\ProgramData\CyberLink
[02/11/2006|15:02] C:\ProgramData\Desktop
[02/11/2006|15:02] C:\ProgramData\Documents
[16/10/2008|07:34] C:\ProgramData\eSobi
[29/10/2008|23:19] C:\ProgramData\ezsidmv.dat
[29/10/2008|22:44] C:\ProgramData\Favoris
[02/11/2006|15:02] C:\ProgramData\Favorites
[08/05/2008|08:16] C:\ProgramData\FloodLightGames
[27/06/2009|10:06] C:\ProgramData\Google
[24/11/2008|19:30] C:\ProgramData\Hewlett-Packard
[25/11/2008|08:30] C:\ProgramData\HP
[10/03/2009|19:54] C:\ProgramData\HP Product Assistant
[24/11/2008|19:36] C:\ProgramData\HPSSUPPLY
[29/06/2009|14:21] C:\ProgramData\hpzinstall.log
[17/12/2008|01:59] C:\ProgramData\Installations
[07/03/2009|23:57] C:\ProgramData\jump program program.77yvu
[07/03/2009|23:57] C:\ProgramData\jump program program.j0etxb
[31/08/2009|20:52] C:\ProgramData\Malwarebytes
[09/03/2009|12:58] C:\ProgramData\McAfee
[29/10/2008|22:44] C:\ProgramData\Menu D‚marrer
[17/01/2009|22:47] C:\ProgramData\Messenger Plus!
[03/02/2009|21:15] C:\ProgramData\Microsoft
[03/02/2009|21:44] C:\ProgramData\Microsoft Help
[29/10/2008|22:44] C:\ProgramData\ModŠles
[18/02/2009|22:58] C:\ProgramData\MyPhotoFun France
[09/03/2009|12:59] C:\ProgramData\Okay meta anti lite
[07/03/2009|23:57] C:\ProgramData\option dupe tool.63g5px8
[23/11/2008|22:05] C:\ProgramData\PC Suite
[31/10/2008|09:56] C:\ProgramData\SiteAdvisor
[29/10/2008|23:15] C:\ProgramData\Skype
[30/08/2009|19:47] C:\ProgramData\Spybot - Search & Destroy
[02/11/2006|15:02] C:\ProgramData\Start Menu
[02/11/2006|15:02] C:\ProgramData\Templates
[09/03/2009|13:32] C:\ProgramData\trustface
[24/11/2008|19:37] C:\ProgramData\WEBREG
[05/11/2008|00:01] C:\ProgramData\WLInstaller
[28/04/2009|01:36] C:\ProgramData\Yahoo!
[19/05/2009|15:44] C:\ProgramData\Yahoo! Companion

--------------------\\ Listing des dossiers dans C:\Program Files

[29/10/2008|22:49] C:\Program Files\Acer
[04/11/2008|23:49] C:\Program Files\Acer GameZone
[16/10/2008|07:35] C:\Program Files\Acer Inc
[08/05/2008|08:02] C:\Program Files\Acer Incorporated
[08/05/2008|08:15] C:\Program Files\Activation Assistant for the 2007 Microsoft Office suites
[10/03/2009|13:55] C:\Program Files\Adobe
[31/08/2009|00:00] C:\Program Files\Ad-remover
[13/01/2009|00:05] C:\Program Files\Apple Software Update
[13/04/2009|22:34] C:\Program Files\Athan
[09/03/2009|12:47] C:\Program Files\Avira
[08/05/2008|08:25] C:\Program Files\Big Kahuna Reef
[13/01/2009|00:07] C:\Program Files\Bonjour
[09/03/2009|13:04] C:\Program Files\Circl Developement
[09/03/2009|12:58] C:\Program Files\Common Files
[16/10/2008|07:27] C:\Program Files\Convesoft
[08/05/2008|08:30] C:\Program Files\Cyberlink
[23/11/2008|21:55] C:\Program Files\DIFX
[04/11/2008|23:29] C:\Program Files\eSobi
[19/07/2009|21:03] C:\Program Files\Fast Browser Search
[29/10/2008|22:44] C:\Program Files\Fichiers communs [C:\Program Files\Common Files]
[30/10/2008|21:28] C:\Program Files\FreeCall.com
[28/06/2009|21:45] C:\Program Files\Google
[24/11/2008|19:33] C:\Program Files\Hewlett-Packard
[24/11/2008|19:36] C:\Program Files\HP
[27/12/2008|20:45] C:\Program Files\InstallShield Installation Information
[30/04/2008|09:21] C:\Program Files\Intel
[29/01/2009|02:40] C:\Program Files\Internet Explorer
[13/01/2009|00:07] C:\Program Files\iPod
[13/01/2009|00:08] C:\Program Files\iTunes
[31/08/2009|22:10] C:\Program Files\JetAudio
[16/10/2008|07:30] C:\Program Files\Launch Manager
[31/10/2008|14:29] C:\Program Files\L'Aventure Multimedia
[22/05/2009|23:02] C:\Program Files\LingvoSoft
[31/08/2009|20:52] C:\Program Files\Malwarebytes' Anti-Malware
[30/04/2008|09:23] C:\Program Files\Marvell
[23/05/2009|23:51] C:\Program Files\Messenger Plus! Live
[29/10/2008|23:36] C:\Program Files\Microsoft
[02/11/2006|14:37] C:\Program Files\Microsoft Games
[26/08/2009|00:09] C:\Program Files\Microsoft Office
[29/10/2008|23:17] C:\Program Files\Microsoft SQL Server Compact Edition
[11/06/2009|09:12] C:\Program Files\Microsoft Works
[08/05/2008|08:12] C:\Program Files\Microsoft.NET
[08/05/2008|19:02] C:\Program Files\Movie Maker
[02/11/2006|14:37] C:\Program Files\MSBuild
[26/08/2009|00:08] C:\Program Files\MSECache
[30/10/2008|08:58] C:\Program Files\MSXML 4.0
[18/02/2009|22:25] C:\Program Files\MyPhotoFun France
[29/10/2008|22:55] C:\Program Files\Neuf
[08/05/2008|08:27] C:\Program Files\NewTech Infosystems
[17/12/2008|02:00] C:\Program Files\Nokia
[23/11/2008|21:54] C:\Program Files\PC Connectivity Solution
[13/01/2009|00:06] C:\Program Files\QuickTime
[08/12/2008|12:19] C:\Program Files\Real
[16/10/2008|07:28] C:\Program Files\Realtek
[02/11/2006|14:37] C:\Program Files\Reference Assemblies
[14/08/2009|07:29] C:\Program Files\SGPSA
[29/10/2008|23:15] C:\Program Files\Skype
[30/08/2009|20:59] C:\Program Files\Spybot - Search & Destroy
[30/04/2008|09:25] C:\Program Files\Synaptics
[01/06/2009|11:18] C:\Program Files\TeamViewer3
[31/08/2009|23:19] C:\Program Files\Trend Micro
[02/11/2006|15:01] C:\Program Files\Uninstall Information
[08/05/2008|19:02] C:\Program Files\Windows Calendar
[08/05/2008|19:02] C:\Program Files\Windows Collaboration
[08/05/2008|19:02] C:\Program Files\Windows Defender
[08/05/2008|19:02] C:\Program Files\Windows Journal
[05/11/2008|00:03] C:\Program Files\Windows Live
[14/08/2009|07:29] C:\Program Files\Windows Mail
[14/08/2009|07:37] C:\Program Files\Windows Media Player
[29/10/2008|22:44] C:\Program Files\Windows NT
[08/05/2008|19:02] C:\Program Files\Windows Photo Gallery
[08/05/2008|19:02] C:\Program Files\Windows Sidebar
[28/04/2009|01:36] C:\Program Files\Yahoo!

--------------------\\ Listing des dossiers dans C:\Program Files\Common Files

[10/03/2009|13:55] C:\Program Files\Common Files\Adobe
[13/01/2009|00:07] C:\Program Files\Common Files\Apple
[31/10/2008|00:29] C:\Program Files\Common Files\DESIGNER
[24/11/2008|19:33] C:\Program Files\Common Files\Hewlett-Packard
[24/11/2008|19:35] C:\Program Files\Common Files\HP
[27/12/2008|20:36] C:\Program Files\Common Files\InstallShield
[08/05/2008|08:27] C:\Program Files\Common Files\LightScribe
[06/03/2009|10:55] C:\Program Files\Common Files\microsoft shared
[08/05/2008|08:26] C:\Program Files\Common Files\muvee Technologies
[23/11/2008|21:55] C:\Program Files\Common Files\Nokia
[23/11/2008|21:55] C:\Program Files\Common Files\PCSuite
[08/12/2008|12:20] C:\Program Files\Common Files\Real
[02/11/2006|13:18] C:\Program Files\Common Files\Services
[29/10/2008|23:15] C:\Program Files\Common Files\Skype
[02/11/2006|13:18] C:\Program Files\Common Files\SpeechEngines
[03/02/2009|21:17] C:\Program Files\Common Files\System
[29/10/2008|23:32] C:\Program Files\Common Files\Windows Live
[29/10/2008|23:14] C:\Program Files\Common Files\WindowsLiveInstaller
[08/12/2008|12:20] C:\Program Files\Common Files\xing shared

--------------------\\ Process

( 104 Processes )

iexplore.exe ~ [PID:6136]
iexplore.exe ~ [PID:4016]
iexplore.exe ~ [PID:2988]
iexplore.exe ~ [PID:4204]

--------------------\\ Recherche avec S_Lop

C:\ProgramData\jump program program.77yvu
C:\ProgramData\jump program program.j0etxb
C:\ProgramData\option dupe tool.63g5px8

--------------------\\ Recherche de Fichiers / Dossiers Lop

C:\ProgramData\Okay meta anti lite
C:\ProgramData\Okay meta anti lite\BOWS DOG.dat
C:\Users\HIBA\AppData\Local\Temp\nstB00E.tmp
C:\Users\HIBA\AppData\Local\Temp\nsx2D28.tmp
C:\Users\HIBA\AppData\Roaming\MICROS~1\Windows\Cookies\hiba@advertising[2].txt

--------------------\\ Verification du Registre

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Showbalm"="\"C:\\ProgramData\\jump program program.j0etxb\""
"ANTI LITE TITLE DEBUG"="\"C:\\ProgramData\\option dupe tool.63g5px8\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

--------------------\\ Verification du fichier Hosts

Fichier Hosts PROPRE


--------------------\\ Recherche de fichiers avec Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-01 21:24:37
Windows 6.0.6001 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 3

--------------------\\ Recherche d'autres infections


Aucune autre infection trouvée !

[F:3111][D:167]-> C:\Users\HIBA\AppData\Local\Temp
[F:3278][D:1]-> C:\Users\HIBA\AppData\Roaming\MICROS~1\Windows\Cookies
[F:1563][D:7]-> C:\Users\HIBA\AppData\Local\MICROS~1\Windows\TEMPOR~1\content.IE5
[F:6][D:2]-> C:\$Recycle.Bin

1 - "C:\Lop SD\LopR_1.txt" - 01/09/2009|21:27 - Option : [1]

--------------------\\ Fin du rapport a 21:27:56
[ UAC => 1 ]


quoi faire !! est ce que mon cher PC est sauvé ou pas encore :) lol

Salut,

Relance Lop S&D

* Choisis l'Option 2 (Suppression)
* Ne ferme pas la fenêtre lors de la suppression !
* Poste le rapport généré (C:\lopR.txt)

PS : si le Bureau ne réapparaît pas, fais Ctrl/Alt/Suppr, onglet "Fichier",
Nouvelle tâche, tape explorer.exe et valide.

Bonsoir,

Voilà le rapport :

--------------------\\ Lop S&D 4.2.5-0 XP/Vista

Microsoft® Windows Vista™ Édition Familiale Premium ( v6.0.6001 ) Service Pack 1
X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) Dual CPU T3200 @ 2.00GHz )
BIOS : Ver 1.00PARTTBL
USER : HIBA ( Administrator )
BOOT : Normal boot
C:\ (Local Disk) - NTFS - Total:69 Go (Free:30 Go)
D:\ (Local Disk) - NTFS - Total:69 Go (Free:68 Go)
E:\ (CD or DVD) - CDFS - Total:0 Go (Free:0 Go)

"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
Option : [2] ( 02/09/2009|21:47 )

[ UAC => 1 ]


\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ SUPPRESSION

Supprime! - C:\ProgramData\Okay meta anti lite\BOWS DOG.dat
Supprime! - C:\Users\HIBA\AppData\Local\Temp\nstB00E.tmp
Supprime! - C:\Users\HIBA\AppData\Local\Temp\nsx2D28.tmp
Supprime! - C:\Users\HIBA\AppData\Roaming\MICROS~1\Windows\Cookies\hiba@advertising[2].txt
Supprime! - C:\ProgramData\jump program program.77yvu
Supprime! - C:\ProgramData\jump program program.j0etxb
Supprime! - C:\ProgramData\option dupe tool.63g5px8
Supprime! - C:\ProgramData\Okay meta anti lite
-
[ Fichier Hosts ] .. Restaure!

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\


--------------------\\ Listing des dossiers dans Local

[13/03/2009|13:50] C:\Users\HIBA\AppData\Local\Adobe
[13/01/2009|00:05] C:\Users\HIBA\AppData\Local\Apple
[13/01/2009|00:32] C:\Users\HIBA\AppData\Local\Apple Computer
[29/10/2008|22:48] C:\Users\HIBA\AppData\Local\Application Data
[31/03/2009|00:06] C:\Users\HIBA\AppData\Local\d3d9caps.dat
[03/06/2009|11:38] C:\Users\HIBA\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[02/03/2009|02:00] C:\Users\HIBA\AppData\Local\GDIPFONTCACHEV1.DAT
[11/07/2009|06:14] C:\Users\HIBA\AppData\Local\Google
[29/10/2008|22:48] C:\Users\HIBA\AppData\Local\Historique
[02/09/2009|08:32] C:\Users\HIBA\AppData\Local\IconCache.db
[18/02/2009|22:26] C:\Users\HIBA\AppData\Local\IsolatedStorage
[27/08/2009|00:54] C:\Users\HIBA\AppData\Local\Microsoft
[05/11/2008|15:06] C:\Users\HIBA\AppData\Local\Microsoft Help
[18/02/2009|22:59] C:\Users\HIBA\AppData\Local\MyPhotoFun
[02/09/2009|21:47] C:\Users\HIBA\AppData\Local\Temp
[29/10/2008|22:48] C:\Users\HIBA\AppData\Local\Temporary Internet Files
[21/12/2008|22:50] C:\Users\HIBA\AppData\Local\VirtualStore
[28/04/2009|01:55] C:\Users\HIBA\AppData\Local\Yahoo

--------------------\\ Tâches planifiées dans C:\Windows\tasks

[02/09/2009 21:19][--a------] C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[02/09/2009 20:50][--a------] C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[02/09/2009 20:50][--ah-----] C:\Windows\tasks\SA.DAT
[02/09/2009 08:32][--a------] C:\Windows\tasks\SCHEDLGU.TXT

--------------------\\ Listing des dossiers dans C:\ProgramData

[08/05/2008|08:15] C:\ProgramData\{174892B1-CBE7-44F5-86FF-AB555EFD73A3}
[13/01/2009|00:08] C:\ProgramData\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
[02/03/2009|01:54] C:\ProgramData\Adobe
[13/01/2009|00:04] C:\ProgramData\Apple
[13/01/2009|00:07] C:\ProgramData\Apple Computer
[02/11/2006|15:02] C:\ProgramData\Application Data
[09/03/2009|12:47] C:\ProgramData\Avira
[29/10/2008|22:44] C:\ProgramData\Bureau
[04/11/2008|23:34] C:\ProgramData\CyberLink
[02/11/2006|15:02] C:\ProgramData\Desktop
[02/11/2006|15:02] C:\ProgramData\Documents
[16/10/2008|07:34] C:\ProgramData\eSobi
[29/10/2008|23:19] C:\ProgramData\ezsidmv.dat
[29/10/2008|22:44] C:\ProgramData\Favoris
[02/11/2006|15:02] C:\ProgramData\Favorites
[08/05/2008|08:16] C:\ProgramData\FloodLightGames
[27/06/2009|10:06] C:\ProgramData\Google
[24/11/2008|19:30] C:\ProgramData\Hewlett-Packard
[25/11/2008|08:30] C:\ProgramData\HP
[10/03/2009|19:54] C:\ProgramData\HP Product Assistant
[24/11/2008|19:36] C:\ProgramData\HPSSUPPLY
[29/06/2009|14:21] C:\ProgramData\hpzinstall.log
[17/12/2008|01:59] C:\ProgramData\Installations
[31/08/2009|20:52] C:\ProgramData\Malwarebytes
[09/03/2009|12:58] C:\ProgramData\McAfee
[29/10/2008|22:44] C:\ProgramData\Menu D‚marrer
[17/01/2009|22:47] C:\ProgramData\Messenger Plus!
[03/02/2009|21:15] C:\ProgramData\Microsoft
[03/02/2009|21:44] C:\ProgramData\Microsoft Help
[29/10/2008|22:44] C:\ProgramData\ModŠles
[18/02/2009|22:58] C:\ProgramData\MyPhotoFun France
[23/11/2008|22:05] C:\ProgramData\PC Suite
[31/10/2008|09:56] C:\ProgramData\SiteAdvisor
[29/10/2008|23:15] C:\ProgramData\Skype
[30/08/2009|19:47] C:\ProgramData\Spybot - Search & Destroy
[02/11/2006|15:02] C:\ProgramData\Start Menu
[02/11/2006|15:02] C:\ProgramData\Templates
[09/03/2009|13:32] C:\ProgramData\trustface
[24/11/2008|19:37] C:\ProgramData\WEBREG
[05/11/2008|00:01] C:\ProgramData\WLInstaller
[28/04/2009|01:36] C:\ProgramData\Yahoo!
[19/05/2009|15:44] C:\ProgramData\Yahoo! Companion

--------------------\\ Listing des dossiers dans C:\Program Files

[29/10/2008|22:49] C:\Program Files\Acer
[04/11/2008|23:49] C:\Program Files\Acer GameZone
[16/10/2008|07:35] C:\Program Files\Acer Inc
[08/05/2008|08:02] C:\Program Files\Acer Incorporated
[08/05/2008|08:15] C:\Program Files\Activation Assistant for the 2007 Microsoft Office suites
[10/03/2009|13:55] C:\Program Files\Adobe
[31/08/2009|00:00] C:\Program Files\Ad-remover
[13/01/2009|00:05] C:\Program Files\Apple Software Update
[13/04/2009|22:34] C:\Program Files\Athan
[09/03/2009|12:47] C:\Program Files\Avira
[08/05/2008|08:25] C:\Program Files\Big Kahuna Reef
[13/01/2009|00:07] C:\Program Files\Bonjour
[09/03/2009|13:04] C:\Program Files\Circl Developement
[09/03/2009|12:58] C:\Program Files\Common Files
[16/10/2008|07:27] C:\Program Files\Convesoft
[08/05/2008|08:30] C:\Program Files\Cyberlink
[23/11/2008|21:55] C:\Program Files\DIFX
[04/11/2008|23:29] C:\Program Files\eSobi
[19/07/2009|21:03] C:\Program Files\Fast Browser Search
[29/10/2008|22:44] C:\Program Files\Fichiers communs [C:\Program Files\Common Files]
[30/10/2008|21:28] C:\Program Files\FreeCall.com
[28/06/2009|21:45] C:\Program Files\Google
[24/11/2008|19:33] C:\Program Files\Hewlett-Packard
[24/11/2008|19:36] C:\Program Files\HP
[27/12/2008|20:45] C:\Program Files\InstallShield Installation Information
[30/04/2008|09:21] C:\Program Files\Intel
[29/01/2009|02:40] C:\Program Files\Internet Explorer
[13/01/2009|00:07] C:\Program Files\iPod
[13/01/2009|00:08] C:\Program Files\iTunes
[31/08/2009|22:10] C:\Program Files\JetAudio
[16/10/2008|07:30] C:\Program Files\Launch Manager
[31/10/2008|14:29] C:\Program Files\L'Aventure Multimedia
[22/05/2009|23:02] C:\Program Files\LingvoSoft
[31/08/2009|20:52] C:\Program Files\Malwarebytes' Anti-Malware
[30/04/2008|09:23] C:\Program Files\Marvell
[23/05/2009|23:51] C:\Program Files\Messenger Plus! Live
[29/10/2008|23:36] C:\Program Files\Microsoft
[02/11/2006|14:37] C:\Program Files\Microsoft Games
[26/08/2009|00:09] C:\Program Files\Microsoft Office
[29/10/2008|23:17] C:\Program Files\Microsoft SQL Server Compact Edition
[11/06/2009|09:12] C:\Program Files\Microsoft Works
[08/05/2008|08:12] C:\Program Files\Microsoft.NET
[08/05/2008|19:02] C:\Program Files\Movie Maker
[02/11/2006|14:37] C:\Program Files\MSBuild
[26/08/2009|00:08] C:\Program Files\MSECache
[30/10/2008|08:58] C:\Program Files\MSXML 4.0
[18/02/2009|22:25] C:\Program Files\MyPhotoFun France
[29/10/2008|22:55] C:\Program Files\Neuf
[08/05/2008|08:27] C:\Program Files\NewTech Infosystems
[17/12/2008|02:00] C:\Program Files\Nokia
[23/11/2008|21:54] C:\Program Files\PC Connectivity Solution
[13/01/2009|00:06] C:\Program Files\QuickTime
[08/12/2008|12:19] C:\Program Files\Real
[16/10/2008|07:28] C:\Program Files\Realtek
[02/11/2006|14:37] C:\Program Files\Reference Assemblies
[14/08/2009|07:29] C:\Program Files\SGPSA
[29/10/2008|23:15] C:\Program Files\Skype
[30/08/2009|20:59] C:\Program Files\Spybot - Search & Destroy
[30/04/2008|09:25] C:\Program Files\Synaptics
[01/06/2009|11:18] C:\Program Files\TeamViewer3
[31/08/2009|23:19] C:\Program Files\Trend Micro
[02/11/2006|15:01] C:\Program Files\Uninstall Information
[08/05/2008|19:02] C:\Program Files\Windows Calendar
[08/05/2008|19:02] C:\Program Files\Windows Collaboration
[08/05/2008|19:02] C:\Program Files\Windows Defender
[08/05/2008|19:02] C:\Program Files\Windows Journal
[05/11/2008|00:03] C:\Program Files\Windows Live
[14/08/2009|07:29] C:\Program Files\Windows Mail
[14/08/2009|07:37] C:\Program Files\Windows Media Player
[29/10/2008|22:44] C:\Program Files\Windows NT
[08/05/2008|19:02] C:\Program Files\Windows Photo Gallery
[08/05/2008|19:02] C:\Program Files\Windows Sidebar
[28/04/2009|01:36] C:\Program Files\Yahoo!

--------------------\\ Listing des dossiers dans C:\Program Files\Common Files

[10/03/2009|13:55] C:\Program Files\Common Files\Adobe
[13/01/2009|00:07] C:\Program Files\Common Files\Apple
[31/10/2008|00:29] C:\Program Files\Common Files\DESIGNER
[24/11/2008|19:33] C:\Program Files\Common Files\Hewlett-Packard
[24/11/2008|19:35] C:\Program Files\Common Files\HP
[27/12/2008|20:36] C:\Program Files\Common Files\InstallShield
[08/05/2008|08:27] C:\Program Files\Common Files\LightScribe
[06/03/2009|10:55] C:\Program Files\Common Files\microsoft shared
[08/05/2008|08:26] C:\Program Files\Common Files\muvee Technologies
[23/11/2008|21:55] C:\Program Files\Common Files\Nokia
[23/11/2008|21:55] C:\Program Files\Common Files\PCSuite
[08/12/2008|12:20] C:\Program Files\Common Files\Real
[02/11/2006|13:18] C:\Program Files\Common Files\Services
[29/10/2008|23:15] C:\Program Files\Common Files\Skype
[02/11/2006|13:18] C:\Program Files\Common Files\SpeechEngines
[03/02/2009|21:17] C:\Program Files\Common Files\System
[29/10/2008|23:32] C:\Program Files\Common Files\Windows Live
[29/10/2008|23:14] C:\Program Files\Common Files\WindowsLiveInstaller
[08/12/2008|12:20] C:\Program Files\Common Files\xing shared

--------------------\\ Process

( 100 Processes )

... OK !

--------------------\\ Recherche avec S_Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Recherche de Fichiers / Dossiers Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Verification du Registre

..... OK !

--------------------\\ Verification du fichier Hosts

Fichier Hosts PROPRE


--------------------\\ Recherche de fichiers avec Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-02 21:47:45
Windows 6.0.6001 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 3

--------------------\\ Recherche d'autres infections


Aucune autre infection trouvée !

[F:3116][D:165]-> C:\Users\HIBA\AppData\Local\Temp
[F:3285][D:1]-> C:\Users\HIBA\AppData\Roaming\MICROS~1\Windows\Cookies
[F:1543][D:7]-> C:\Users\HIBA\AppData\Local\MICROS~1\Windows\TEMPOR~1\content.IE5
[F:6][D:2]-> C:\$Recycle.Bin

1 - "C:\Lop SD\LopR_1.txt" - 01/09/2009|21:27 - Option : [1]
2 - "C:\Lop SD\LopR_2.txt" - 02/09/2009|21:50 - Option : [2]

--------------------\\ Fin du rapport a 21:50:57
[ UAC => 1 ]

Merci bcp pour votre suivi mon cher expert :)

Salut,

Télécharge Genproc : http://www.genproc.com/GenProc.exe ;
puis, double-clique sur GenProc.exe et poste le contenu du rapport qui s'ouvre.

voila le rapport :

Rapport GenProc 2.623 [1] - 03/09/2009 à 1:25:40
@ Windows Vista Service Pack 1 - Mode normal
@ Internet Explorer (8.0.6001.18372) [Navigateur par défaut]

# Etape 1/ Télécharge :

- CCleaner http://www.ccleaner.com/download/builds/downloading-slim (FileHippo). Ce logiciel va permettre de supprimer tous les fichiers temporaires. Lance-le et clique sur "Options", "Avancé" et décoche la case "Effacer uniquement les fichiers, du dossier Temp de Windows, plus vieux que 48 heures". Par la suite, laisse-le avec ses réglages par défaut. Ferme le programme.

- Toolbar-S&D http://eric.71.mespages.googlepages.com/ToolBarSD.exe (Team IDN) sur ton Bureau.


Redémarre en mode sans échec comme indiqué ici http://www.pcloisirs.eu/mode_sans_echec.htm ; Choisis ta session courante *** HIBA *** (pour retrouver le rapport, clique sur le raccourci "Rapport GenProc[1]" sur ton bureau).


# Etape 2/

Lance Toolbar-S&D situé sur le Bureau. Tape sur "2" puis valide en appuyant sur "Entrée". Ne ferme pas la fenêtre lors de la suppression.

# Etape 3/

Lance CCleaner : "Nettoyeur"/"lancer le nettoyage" et c'est tout.

# Etape 4/

Redémarre normalement et poste, dans la même réponse :

- Le contenu du rapport TB.txt situé dans C:\ ;
- Un nouveau rapport HijackThis http://tinyurl.com/GenProc-HijackThis ;
- Un nouveau rapport GenProc ;

Précise les difficultés que tu as eu (ce que tu n'as pas pu faire...) ainsi que l'évolution de la situation.

~~ Arguments de la procédure ~~


# Détections [1] GenProc 2.623 03/09/2009 à 1:26:12
Toolbar:le 03/09/2009 à 1:26:43 "C:\Windows\iun6002.exe"

----------------------------------------------------------------------
Sites officiels GenProc : www.alt-shift-return.org et www.genproc.com
----------------------------------------------------------------------

~~ Fin à 1:27:00 ~~

Salut,

Suis les étapes et poste les rapports.

Bonsoir,

désolé pour le retard Cher expert mais j'avais du mal à faire cette étape :(

J’avais vraiment du mal à faire le mode de démarrage sans échec !!
Je l’ai fait quand même, mon bureau était bizarre, j’ai redémarré puis j’ai cliqué sur GenProc qui m’a affiché un apport par la suite :

Le voilà :
Rapport GenProc 2.623 [3] - 05/09/2009 à 0:13:29
@ Windows Vista Service Pack 1 - Mode normal
@ Internet Explorer (8.0.6001.18372) [Navigateur par défaut]

# Etape 1/ Télécharge :

- Toolbar-S&D http://eric.71.mespages.googlepages.com/ToolBarSD.exe (Team IDN) sur ton Bureau.


Redémarre en mode sans échec comme indiqué ici http://www.pcloisirs.eu/mode_sans_echec.htm ; Choisis ta session courante *** HIBA *** (pour retrouver le rapport, clique sur le raccourci "Rapport GenProc[3]" sur ton bureau).


# Etape 2/

Lance Toolbar-S&D situé sur le Bureau. Tape sur "2" puis valide en appuyant sur "Entrée". Ne ferme pas la fenêtre lors de la suppression.

# Etape 3/

Lance CCleaner : "Nettoyeur"/"lancer le nettoyage" et c'est tout.

# Etape 4/

Redémarre normalement et poste, dans la même réponse :

- Le contenu du rapport TB.txt situé dans C:\ ;
- Un nouveau rapport HijackThis http://tinyurl.com/GenProc-HijackThis ;
- Un nouveau rapport GenProc ;

Précise les difficultés que tu as eu (ce que tu n'as pas pu faire...) ainsi que l'évolution de la situation.

~~ Arguments de la procédure ~~


# Détections [1] GenProc 2.623 03/09/2009 à 1:26:12
Toolbar:le 03/09/2009 à 1:26:43 "C:\Windows\iun6002.exe"

# Détections [2] GenProc 2.623 03/09/2009 à 1:28:27

# Détections [3] GenProc 2.623 05/09/2009 à 0:13:31
Toolbar:le 05/09/2009 à 0:13:50 "C:\Windows\iun6002.exe"

----------------------------------------------------------------------
Sites officiels GenProc : www.alt-shift-return.org et www.genproc.com
----------------------------------------------------------------------

~~ Fin à 0:14:03 ~~

Voilà le Rapport toolBar :



-----------\\ ToolBar S&D 1.2.9 XP/Vista

Microsoft® Windows Vista™ Édition Familiale Premium ( v6.0.6001 ) Service Pack 1
X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) Dual CPU T3200 @ 2.00GHz )
BIOS : Ver 1.00PARTTBL
USER : HIBA ( Administrator )
BOOT : Normal boot
C:\ (Local Disk) - NTFS - Total:69 Go (Free:28 Go)
D:\ (Local Disk) - NTFS - Total:69 Go (Free:68 Go)
E:\ (CD or DVD) - CDFS - Total:0 Go (Free:0 Go)

"C:\ToolBar SD" ( MAJ : 22-08-2009|18:42 )
Option : [2] ( 05/09/2009| 0:20 )

[ UAC => 1 ]
C:\Windows\iun6002.exe

-----------\\ SUPPRESSION

Supprime! - C:\Windows\iun6002.exe

-----------\\ Recherche de Fichiers / Dossiers ...


-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\Windows\\system32\\blank.htm"
"Search Page"="http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*http://www.yahoo.com"
"Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
"Default_Page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
"Search Bar"="http://go.microsoft.com/fwlink/?linkid=54896"
"Default_search_url"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Url"="http://go.microsoft.com/fwlink/?LinkID=68928"
"Url"="http://go.microsoft.com/fwlink/?LinkID=44406"
"Url"="http://go.microsoft.com/fwlink/?LinkID=68929"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.msn.com/"
"Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Local Page"="C:\\Windows\\System32\\blank.htm"
"Default_Page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
"Search Bar"="http://search.msn.com/spbasic.htm"


--------------------\\ Recherche d'autres infections


Aucune autre infection trouvée !

[ UAC => 1 ]


1 - "C:\ToolBar SD\TB_1.txt" - 05/09/2009| 0:21 - Option : [2]

-----------\\ Fin du rapport a 0:21:09,02

J’ai pas réussi à faire ça 

Le contenu du rapport TB.txt situé dans C:\ ;
Comment faire ??

Voila le rapport du HIjackThis, je l’avais déjà sur mon bureau :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:20:09, on 31/08/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18372)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\PLFSetI.exe
C:\Users\HIBA\AppData\Local\Temp\RtkBtMnt.exe
C:\Program Files\Launch Manager\LManager.exe
C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe
C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Athan\Athan.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Nokia\PC Internet Access\NPCIA.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\igfxext.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10b.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\PC Connectivity Solution\Transports\NclIrSrv.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.microsoft.com/fwlink/?linkid=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://recherche.neuf.fr/ie/default.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: SearchHelper Class - {91C18ED5-5E1C-4AE5-A148-A861DE8C8E16} - C:\Program Files\SGPSA\mtwb3sh.dll (file missing)
O1 - Hosts: ::1 localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Search Assistant - {F0626A63-410B-45E2-99A1-3F2475B2D695} - C:\Program Files\SGPSA\BHO.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [BkupTray] "C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKLM\..\Run: [PLFSetI] C:\Windows\PLFSetI.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe
O4 - HKLM\..\Run: [ePower_DMC] C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [ProductReg] "C:\Program Files\Acer\WR_PopUp\ProductReg.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Athan] C:\Program Files\Athan\Athan.exe
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe" /NoDialog
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [NokiaPCInternetAccess] "C:\Program Files\Nokia\PC Internet Access\NPCIA.exe" /b
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Showbalm] "C:\ProgramData\jump program program.j0etxb"
O4 - HKCU\..\Run: [ANTI LITE TITLE DEBUG] "C:\ProgramData\option dupe tool.63g5px8"
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {04CB5B64-5915-4629-B869-8945CEBADD21} (Module de délivrance de certificat MINEFI) - https://static.impots.gouv.fr/abos/static/securite/certdgi1.cab
O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerVistaADP-2.0.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Service Google Update (gupdate1c9d52578b6163a) (gupdate1c9d52578b6163a) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

Salut,

Fait directement cela ...

" # Etape 3/
Poste un rapport Nod32 (il faut utiliser Internet Explorer)
- coche toutes les cases à chaque fois, et lorsque c'est terminé, colle le rapport :
C:\Program Files\EsetOnlineScanner\log.txt "

Donc ...

Lance un scan Nod32 : http://www.eset-nod32.fr/scanner.html
(il faut utiliser Internet Explorer)

Coche toutes les cases à chaque fois ; une fois le scan achevé, colle le rapport :

-> C:\Program Files\EsetOnlineScanner\log.txt <-- le rapport

Bonsoir mon expert :)

ça fait des jours j'essaye de teléchatger cet anti-virus mais ça marche pas arrivant à 44% il arrête de scanner

Koi faire SVP :( ?

Salut,

Clique droit sur ce lien pour installer ComboFix (par sUBs) :

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Choisis "Enregistrer sous" (dans IE c'est "Enregistrer la cible/le lien sous..")
et sauvegarde-le (Enregistrer dans) sur le Bureau.

Important : dans "Nom du fichier" enregistre (renomme) "combofix" en combo-fix.exe

Prends connaissance de ce tutoriel : http://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

Ferme toutes les fenêtres et applications.
Déconnecte-toi du net et désactive tes protections résidentes :
http://forum.pcastuces.com/desactiver_les_protections_residentes-f31s4.htm

! IMPORTANT ! ...A ce stade, désactive l' UAC : http://tinyurl.com/5zfaxk

Sur le bureau, double clique combo-fix.exe.
Tape sur la touche Y (Yes) pour démarrer le scan.
ComboFix redémarrera ton PC.
Lorsque le scan sera complété, un rapport apparaîtra.
Copie/colle ce rapport dans ta prochaine réponse et nouveau rapport hijackthis.

PS : Le rapport se trouve également ici : C:\Combofix.txt

Ne clique pas dans la fenêtre de Combofix durant l’analyse : cela pourrait provoquer le gel du programme !

Bonjour cher expert, :) :)

Je vous remercie infiniment pour votre aide :)

voilà le rapport :

ComboFix 09-09-11.01 - HIBA 12/09/2009 11:53.2.2 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.33.1036.18.3000.1856 [GMT 2:00]
Lancé depuis: c:\users\HIBA\Desktop\combo-fix.exe.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-3066969076-1937047056-318044926-500
c:\program files\Fast Browser Search
c:\program files\Fast Browser Search\IE\1.bat
c:\program files\Fast Browser Search\IE\about.html
c:\program files\Fast Browser Search\IE\affid.dat
c:\program files\Fast Browser Search\IE\basis.xml
c:\program files\Fast Browser Search\IE\BHO.dll
c:\program files\Fast Browser Search\IE\ClearRecycleBin.exe
c:\program files\Fast Browser Search\IE\error.html
c:\program files\Fast Browser Search\IE\fbsProtection.xml
c:\program files\Fast Browser Search\IE\FbsSearchProvider.xml
c:\program files\Fast Browser Search\IE\FbsSearchProviderIE8.exe
c:\program files\Fast Browser Search\IE\FBStoolbar.dll
c:\program files\Fast Browser Search\IE\icons.bmp
c:\program files\Fast Browser Search\IE\info.txt
c:\program files\Fast Browser Search\IE\local.xml
c:\program files\Fast Browser Search\IE\logobg.bmp
c:\program files\Fast Browser Search\IE\MTWBtoolbar.html
c:\program files\Fast Browser Search\IE\search.bmp
c:\program files\Fast Browser Search\IE\SearchGuardPlus.exe
c:\program files\Fast Browser Search\IE\SearchGuardPlus.ico
c:\program files\Fast Browser Search\IE\SGPU.ico
c:\program files\Fast Browser Search\IE\sgpUpdater.exe
c:\program files\Fast Browser Search\IE\sgpUpdater.xml
c:\program files\Fast Browser Search\IE\SGPUpdaterS.exe
c:\program files\Fast Browser Search\IE\tbs_include_script_003175.js
c:\program files\Fast Browser Search\IE\tbs_include_script_005064.js
c:\program files\Fast Browser Search\IE\tbs_include_script_012817.js
c:\program files\Fast Browser Search\IE\Toolbar Help.htm
c:\program files\Fast Browser Search\IE\uninstall.exe
c:\program files\Fast Browser Search\IE\uninstalSGP.exe
c:\program files\Fast Browser Search\IE\uninstalSGPU.exe
c:\program files\Fast Browser Search\IE\update.exe
c:\program files\Fast Browser Search\IE\version.txt
c:\program files\SGPSA
c:\program files\SGPSA\BHO.dll
c:\recycler\S-1-5-21-6299470188-7406144504-541983239-2526
c:\windows\Installer\178011.msi
c:\windows\Suyin.reg

.
((((((((((((((((((((((((((((( Fichiers créés du 2009-08-12 au 2009-09-12 ))))))))))))))))))))))))))))))))))))
.

2009-09-12 10:00 . 2009-09-12 10:00 -------- d-----w- c:\users\Default\AppData\Local\temp
2009-09-09 19:56 . 2009-08-14 17:07 897608 ----a-w- c:\windows\system32\drivers\tcpip.sys
2009-09-07 00:33 . 2009-09-07 00:33 -------- d-----w- c:\program files\ESET
2009-09-03 22:42 . 2009-09-04 22:21 -------- d-----w- C:\ToolBar SD
2009-09-03 22:37 . 2009-09-03 22:37 -------- d-----w- c:\program files\CCleaner
2009-09-02 23:25 . 2009-09-04 22:37 -------- d-----w- C:\GenProc
2009-09-02 18:56 . 2009-08-28 12:39 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2009-09-02 18:56 . 2009-08-28 10:15 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2009-09-01 19:23 . 2009-09-02 19:50 -------- d-----w- C:\Lop SD
2009-08-31 21:19 . 2009-08-31 21:19 -------- d-----w- c:\program files\Trend Micro
2009-08-31 18:52 . 2009-08-03 11:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-31 18:52 . 2009-08-31 18:52 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-08-31 18:52 . 2009-08-31 18:52 -------- d-----w- c:\programdata\Malwarebytes
2009-08-31 18:52 . 2009-08-03 11:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-08-30 19:04 . 2009-06-15 15:21 499712 ----a-w- c:\windows\system32\kerberos.dll
2009-08-30 19:04 . 2009-06-15 15:24 175104 ----a-w- c:\windows\system32\wdigest.dll
2009-08-30 19:04 . 2009-06-15 15:24 270848 ----a-w- c:\windows\system32\schannel.dll
2009-08-30 19:04 . 2009-06-15 15:23 1256448 ----a-w- c:\windows\system32\lsasrv.dll
2009-08-30 19:04 . 2009-06-15 15:22 213504 ----a-w- c:\windows\system32\msv1_0.dll
2009-08-30 19:04 . 2009-06-15 18:20 439896 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2009-08-30 19:04 . 2009-06-15 15:24 72704 ----a-w- c:\windows\system32\secur32.dll
2009-08-30 19:04 . 2009-06-15 12:57 9728 ----a-w- c:\windows\system32\lsass.exe
2009-08-30 17:34 . 2009-08-30 22:00 -------- d-----w- c:\program files\Ad-remover
2009-08-26 22:05 . 2009-08-30 18:59 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-08-26 22:05 . 2009-08-30 17:47 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2009-08-26 20:54 . 2009-08-26 20:54 -------- d-----w- c:\users\HIBA\AppData\Roaming\Malwarebytes
2009-08-26 01:01 . 2009-06-22 10:22 2048 ----a-w- c:\windows\system32\tzres.dll
2009-08-25 22:08 . 2009-08-25 22:08 -------- d-----w- c:\program files\MSECache

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-12 09:11 . 2008-10-29 21:16 -------- d-----w- c:\users\HIBA\AppData\Roaming\Skype
2009-09-12 06:04 . 2008-10-29 21:19 -------- d-----w- c:\users\HIBA\AppData\Roaming\skypePM
2009-09-10 05:05 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-09-08 21:34 . 2008-05-08 15:56 49472 ----a-w- c:\windows\system32\perfh00C.dat
2009-09-08 21:34 . 2008-05-08 15:56 11720 ----a-w- c:\windows\system32\perfc00C.dat
2009-08-31 20:10 . 2008-12-18 20:14 -------- d-----w- c:\program files\JetAudio
2009-08-14 16:29 . 2009-09-09 19:55 17920 ----a-w- c:\windows\system32\netevent.dll
2009-08-14 16:29 . 2009-09-09 19:55 104960 ----a-w- c:\windows\system32\netiohlp.dll
2009-08-14 14:16 . 2009-09-09 19:55 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE
2009-08-14 14:16 . 2009-09-09 19:55 17920 ----a-w- c:\windows\system32\ROUTE.EXE
2009-08-14 14:16 . 2009-09-09 19:55 11264 ----a-w- c:\windows\system32\MRINFO.EXE
2009-08-14 14:16 . 2009-09-09 19:55 27136 ----a-w- c:\windows\system32\NETSTAT.EXE
2009-08-14 14:16 . 2009-09-09 19:55 19968 ----a-w- c:\windows\system32\ARP.EXE
2009-08-14 14:16 . 2009-09-09 19:55 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE
2009-08-14 14:16 . 2009-09-09 19:55 10240 ----a-w- c:\windows\system32\finger.exe
2009-07-17 14:35 . 2009-08-13 03:25 71680 ----a-w- c:\windows\system32\atl.dll
2009-07-14 13:00 . 2009-08-13 03:24 313344 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-14 12:59 . 2009-08-13 03:24 4096 ----a-w- c:\windows\system32\dxmasf.dll
2009-07-14 12:58 . 2009-08-13 03:24 7680 ----a-w- c:\windows\system32\spwmp.dll
2009-07-14 10:59 . 2009-08-13 03:24 8147456 ----a-w- c:\windows\system32\wmploc.DLL
2009-07-11 19:32 . 2009-09-09 19:55 513024 ----a-w- c:\windows\system32\wlansvc.dll
2009-07-11 19:32 . 2009-09-09 19:55 302592 ----a-w- c:\windows\system32\wlansec.dll
2009-07-11 19:32 . 2009-09-09 19:55 293376 ----a-w- c:\windows\system32\wlanmsm.dll
2009-07-11 19:29 . 2009-09-09 19:55 127488 ----a-w- c:\windows\system32\L2SecHC.dll
2009-06-29 12:21 . 2008-11-24 17:22 146288 ----a-w- c:\windows\hpoins18.dat
2009-06-15 15:24 . 2009-07-15 06:04 156672 ----a-w- c:\windows\system32\t2embed.dll
2009-06-15 15:20 . 2009-07-15 06:04 72704 ----a-w- c:\windows\system32\fontsub.dll
2009-06-15 15:20 . 2009-07-15 06:04 10240 ----a-w- c:\windows\system32\dciman32.dll
2009-06-15 12:52 . 2009-07-15 06:04 289792 ----a-w- c:\windows\system32\atmfd.dll
2008-10-16 15:00 . 2008-10-16 14:58 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2008-05-14 15:05 121392 ----a-w- c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 6\PCSync2.exe" [2008-03-26 1232896]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2008-04-16 1079808]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-06-28 39408]
"NokiaPCInternetAccess"="c:\program files\Nokia\PC Internet Access\NPCIA.exe" [2008-05-07 536576]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-03-18 4363504]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
"WindowsWelcomeCenter"="oobefldr.dll" - c:\windows\System32\oobefldr.dll [2008-01-21 2153472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-04-25 1049896]
"BkupTray"="c:\program files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe" [2008-04-06 34040]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-07-16 150040]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-07-16 170520]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-07-16 145944]
"PLFSetI"="c:\windows\PLFSetI.exe" [2007-10-23 200704]
"LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2008-09-10 809480]
"eDataSecurity Loader"="c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe" [2008-05-14 526896]
"ePower_DMC"="c:\program files\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2008-06-11 409600]
"ProductReg"="c:\program files\Acer\WR_PopUp\ProductReg.exe" [2008-09-23 6144]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 49152]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-12-08 185872]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-12-08 29744]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"Athan"="c:\program files\Athan\Athan.exe" [2009-01-18 1081344]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2008-06-13 6183456]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-1-2 210520]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~2\GoogleDesktopNetwork3.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{094339B4-DC9A-4360-BD84-3F092D663E07}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{630EE3C1-2814-48EE-A950-11CD55D32643}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{7B7DEEEB-D07C-4D91-9E38-F857C78E87AD}"= UDP:c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe:AgentSvc.exe
"{85FDDE5B-8CBC-4798-B06D-8EC8E0C59F70}"= TCP:c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe:AgentSvc.exe
"{700982FC-837F-4B5A-9A78-2CBD0B8EB989}"= UDP:c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe:SchedulerSvc.exe
"{1EC0BE30-C5C4-4D30-8DDA-FDFEE6BEFF0F}"= TCP:c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe:SchedulerSvc.exe
"{89DA007C-73BF-4DD5-92F4-A6479FA63BA8}"= UDP:c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe:BackupSvc.exe
"{54955791-5D79-4470-BEFE-6EECB7BB4EF4}"= TCP:c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe:BackupSvc.exe
"{E0025EC9-154E-4225-AD81-E6274D2A9539}"= c:\program files\Cyberlink\PowerDirector\PDR.EXE:CyberLink PowerDirector
"{6AA1A1C3-AA85-4BAB-847E-203D58F3E99C}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{4124DF1A-AC30-4A82-8B14-C436E8FBC55C}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{AED1D4E6-9542-4B83-ABBF-6EDB5825987A}"= UDP:c:\program files\FreeCall.com\FreeCall\FreeCall.exe:FreeCall
"{C0672EF7-E98A-4A47-977C-E5A316A873D9}"= TCP:c:\program files\FreeCall.com\FreeCall\FreeCall.exe:FreeCall
"{A189041B-2891-47CE-9C6C-D5055E6D1D4B}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{1AE16A21-4506-4385-B9EB-94DD7F0AC453}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{731A4575-B7A7-45FD-893D-1DA00CD570ED}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{BE573602-3406-4ACA-A520-87CECCE89DAB}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"{2FFD9A91-AF6D-4E33-8C3F-55843A2D9682}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{A5EADEFD-CFAE-4F5A-A71A-F24AE978FF39}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{2B43D934-3468-42D2-AF6C-CFD9445E0C62}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger

R2 BUNAgentSvc;NTI Backup Now 5 Agent Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe [03/03/2008 13:11 16384]
R2 ETService;Empowering Technology Service;c:\program files\Acer\Empowering Technology\Service\ETService.exe [08/05/2008 08:30 24576]
R2 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [06/04/2008 22:42 50424]
S2 gupdate1c9d52578b6163a;Service Google Update (gupdate1c9d52578b6163a);c:\program files\Google\Update\GoogleUpdate.exe [15/05/2009 08:22 133104]
S2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [04/04/2008 03:03 131072]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\System32\drivers\b57nd60x.sys [21/01/2008 04:23 179712]
S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [08/12/2008 12:17 29744]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contenu du dossier 'Tâches planifiées'

2009-09-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-15 06:21]

2009-09-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-15 06:21]
.
.
------- Examen supplémentaire -------
.
mWindow Title =
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: {04CB5B64-5915-4629-B869-8945CEBADD21} - hxxps://static.impots.gouv.fr/abos/static/securite/certdgi1.cab
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} - hxxps://static.impots.gouv.fr/tdir/static/adpform/AdSignerVistaADP-2.0.cab
.
- - - - ORPHELINS SUPPRIMES - - - -

HKLM-Run-eRecoveryService - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-12 12:00
Windows 6.0.6001 Service Pack 1 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Heure de fin: 2009-09-12 12:02
ComboFix-quarantined-files.txt 2009-09-12 10:02

Avant-CF: 33 194 835 968 octets libres
Après-CF: 33 033 183 232 octets libres

255 --- E O F --- 2009-09-10 19:38

et voila le 2ème rapport

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:03:52, on 12/09/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18372)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Launch Manager\LManager.exe
C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe
C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Windows\system32\igfxext.exe
C:\Program Files\Athan\Athan.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Nokia\PC Internet Access\NPCIA.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\PC Connectivity Solution\Transports\NclIrSrv.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\notepad.exe
C:\Windows\system32\conime.exe
C:\Windows\Explorer.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [BkupTray] "C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [PLFSetI] C:\Windows\PLFSetI.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe
O4 - HKLM\..\Run: [ePower_DMC] C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [ProductReg] "C:\Program Files\Acer\WR_PopUp\ProductReg.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Athan] C:\Program Files\Athan\Athan.exe
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe" /NoDialog
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [NokiaPCInternetAccess] "C:\Program Files\Nokia\PC Internet Access\NPCIA.exe" /b
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)
O16 - DPF: {04CB5B64-5915-4629-B869-8945CEBADD21} (Module de délivrance de certificat MINEFI) - https://static.impots.gouv.fr/abos/static/securite/certdgi1.cab
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerVistaADP-2.0.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GoogleDesktopNetwork3.dll
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Service Google Update (gupdate1c9d52578b6163a) (gupdate1c9d52578b6163a) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe