Explorer.exe ne demarre pas (entre autres) [Résolu]

dans le menu démarrage place un raccourci de explorer.exe
tu peux peut etre regarder aussi du coté de msconfig et voir ce qui se lance au démarrage.

J'ai tenté ta méthode du raccourci explorer.exe
En fait le processus se lance apparement puis il cesse de fonctionner.
Pour se qui est de msconfig, j'ai tout réactivé pour être sûr que explorer démarre.
Je poste un rapport RSIT si ça peut aider


info.txt logfile of random's system information tool 1.06 2010-01-06 10:01:32

======Uninstall list======

-->C:\Windows\system32\Macromed\Flash\uninstall_plugin.exe
123 Free Solitaire 2009 v7.0-->"C:\Program Files\123 Free Solitaire\unins000.exe"
2007 Microsoft Office system-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PROHYBRIDR /dll OSETUP.DLL
Activation Assistant for the 2007 Microsoft Office suites-->"C:\ProgramData\{174892B1-CBE7-44F5-86FF-AB555EFD73A3}\Microsoft Office Activation Assistant.exe" REMOVE=TRUE MODIFY=FALSE
Adobe Flash Player 10 Plugin-->MsiExec.exe /X{ECA1A3B6-898F-4DCE-9F04-714CF3BA126B}
Adobe Flash Player ActiveX-->C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Reader 8 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A80000000002}
Adobe Reader 8.1.2 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A81200000003}
ALPS Touch Pad Driver-->C:\Program Files\Apoint2K\Uninstap.exe ADDREMOVE
Assistant de connexion Windows Live-->MsiExec.exe /I{DCE8CD14-FBF5-4464-B9A4-E18E473546C7}
avast! Antivirus-->C:\Program Files\Alwil Software\Avast4\aswRunDll.exe "C:\Program Files\Alwil Software\Avast4\Setup\setiface.dll",RunSetup
Bluetooth Stack for Windows by Toshiba-->MsiExec.exe /X{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}
Cake Mania 2-->"C:\Program Files\orange\jeux\Cake Mania 2\Uninstall.exe" "C:\Program Files\orange\jeux\Cake Mania 2\install.log"
Cake Mania Main Street-->"C:\Program Files\orange\jeux\Cake Mania Main Street\Uninstall.exe" "C:\Program Files\orange\jeux\Cake Mania Main Street\install.log"
Canon MP Navigator 3.0-->"C:\Program Files\Canon\MP Navigator 3.0\Maint.exe" /UninstallRemove C:\Program Files\Canon\MP Navigator 3.0\uninst.ini
Canon MP160-->"C:\Windows\system32\CanonIJ Uninstaller Information\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP160\DelDrv.exe" /U:{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP160 /L0x000c
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
Desktop SMS-->MsiExec.exe /I{5980B928-1C95-4B3E-957B-B02D8147FF9E}
Détecteur de flux Windows Live Toolbar (Windows Live Toolbar)-->MsiExec.exe /X{EFFCB0F1-CFEC-48D4-B793-EBFCAE852976}
Diaper Dash-->"C:\Program Files\orange\jeux\Diaper Dash\Uninstall.exe" "C:\Program Files\orange\jeux\Diaper Dash\install.log"
Diner Dash-->"C:\Program Files\orange\jeux\Diner Dash\Uninstall.exe" "C:\Program Files\orange\jeux\Diner Dash\install.log"
EA Download Manager-->C:\Program Files\Electronic Arts\EADM\Uninstall.exe
Enjoy 4e-->C:\Windows\Enjoy 4e Uninstaller.exe
Fichiers de prise en charge de l'installation de Microsoft SQL Server (Français)-->MsiExec.exe /X{3380F354-C5F7-4E71-8F51-EEE6C3F06C62}
Galerie de photos Windows Live-->MsiExec.exe /X{B131E59D-202C-43C6-84C9-68F0C37541F1}
Gestionnaire de contacts professionnels pour Outlook 2007-->"c:\Program Files\Microsoft Small Business\Business Contact Manager\SetupBootstrap\Setup.exe" /remove {69ca8988-1c6c-4285-b8af-db780a6e42af}
Gestionnaire de contacts professionnels pour Outlook 2007-->MsiExec.exe /X{69ca8988-1c6c-4285-b8af-db780a6e42af}
Go-Go Gourmet-->"C:\Program Files\orange\jeux\Go-Go Gourmet\Uninstall.exe" "C:\Program Files\orange\jeux\Go-Go Gourmet\install.log"
Google Toolbar for Internet Explorer-->MsiExec.exe /I{DBEA1034-5882-4A88-8033-81C4EF0CFA29}
Google Update Helper-->MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
Google Earth-->MsiExec.exe /X{C084BC61-E537-11DE-8616-005056806466}
Hardwood Solitaire Deluxe-->"C:\Program Files\orange\jeux\Hardwood Solitaire Deluxe\Uninstall.exe" "C:\Program Files\orange\jeux\Hardwood Solitaire Deluxe\install.log"
Hardwood Solitaire Deluxe-->C:\Program Files\orange\jeux\Hardwood Solitaire Deluxe\solitaire.exe -Uninstall
HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
Installation Windows Live-->C:\Program Files\Windows Live\Installer\wlarp.exe
Installation Windows Live-->MsiExec.exe /I{46ABBC54-1872-4AA3-95E2-F2C063A63F31}
Intel(R) Graphics Media Accelerator Driver-->C:\Windows\system32\igxpun.exe -uninstall
Intel(R) Network Connections Drivers-->Prounstl.exe
Intel® Matrix Storage Manager-->C:\Windows\system32\imsmudlg.exe -uninstall
Java(TM) 6 Update 11-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216011FF}
Java(TM) 6 Update 4-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160040}
Java(TM) SE Runtime Environment 6-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160000}
Jessicas Cupcake Cafe-->"C:\Program Files\orange\jeux\Jessicas Cupcake Cafe\Uninstall.exe" "C:\Program Files\orange\jeux\Jessicas Cupcake Cafe\install.log"
Junk Mail filter update-->MsiExec.exe /I{E2DFE069-083E-4631-9B6C-43C48E991DE5}
Les Sims™ 3-->"C:\Program Files\InstallShield Installation Information\{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}\Sims3Setup.exe" -runfromtemp -l0x040c -removeonly
LimeWire 5.1.2-->"C:\Program Files\LimeWire\uninstall.exe"
Lovely Kitchen-->"C:\Program Files\orange\jeux\Lovely Kitchen\Uninstall.exe" "C:\Program Files\orange\jeux\Lovely Kitchen\install.log"
Mahjong Garden Deluxe-->"C:\Program Files\orange\jeux\Mahjong Garden Deluxe\Uninstall.exe" "C:\Program Files\orange\jeux\Mahjong Garden Deluxe\install.log"
Manuels TOSHIBA-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5B1DD5AA-FF34-4D6E-A912-CB46BB7378DC}\setup.exe" -l0x40c -removeonly
Menus intelligents (Windows Live Toolbar)-->MsiExec.exe /X{0CC70FEF-5068-4CD5-B4DE-86FFD98EC929}
Messenger Plus! Live-->"C:\Program Files\Messenger Plus! Live\Uninstall.exe"
Microsoft .NET Framework 3.5 Language Pack SP1 - fra-->MsiExec.exe /I{3E31821C-7917-367E-938E-E65FC413EA31}
Microsoft .NET Framework 3.5 SP1-->C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Choice Guard-->MsiExec.exe /X{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}
Microsoft Office 2003 Web Components-->MsiExec.exe /I{90A4040C-6000-11D3-8CFE-0150048383C9}
Microsoft Office 2007 Primary Interop Assemblies-->MsiExec.exe /X{50120000-1105-0000-0000-0000000FF1CE}
Microsoft Office Access MUI (French) 2007-->MsiExec.exe /X{90120000-0015-040C-0000-0000000FF1CE}
Microsoft Office Excel MUI (French) 2007-->MsiExec.exe /X{90120000-0016-040C-0000-0000000FF1CE}
Microsoft Office Live Add-in 1.3-->MsiExec.exe /I{57F0ED40-8F11-41AA-B926-4A66D0D1A9CC}
Microsoft Office Outlook MUI (French) 2007-->MsiExec.exe /X{90120000-001A-040C-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (French) 2007-->MsiExec.exe /X{90120000-0018-040C-0000-0000000FF1CE}
Microsoft Office Professional Hybrid 2007-->MsiExec.exe /X{91120000-0031-0000-0000-0000000FF1CE}
Microsoft Office Proof (Arabic) 2007-->MsiExec.exe /X{90120000-001F-0401-0000-0000000FF1CE}
Microsoft Office Proof (Dutch) 2007-->MsiExec.exe /X{90120000-001F-0413-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (French) 2007-->MsiExec.exe /X{90120000-002C-040C-0000-0000000FF1CE}
Microsoft Office Publisher MUI (French) 2007-->MsiExec.exe /X{90120000-0019-040C-0000-0000000FF1CE}
Microsoft Office Shared MUI (French) 2007-->MsiExec.exe /X{90120000-006E-040C-0000-0000000FF1CE}
Microsoft Office Small Business Connectivity Components-->MsiExec.exe /X{A939D341-5A04-4E0A-BB55-3E65B386432D}
Microsoft Office Word MUI (French) 2007-->MsiExec.exe /X{90120000-001B-040C-0000-0000000FF1CE}
Microsoft Search Enhancement Pack-->MsiExec.exe /X{4CBA3D4C-8F51-4D60-B27E-F6B641C571E7}
Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft SQL Server 2005 Compact Edition [ENU]-->MsiExec.exe /I{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}
Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)-->MsiExec.exe /I{480DBB60-F0B6-45F2-B26F-1A2E11197791}
Microsoft SQL Server 2005-->"c:\Program Files\Microsoft SQL Server\90\Setup Bootstrap\ARPWrapper.exe" /Remove
Microsoft SQL Server Native Client-->MsiExec.exe /I{90283F22-0731-43B6-81FD-E6DD911A31FB}
Microsoft SQL Server VSS Writer-->MsiExec.exe /I{C74B273E-DF20-4955-899B-15205119894C}
Microsoft Sync Framework Runtime Native v1.0 (x86)-->MsiExec.exe /I{8A74E887-8F0F-4017-AF53-CBA42211AAA5}
Microsoft Sync Framework Services Native v1.0 (x86)-->MsiExec.exe /I{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053-->MsiExec.exe /X{770657D0-A123-3C07-8E44-1C83EC895118}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}
Microsoft WSE 3.0 Runtime-->MsiExec.exe /X{E3E71D07-CD27-46CB-8448-16D4FB29AA13}
Module linguistique Microsoft .NET Framework 3.5 SP1- fra-->C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack SP1 - fra\setup.exe
MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
MSXML 4.0 SP2 (KB927978)-->MsiExec.exe /I{37477865-A3F1-4772-AD43-AAFC6BCFF99F}
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB941833)-->MsiExec.exe /I{C523D256-313D-4866-B36A-F3DE528246EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 4.0 SP2 (KB973688)-->MsiExec.exe /I{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}
myphotobook 3.1-->C:\Program Files\myphotobook\uninst.exe
NVIDIA Drivers-->C:\Windows\system32\NVUNINST.EXE UninstallGUI
OpenOffice.org 3.1-->MsiExec.exe /I{E6B87DC4-2B3D-4483-ADFF-E483BF718991}
Outil de mise à jour Google-->"C:\Program Files\Google\Google Updater\GoogleUpdater.exe" -uninstall
Outil de téléchargement Windows Live-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}
Outlook Express Backup Expert 1.40-->"C:\Program Files\Bodrag\Outlook Express Backup Expert\unins000.exe"
Patience 2.4-->C:\PROGRA~1\Patience\UNWISE.EXE C:\PROGRA~1\Patience\INSTALL.LOG
PhotoFiltre-->"C:\Program Files\PhotoFiltre\Uninst.exe"
PhotoScape-->"C:\Program Files\PhotoScape\uninstall.exe"
Picasa 3-->"C:\Program Files\Google\Picasa3\Uninstall.exe"
Realtek High Definition Audio Driver-->RtlUpd.exe -r -m
Réducteur de bruit lect. CD/DVD-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9FE35071-CAB2-4E79-93E7-BFC6A2DC5C5D}\setup.exe" -l0x40c
Registry Mechanic 7.0-->"C:\Program Files\Registry Mechanic\unins000.exe"
Search Guard Plus (My Web Tattoo)-->C:\Program Files\Search Guard Plus\uninstalSGP.exe
Search Guard Plus Updater (My Web Tattoo)-->C:\Program Files\Search Guard PlusU\uninstalSGPU.exe
Texas Instruments PCIxx21/x515/xx12 drivers.-->C:\Program Files\InstallShield Installation Information\{DB780B85-B4B5-4864-A49C-9B706B169C93}\setup.exe -runfromtemp -l0x040c
TOSHIBA Assist-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{12B3A009-A080-4619-9A2A-C6DB151D8D67}\setup.exe" -l0x40c
TOSHIBA ConfigFree-->C:\Program Files\InstallShield Installation Information\{78C6A78A-8B03-48C8-A47C-78BA1FCA2307}\setup.exe -runfromtemp -l0x040c uninstall -removeonly
TOSHIBA Disc Creator-->MsiExec.exe /X{5DA0E02F-970B-424B-BF41-513A5018E4C0}
TOSHIBA Extended Tiles for Windows Mobility Center-->C:\Program Files\InstallShield Installation Information\{617C36FD-0CBE-4600-84B2-441CEB12FADF}\setup.exe -runfromtemp -l0x040c
TOSHIBA HDD Protection-->MsiExec.exe /X{94A90C69-71C1-470A-88F5-AA47ECC96B40}
Toshiba Online Product Information-->C:\Program Files\InstallShield Installation Information\{2290A680-4083-410A-ADCC-7092C67FC052}\setup.exe -runfromtemp -l0x040c -removeonly
TOSHIBA SD Memory Boot Utility-->MsiExec.exe /X{BBF5493A-05FB-4449-90DE-84A61EB78154}
TOSHIBA SD Memory Utilities-->MsiExec.exe /X{EBFF48F5-3CFA-436F-8FD5-94FB01D3A0A7}
TOSHIBA Security Assist-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{1E63ACB5-D45E-4856-8FC9-78F4B0D7BB80}\setup.exe" -l0x40c -removeonly
TOSHIBA Software Modem-->Tosmreg -U
TOSHIBA Value Added Package-->C:\Program Files\InstallShield Installation Information\{FEDD27A0-B306-45EF-BF58-B527406B42C8}\setup.exe -runfromtemp -l0x040c
TOSHIBA Wireless Key Logon-->MsiExec.exe /X{FC4C645F-8EBC-4F1E-A517-D1505B43A374}
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=""
Update for Office 2007 (KB934528)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {2B939677-2FFD-48F6-9075-7BF48CB87C80}
Update for Office System 2007 Setup (KB929722)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {D8E9BEBD-655F-467D-8176-CA9959C140A3}
VideoLAN VLC media player 0.8.6c-->C:\Program Files\VideoLAN\VLC\uninstall.exe
Windows Live Call-->MsiExec.exe /I{82C7B308-0BDD-49D8-8EA5-9CD3A3F9DF41}
Windows Live Communications Platform-->MsiExec.exe /I{3B4E636E-9D65-4D67-BA61-189800823F52}
Windows Live Contrôle parental-->MsiExec.exe /X{D5D81435-B8DE-4CAF-867F-7998F2B92CFC}
Windows Live FolderShare-->MsiExec.exe /X{2075CB0A-D26F-4DAA-B424-5079296B43BA}
Windows Live Mail-->MsiExec.exe /I{5DD76286-9BE7-4894-A990-E905E91AC818}
Windows Live Messenger-->MsiExec.exe /I{F6326B60-1B1D-4ABF-BFCD-7B7404F44411}
Windows Live Messenger-->MsiExec.exe /X{770F1BEC-2871-4E70-B837-FB8525FFA3B1}
Windows Live Movie Maker-->MsiExec.exe /X{53B20C18-D8D4-4588-8737-9BBFE303C354}
Windows Live Sign-in Assistant-->MsiExec.exe /I{49672EC2-171B-47B4-8CE7-50D7806360D7}
Windows Live Toolbar-->MsiExec.exe /X{F7D27C70-90F5-49B9-B188-0A133C0CE353}
Windows Live Writer-->MsiExec.exe /X{4634B21A-CC07-4396-890C-2B8168661FEA}
WinDVD for TOSHIBA-->C:\Program Files\InstallShield Installation Information\{20471B27-D702-4FE8-8DEC-0702CC8C0A85}\setup.exe -runfromtemp -l0x040c
Zuma Deluxe-->"C:\Program Files\orange\jeux\Zuma Deluxe\Uninstall.exe" "C:\Program Files\orange\jeux\Zuma Deluxe\install.log"

======Security center information======

AS: Windows Defender (disabled)

======System event log======

Computer Name: PC-de-frederiqu
Event Code: 4376
Message: Servicing a requis un redémarrage pour terminer la définition du package KB944036(Update) à l’état Installation demandée(Install Requested)
Record Number: 154365
Source Name: Microsoft-Windows-Servicing
Time Written: 20100106085933.000000-000
Event Type: Avertissement
User: PC-de-frederiqu\frederique

Computer Name: PC-de-frederiqu
Event Code: 4376
Message: Servicing a requis un redémarrage pour terminer la définition du package KB976325(Security Update) à l’état Installation demandée(Install Requested)
Record Number: 154479
Source Name: Microsoft-Windows-Servicing
Time Written: 20100106090129.000000-000
Event Type: Avertissement
User: PC-de-frederiqu\frederique

Computer Name: PC-de-frederiqu
Event Code: 4376
Message: Servicing a requis un redémarrage pour terminer la définition du package KB976325(Security Update) à l’état Installation demandée(Install Requested)
Record Number: 154481
Source Name: Microsoft-Windows-Servicing
Time Written: 20100106090129.000000-000
Event Type: Avertissement
User: PC-de-frederiqu\frederique

Computer Name: PC-de-frederiqu
Event Code: 4376
Message: Servicing a requis un redémarrage pour terminer la définition du package KB976325(Security Update) à l’état Installation demandée(Install Requested)
Record Number: 154483
Source Name: Microsoft-Windows-Servicing
Time Written: 20100106090129.000000-000
Event Type: Avertissement
User: PC-de-frederiqu\frederique

Computer Name: PC-de-frederiqu
Event Code: 4376
Message: Servicing a requis un redémarrage pour terminer la définition du package KB976325(Security Update) à l’état Installation demandée(Install Requested)
Record Number: 154485
Source Name: Microsoft-Windows-Servicing
Time Written: 20100106090129.000000-000
Event Type: Avertissement
User: PC-de-frederiqu\frederique

=====Application event log=====

Computer Name: PC-de-frederiqu
Event Code: 1000
Message: Application défaillante explorer.exe, version 6.0.6001.18164, horodatage 0x4907e242, module défaillant dmocx32.dll, version 0.0.0.0, horodatage 0x4b338711, code d’exception 0xc0000005, décalage d’erreur 0x00010d39, ID du processus 0xb98, heure de début de l’application 0x01ca8e3587f4eead.
Record Number: 71650
Source Name: Application Error
Time Written: 20100105183311.000000-000
Event Type: Erreur
User:

Computer Name: PC-de-frederiqu
Event Code: 1000
Message: Application défaillante explorer.exe, version 6.0.6001.18164, horodatage 0x4907e242, module défaillant dmocx32.dll, version 0.0.0.0, horodatage 0x4b338711, code d’exception 0xc0000005, décalage d’erreur 0x0000200d, ID du processus 0xf04, heure de début de l’application 0x01ca8e362109a784.
Record Number: 71705
Source Name: Application Error
Time Written: 20100105183733.000000-000
Event Type: Erreur
User:

Computer Name: PC-de-frederiqu
Event Code: 1000
Message: Application défaillante explorer.exe, version 6.0.6001.18164, horodatage 0x4907e242, module défaillant dmocx32.dll_unloaded, version 0.0.0.0, horodatage 0x4b338711, code d’exception 0xc0000005, décalage d’erreur 0x10010d39, ID du processus 0xee0, heure de début de l’application 0x01ca8e3668f371c4.
Record Number: 71707
Source Name: Application Error
Time Written: 20100105183928.000000-000
Event Type: Erreur
User:

Computer Name: PC-de-frederiqu
Event Code: 1000
Message: Application défaillante Explorer.EXE, version 6.0.6001.18164, horodatage 0x4907e242, module défaillant dmocx32.dll, version 0.0.0.0, horodatage 0x4b338711, code d’exception 0xc0000005, décalage d’erreur 0x0000200d, ID du processus 0x848, heure de début de l’application 0x01ca8e3b85484655.
Record Number: 71722
Source Name: Application Error
Time Written: 20100105191610.000000-000
Event Type: Erreur
User:

Computer Name: PC-de-frederiqu
Event Code: 1000
Message: Application défaillante explorer.exe, version 6.0.6001.18164, horodatage 0x4907e242, module défaillant SHLWAPI.dll, version 6.0.6001.18000, horodatage 0x4791a75c, code d’exception 0xc0000005, décalage d’erreur 0x00020d4c, ID du processus 0xad4, heure de début de l’application 0x01ca8e3bab0fb8f5.
Record Number: 71783
Source Name: Application Error
Time Written: 20100106085450.000000-000
Event Type: Erreur
User:

=====Security event log=====

Computer Name: PC-de-frederiqu
Event Code: 4672
Message: Privilèges spéciaux attribués à la nouvelle ouverture de session.

Sujet :
ID de sécurité : S-1-5-18
Nom du compte : SYSTEM
Domaine du compte : AUTORITE NT
ID d’ouverture de session : 0x3e7

Privilèges : SeAssignPrimaryTokenPrivilege
SeTcbPrivilege
SeSecurityPrivilege
SeTakeOwnershipPrivilege
SeLoadDriverPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeDebugPrivilege
SeAuditPrivilege
SeSystemEnvironmentPrivilege
SeImpersonatePrivilege
Record Number: 28849
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090212125027.780400-000
Event Type: Succès de l'audit
User:

Computer Name: PC-de-frederiqu
Event Code: 4647
Message: Fermeture de session initiée par l’utilisateur :

Sujet :
ID de sécurité : S-1-5-21-4183581156-1823947664-1311954497-1003
Nom du compte : frederique
Domaine du compte : PC-de-frederiqu
ID d’ouverture de session : 0x399d2

Cet événement est généré lorsqu’une fermeture de session est initiée, mais que le nombre de références du jeton n’étant pas zéro, la session ouverte ne peut pas être supprimée. Aucune autre activité initiée par l’utilisateur ne peut se produire. Cet événement peut être interprété comme un événement de fermeture de session.
Record Number: 28850
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090212134508.493000-000
Event Type: Succès de l'audit
User:

Computer Name: PC-de-frederiqu
Event Code: 1100
Message: Le service d’enregistrement des événements a été arrêté.
Record Number: 28851
Source Name: Microsoft-Windows-Eventlog
Time Written: 20090212134521.675000-000
Event Type: Succès de l'audit
User:

Computer Name: PC-de-frederiqu
Event Code: 4616
Message: L’heure du système a été modifiée.

Sujet :
ID de sécurité : S-1-5-19
Nom du compte : SERVICE LOCAL
Domaine du compte : AUTORITE NT
ID d’ouverture de session : 0x3e5

Informations sur le processus :
ID du processus : 0x5a4
Nom : C:\Windows\System32\svchost.exe

Heure précédente : 14:45:21 12/02/2009
Nouvelle heure : 14:45:21 12/02/2009

Cet événement est généré lorsque l’heure du système est modifiée. Le changement régulier de l’heure du système est une opération normale de la part du service de temps Windows qui s’exécute avec des privilèges système. Mais, d’autres modifications de l’heure du système peuvent indiquer des tentatives de falsification de l’ordinateur.
Record Number: 28852
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090212134525.480800-000
Event Type: Succès de l'audit
User:

Computer Name: PC-de-frederiqu
Event Code: 4634
Message: Fermeture de session d’un compte.

Sujet :
ID de sécurité : S-1-5-7
Nom du compte : ANONYMOUS LOGON
Domaine du compte : AUTORITE NT
ID du compte : 0x33fa3

Type d’ouverture de session : 3

Cet événement est généré lorsqu’une session ouverte est supprimée. Il peut être associé à un événement d’ouverture de session en utilisant la valeur ID d’ouverture de session. Les ID d’ouverture de session ne sont uniques qu’entre les redémarrages sur un même ordinateur.
Record Number: 28853
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090212134556.134800-000
Event Type: Succès de l'audit
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;c:\Program Files\Microsoft SQL Server\90\Tools\binn\
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE"=x86
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"USERNAME"=SYSTEM
"windir"=%SystemRoot%
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 13, GenuineIntel
"PROCESSOR_REVISION"=0f0d
"NUMBER_OF_PROCESSORS"=2

-----------------EOF-----------------
Logfile of random's system information tool 1.06 (written by random/random)
Run by frederique at 2010-01-06 09:59:19
Microsoft® Windows Vista™ Professionnel Service Pack 1
System drive C: has 10 GB (17%) free of 57 GB
Total RAM: 1014 MB (19% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:01:14, on 06/01/2010
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18349)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Search Guard Plus\SearchGuardPlus.exe
C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Windows\System32\ThpSrv.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\IDM\Desktop SMS\DesktopSMS.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Winsudate\gibusr.exe
C:\Program Files\Electronic Arts\EADM\Core.exe
C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files\Protector Suite QL\psqltray.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSwMgr.exe
C:\Program Files\Windows Mail\WinMail.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\conime.exe
C:\Windows\SYSTEM32\WISPTIS.EXE
C:\Windows\explorer.exe
C:\Windows\system32\wuauclt.exe
C:\Users\frederique\Desktop\RSIT.exe
C:\Program Files\trend micro\frederique.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.orange.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: SearchHelper Class - {91C18ED5-5E1C-4AE5-A148-A861DE8C8E16} - C:\Program Files\SGPSA\mtwb3sh.dll
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {0365D4B0-3A0D-4DE5-AD4F-BE080B219667} - C:\Windows\System32\dwmredir32.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: BrowserHelper Class - {8A9D74F9-560B-4FE7-ABEB-3B2E638E5CD6} - C:\Program Files\SGPSA\SearchAssistant.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [TOSDCR] %ProgramFiles%\TOSHIBA\PasswordUtility\TOSDCR.exe
O4 - HKLM\..\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
O4 - HKLM\..\Run: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe
O4 - HKLM\..\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [topi] C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe -startup
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [PopUp Destroy] C:\Program Files\PopUp Destroy\Popup-Destroy.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Toshiba Registration] C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe
O4 - HKLM\..\Run: [TosAutLk] c:\Program Files\TOSHIBA\WirelessKeyLogon\TosAutLk.exe -s
O4 - HKLM\..\Run: [ThpSrv] C:\Windows\system32\thpsrv /logon
O4 - HKLM\..\Run: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
O4 - HKLM\..\Run: [PSQLLauncher] "C:\Program Files\Protector Suite QL\launcher.exe" /startup
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [Desktop SMS] C:\Program Files\IDM\Desktop SMS\DesktopSMS.exe /auto
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [Speech Recognition] "C:\Windows\Speech\Common\sapisvr.exe" -SpeechUX -Startup
O4 - HKCU\..\Run: [WinUsr] C:\Program Files\Winsudate\gibusr.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [EA Core] "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent
O4 - HKCU\..\Run: [RTHDBPL] C:\Users\frederique\AppData\Roaming\SystemProc\lsass.exe
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: eBay - Achetez, Vendez - {76577871-04EC-495E-A12B-91F7C3600AFA} - http://rover.ebay.com/rover/1/709-44555-9400-3/4 (file missing)
O9 - Extra button: Amazon.fr - {8A918C1D-E123-4E36-B562-5C1519E434CE} - http://www.amazon.fr/exec/obidos/redirect-home?tag=Toshibafrbholink-21&site=home (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/...
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab
O20 - AppInit_DLLs: C:\Windows\System32\dmocx32.dll
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Service Google Update (gupdate1c99b42a509777f) (gupdate1c99b42a509777f) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: TOSHIBA HDD Protection (Thpsrv) - TOSHIBA Corporation - C:\Windows\system32\ThpSrv.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe
O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
O23 - Service: TOSHIBA Bluetooth Service - Unknown owner - c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe (file missing)
O23 - Service: Gestionnaire de mise à jour Winsudate (WinSvc) - Winsudate - C:\Program Files\Winsudate\gibsvc.exe

Hello Nathandre, voici le rapport Malwarebytes :

Malwarebytes' Anti-Malware 1.43
Version de la base de données: 3499
Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18865

06/01/2010 17:08:03
mbam-log-2010-01-06 (17-08-03).txt

Type de recherche: Examen complet (C:\|E:\|)
Eléments examinés: 239244
Temps écoulé: 1 hour(s), 26 minute(s), 0 second(s)

Processus mémoire infecté(s): 2
Module(s) mémoire infecté(s): 1
Clé(s) du Registre infectée(s): 4
Valeur(s) du Registre infectée(s): 3
Elément(s) de données du Registre infecté(s): 2
Dossier(s) infecté(s): 2
Fichier(s) infecté(s): 34

Processus mémoire infecté(s):
C:\Program Files\Winsudate\gibusr.exe (Adware.Gibmedia) -> Unloaded process successfully.
C:\Program Files\Winsudate\gibsvc.exe (Adware.Gibmedia) -> Unloaded process successfully.

Module(s) mémoire infecté(s):
C:\Windows\System32\dmocx32.dll (Trojan.Tracur) -> Delete on reboot.

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\winsvc (Adware.Gibmedia) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1a93c934-025b-4c3a-b38e-9654a7003239} (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6f282b65-56bf-4bd1-a8b2-a4449a05863d} (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\.fsharproj (Trojan.BHO) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winusr (Adware.Gibmedia) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rthdbpl (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\desktop sms (Worm.P2P) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Tracur) -> Data: c:\windows\system32\dmocx32.dll -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Tracur) -> Data: system32\dmocx32.dll -> Delete on reboot.

Dossier(s) infecté(s):
C:\Program Files\Winsudate (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\Windows\System32\SysWoW32 (Worm.Archive) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Windows\System32\dmocx32.dll (Trojan.Tracur) -> Delete on reboot.
C:\Program Files\Winsudate\gibusr.exe (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\Program Files\Winsudate\gibsvc.exe (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DA1LM9VL\gibupt[1].exe (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DA1LM9VL\gibusr[1].exe (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EZKU384H\gibcom[1].dll (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EZKU384H\gibidl[1].dll (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\V4ML8LGU\gibsvc[1].exe (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\Program Files\Winsudate\gibcom.dll (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\Program Files\Winsudate\gibidl.dll (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\Program Files\Winsudate\gibupt.exe (Adware.Gibmedia) -> Quarantined and deleted successfully.
C:\Windows\System32\SysWoW32\@i104748141v4 (Worm.Archive) -> Quarantined and deleted successfully.
C:\Windows\System32\SysWoW32\@i104748141v6 (Worm.Archive) -> Quarantined and deleted successfully.
C:\Windows\System32\SysWoW32\@i104748141v7 (Worm.Archive) -> Quarantined and deleted successfully.
C:\Windows\System32\SysWoW32\@u104748141v5 (Worm.Archive) -> Quarantined and deleted successfully.
C:\Windows\System32\SysWoW32\mi104748141v4 (Worm.Archive) -> Quarantined and deleted successfully.
C:\Windows\System32\SysWoW32\mi104748141v4.kwd (Worm.Archive) -> Quarantined and deleted successfully.
C:\Windows\System32\SysWoW32\mi104748141v6 (Worm.Archive) -> Quarantined and deleted successfully.
C:\Windows\System32\SysWoW32\mi104748141v6.kwd (Worm.Archive) -> Quarantined and deleted successfully.
C:\Windows\System32\SysWoW32\mi104748141v7 (Worm.Archive) -> Quarantined and deleted successfully.
C:\Windows\System32\SysWoW32\mi104748141v7.kwd (Worm.Archive) -> Quarantined and deleted successfully.
C:\Windows\System32\SysWoW32\mu104748141v5 (Worm.Archive) -> Quarantined and deleted successfully.
C:\Windows\System32\SysWoW32\mu104748141v5.kwd (Worm.Archive) -> Quarantined and deleted successfully.
C:\Windows\System32\SysWoW32\wu104748141v0.kwd (Worm.Archive) -> Quarantined and deleted successfully.
C:\Windows\System32\SysWoW32\wu104748141v1.kwd (Worm.Archive) -> Quarantined and deleted successfully.
C:\Windows\System32\SysWoW32\wu104748141v2.kwd (Worm.Archive) -> Quarantined and deleted successfully.
C:\Windows\System32\SysWoW32\wu104748141v3.kwd (Worm.Archive) -> Quarantined and deleted successfully.
C:\Windows\System32\SysWoW32\_i104748141v4 (Worm.Archive) -> Quarantined and deleted successfully.
C:\Windows\System32\SysWoW32\_i104748141v6 (Worm.Archive) -> Quarantined and deleted successfully.
C:\Windows\System32\SysWoW32\_i104748141v7 (Worm.Archive) -> Quarantined and deleted successfully.
C:\Windows\System32\SysWoW32\_u104748141v5 (Worm.Archive) -> Quarantined and deleted successfully.
C:\Users\frederique\AppData\Roaming\SystemProc\lsass.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\GnuHashes.ini (Malware.Trace) -> Quarantined and deleted successfully.
C:\confin.sys (Malware.Trace) -> Quarantined and deleted successfully.

Bon déjà, je sais pas par quelle manoeuvre mais le pb de l'explorateur est résolu.
Est ce que je peux supprimer la quarantaine de Malwarebytes ?
Sinon j'essaie de lancer un nettoyage de Ad-Remover, l'ordinateur redemarre mais AD-R ne se lance jamais au redémarrage.
Voici le rapport RSIT :

Logfile of random's system information tool 1.06 (written by random/random)
Run by frederique at 2010-01-07 10:19:43
Microsoft® Windows Vista™ Professionnel Service Pack 2
System drive C: has 16 GB (28%) free of 57 GB
Total RAM: 1014 MB (25% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:21:41, on 07/01/2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18865)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Windows\System32\ThpSrv.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Users\frederique\Desktop\RSIT.exe
C:\Program Files\trend micro\frederique.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Windows\system32\conime.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.orange.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: BrowserHelper Class - {8A9D74F9-560B-4FE7-ABEB-3B2E638E5CD6} - C:\Program Files\SGPSA\SearchAssistant.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [TosAutLk] c:\Program Files\TOSHIBA\WirelessKeyLogon\TosAutLk.exe -s
O4 - HKLM\..\Run: [ThpSrv] C:\Windows\system32\thpsrv /logon
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: eBay - Achetez, Vendez - {76577871-04EC-495E-A12B-91F7C3600AFA} - http://rover.ebay.com/rover/1/709-44555-9400-3/4 (file missing)
O9 - Extra button: Amazon.fr - {8A918C1D-E123-4E36-B562-5C1519E434CE} - http://www.amazon.fr/exec/obidos/redirect-home?tag=Toshibafrbholink-21&site=home (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (no file)
O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)
O13 - Gopher Prefix:
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/...
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} (get_atlcom Class) - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: TOSHIBA HDD Protection (Thpsrv) - TOSHIBA Corporation - C:\Windows\system32\ThpSrv.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe
O23 - Service: TOSHIBA Bluetooth Service - Unknown owner - c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe (file missing)

je reviens sur mon post 7, c'est normal qu'il n'y a pas le rapport info.txt
héberge le rapport log.txt sur le site ci joint.fr, car il n'est pas complet

Voici le lien du fichier log.txt :

http://www.cijoint.fr/cjlink.php?file=cj201001/cijpEZxeac.txt

Toujours le meme problème, je lance AD-R.exe en tant qu'administrateur, le controle de comptes est désactivé, l'ordintateur redémarre mais au redémarrage, AD-R ne s'exécute pas après avoir ouvert la session.

Je desespérais, j'aurais pu y penser plus tôt. Voici le rapport :
.
======= RAPPORT D'AD-REMOVER 1.1.4.6_G | UNIQUEMENT XP/VISTA/7 =======
.
Mis à jour par C_XX le 05.01.2010 à 18:50
Contact: AdRemover.contact@gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Lancé à: 18:04:40, 07/01/2010 | Mode Normal | Option: CLEAN
Exécuté de: C:\Program Files\Ad-Remover\
Système d'exploitation: Microsoft® Windows Vista™ Business Service Pack 2 v6.0.6002
Nom du PC: PC-DE-FREDERIQU | Utilisateur actuel: frederique

.
============== ÉLÉMENT(S) NEUTRALISÉ(S) ==============
.

C:\Program Files\SGPSA
C:\Program Files\Winletmin

(!) -- Fichiers temporaires supprimés.

.
HKLM\Software\Classes\CLSID\{8A9D74F9-560B-4FE7-ABEB-3B2E638E5CD6}
HKLM\Software\Classes\TypeLib\{4509D3CC-B642-4745-B030-645B79522C6D}
HKLM\software\classes\URLSearchHook.ToolbarURLSearchHook
HKLM\software\classes\URLSearchHook.ToolbarURLSearchHook.1
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8EEB63E6-3F4D-4203-8605-1240BEB0CBD4}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8A9D74F9-560B-4FE7-ABEB-3B2E638E5CD6}
HKU\.default\software\GamesBar
.
============== Scan additionnel ==============
.
.
* Internet Explorer Version 8.0.6001.18865 *
.
[HKEY_CURRENT_USER\..\Internet Explorer\Main]
.
Do404Search: 01000000
Local Page: C:\Windows\system32\blank.htm
Show_ToolBar: yes
Enable Browser Extensions: yes
Start Page: hxxp://fr.msn.com/
Use Search Asst:
Use Custom Search URL: 1 (0x1)
Search Bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchAssistant:
Default_page_url: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]
.
Start Page: hxxp://fr.msn.com/
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Delete_Temp_Files_On_Exit: yes
Local Page: C:\Windows\System32\blank.htm
Search bar: hxxp://search.msn.com/spbasic.htm
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]
.
Tabs: res://ieframe.dll/tabswelcome.htm
.
===================================
.
2349 Octet(s) - C:\Ad-Report-CLEAN[1].log
.
0 Fichier(s) - C:\Users\FREDER~1\AppData\Local\Temp
1 Fichier(s) - C:\Windows\Temp
0 Fichier(s) - C:\Windows\Prefetch
.
19 Fichier(s) - C:\Program Files\Ad-Remover\BACKUP
3 Fichier(s) - C:\Program Files\Ad-Remover\QUARANTINE
.
Fin à: 18:08:28 | 07/01/2010 - CLEAN[1]
.
============== E.O.F ==============
.

Voici :

http://www.cijoint.fr/cjlink.php?file=cj201001/cijNqAAvV4.txt

je verrai cela dans la soirée

Ca donne quoi ce rapport ?

J'ai analysé les fichiers.
Aucun virus détectés.
Encore des procédures à effectuer ?

Salut à vous 2,

Coucou Mat' ... :)

Pour suivre.

PS: les fichiers semblent infectieux ... ;)
et le dossier, ça ressemble à une infection genre security tool.
sauf le dernier, il est sain.
Ne pas oublier, l'UAC et norton ...

Hello fix,
En l'occurence non ces fichiers n'ont pas été détectés.
Le dossier je ne l'ai pas passé sur virus total (le dossier est vide d'ailleurs donc comment faire ?)
Pour l'UAC et Norton, que faut il faire ?
L'UAC est désactivée, et en fait l'alerte du centre de sécurité n'apparait meme pas dans la zone de notification.

bonsoir mat bonne Année

bonsoir à tous

pour suivre

bonsoir mat, désolée, j'étais occupée
Attention, avant de commencer, lit attentivement la procédure, et imprime la

Télécharge ComboFix de sUBs sur ton Bureau :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

/!\ Déconnecte-toi du net et DESACTIVES TOUTES LES DEFENSES, antivirus et antispyware y compris /!\
---> Clic droit sur ComboFix.exe, et sur exécuter en tant qu'administrateur
Un "pop-up" va apparaître qui dit que ComboFix est utilisé à vos risques et avec aucune garantie... Clique sur oui pour accepter
SURTOUT INSTALLES LA CONSOLE DE RECUPERATION
---> Mets-le en langue française F
Tape sur la touche 1 (Yes) pour démarrer le scan.

Ne touche à rien(souris, clavier) tant que le scan n'est pas terminé, car tu risques de planter ton PC

En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.

Une fois le scan achevé, un rapport va s'afficher : Poste son contenu

/!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\

Note : Le rapport se trouve également là : C:\ComboFix.txt

ComboFix 10-01-04.01 - frederique 11/01/2010 10:40:04.1.2 - x86
Microsoft® Windows Vista™ Professionnel 6.0.6002.2.1252.33.1036.18.1014.294 [GMT 1:00]
Lancé depuis: c:\users\frederique\Desktop\ComboFix.exe
SP: Windows Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-54147300-3733482535-1002236262-500
c:\$recycle.bin\S-1-5-21-918056312-2952985149-2686913973-500
c:\users\frederique\AppData\Roaming\020000003f421330724C.manifest
c:\users\frederique\AppData\Roaming\020000003f421330724O.manifest
c:\users\frederique\AppData\Roaming\020000003f421330724P.manifest
c:\users\frederique\AppData\Roaming\020000003f421330724S.manifest
c:\users\frederique\AppData\Roaming\SystemProc
c:\windows\system32\1851156816
c:\windows\system32\6D7yOJp.vbs
c:\windows\system32\config\systemprofile\AppData\Roaming\020000003f421330724C.manifest
c:\windows\system32\config\systemprofile\AppData\Roaming\020000003f421330724O.manifest
c:\windows\system32\config\systemprofile\AppData\Roaming\020000003f421330724P.manifest
c:\windows\system32\config\systemprofile\AppData\Roaming\020000003f421330724S.manifest
c:\windows\system32\jfFZq.vbs
c:\windows\system32\oQaqe.vbs
c:\windows\system32\rC9dC3L.vbs
c:\windows\system32\unrar.exe
c:\windows\system32\Zv6eP.vbs

.
((((((((((((((((((((((((((((( Fichiers créés du 2009-12-11 au 2010-01-11 ))))))))))))))))))))))))))))))))))))
.

2010-01-07 17:32 . 2010-01-07 17:32 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Roaming\TeamViewer
2010-01-07 17:32 . 2010-01-07 17:32 -------- d-----w- c:\users\frederique\AppData\Roaming\TeamViewer
2010-01-07 17:31 . 2010-01-07 17:31 -------- d-----w- c:\program files\TeamViewer
2010-01-07 17:31 . 2010-01-07 17:31 -------- d-----w- c:\users\frederique\temp
2010-01-07 17:12 . 2009-08-24 11:36 377344 ----a-w- c:\windows\system32\winhttp.dll
2010-01-07 17:03 . 2010-01-07 17:08 -------- d-----w- c:\program files\Ad-Remover
2010-01-06 19:17 . 2010-01-06 19:19 -------- d-----w- C:\ToolBar SD
2010-01-06 18:52 . 2010-01-06 18:52 -------- d-----w- c:\program files\CCleaner
2010-01-06 18:48 . 2010-01-06 19:29 -------- d-----w- C:\GenProc
2010-01-06 18:28 . 2009-06-15 14:52 499712 ----a-w- c:\windows\system32\kerberos.dll
2010-01-06 18:28 . 2009-06-15 14:53 270848 ----a-w- c:\windows\system32\schannel.dll
2010-01-06 18:24 . 2010-01-06 18:24 104040 ----a-w- c:\windows\system32\GDIPFONTCACHEV1.DAT
2010-01-06 17:57 . 2010-01-06 18:07 -------- d-----w- c:\programdata\NOS
2010-01-06 17:57 . 2010-01-06 17:57 -------- d-----w- c:\program files\NOS
2010-01-06 16:52 . 2010-01-06 16:52 -------- d-----w- c:\program files\Windows Portable Devices
2010-01-06 16:50 . 2009-09-10 02:00 92672 ----a-w- c:\windows\system32\UIAnimation.dll
2010-01-06 16:50 . 2009-09-10 02:01 3023360 ----a-w- c:\windows\system32\UIRibbon.dll
2010-01-06 16:50 . 2009-09-10 02:00 1164800 ----a-w- c:\windows\system32\UIRibbonRes.dll
2010-01-06 16:48 . 2009-10-01 01:02 30208 ----a-w- c:\windows\system32\WPDShextAutoplay.exe
2010-01-06 16:46 . 2009-10-08 21:08 234496 ----a-w- c:\windows\system32\oleacc.dll
2010-01-06 16:46 . 2009-10-08 21:07 4096 ----a-w- c:\windows\system32\oleaccrc.dll
2010-01-06 16:46 . 2009-10-08 21:08 555520 ----a-w- c:\windows\system32\UIAutomationCore.dll
2010-01-06 14:40 . 2010-01-06 14:40 -------- d-----w- c:\users\frederique\AppData\Roaming\Malwarebytes
2010-01-06 14:40 . 2009-12-30 13:55 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-06 14:40 . 2010-01-06 14:40 -------- d-----w- c:\programdata\Malwarebytes
2010-01-06 14:40 . 2010-01-06 14:40 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-06 14:40 . 2009-12-30 13:54 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-06 10:59 . 2010-01-06 10:59 -------- d-----w- c:\program files\VS Revo Group
2010-01-06 10:28 . 2010-01-06 10:28 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2010-01-06 10:22 . 2010-01-06 10:22 -------- d-----w- c:\program files\ESET
2010-01-06 09:51 . 2010-01-06 09:51 -------- d-----w- c:\windows\system32\ca-ES
2010-01-06 09:51 . 2010-01-06 09:51 -------- d-----w- c:\windows\system32\eu-ES
2010-01-06 09:51 . 2010-01-06 09:51 -------- d-----w- c:\windows\system32\vi-VN
2010-01-06 09:24 . 2010-01-06 09:24 -------- d-----w- c:\windows\system32\EventProviders
2010-01-06 01:50 . 2009-04-11 05:03 12240896 ----a-w- c:\windows\system32\NlsLexicons0007.dll
2010-01-06 01:48 . 2009-04-11 06:28 754688 ----a-w- c:\windows\system32\propsys.dll
2010-01-06 01:47 . 2009-04-11 06:28 189952 ----a-w- c:\windows\system32\winmm.dll
2010-01-06 01:46 . 2009-04-11 06:28 31744 ----a-w- c:\windows\system32\bitsigd.dll
2010-01-06 01:45 . 2009-04-11 06:28 705536 ----a-w- c:\windows\system32\SmiEngine.dll
2010-01-06 01:45 . 2009-04-11 06:28 218624 ----a-w- c:\windows\system32\wdscore.dll
2010-01-06 01:45 . 2009-04-11 06:27 130560 ----a-w- c:\windows\system32\PkgMgr.exe
2010-01-06 01:45 . 2009-04-11 06:28 247808 ----a-w- c:\windows\system32\drvstore.dll
2010-01-05 17:59 . 2010-01-05 17:59 -------- d-----w- c:\users\frederique\AppData\Local\Seven Zip
2009-12-29 17:49 . 2009-10-29 09:17 2048 ----a-w- c:\windows\system32\tzres.dll
2009-12-29 17:45 . 2009-11-09 12:31 24064 ----a-w- c:\windows\system32\nshhttp.dll
2009-12-29 17:45 . 2009-11-09 10:36 411648 ----a-w- c:\windows\system32\drivers\http.sys
2009-12-29 17:45 . 2009-11-09 12:30 30720 ----a-w- c:\windows\system32\httpapi.dll
2009-12-25 15:42 . 2010-01-05 18:17 12288 ----a-w- c:\users\Public\mtwb.dat
2009-12-25 15:19 . 2009-12-25 15:19 -------- d-----w- c:\programdata\Electronic Arts
2009-12-25 15:17 . 2009-12-25 15:17 10134 ----a-r- c:\users\frederique\AppData\Roaming\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe
2009-12-25 15:17 . 2009-12-25 15:17 -------- d-----w- c:\program files\Microsoft WSE
2009-12-25 15:16 . 2006-09-28 15:05 2414360 ----a-w- c:\windows\system32\d3dx9_31.dll
2009-12-25 15:06 . 2009-12-25 15:06 -------- d-----w- c:\programdata\WindowsSearch
2009-12-25 14:51 . 2010-01-06 11:59 -------- d-----w- c:\program files\Electronic Arts

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-07 17:24 . 2010-01-06 08:59 -------- d-----w- c:\program files\trend micro
2010-01-06 19:23 . 2008-01-16 14:22 104040 ----a-w- c:\users\frederique\AppData\Local\GDIPFONTCACHEV1.DAT
2010-01-06 18:02 . 2007-07-18 09:31 -------- d-----w- c:\program files\Common Files\Adobe
2010-01-06 17:54 . 2009-11-14 09:30 -------- d-----w- c:\program files\OpenOffice.org 3
2010-01-06 17:29 . 2009-03-06 14:49 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-01-06 17:28 . 2007-07-18 08:27 -------- d-----w- c:\program files\Java
2010-01-06 17:07 . 2007-07-18 08:36 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-06 17:07 . 2007-07-18 07:34 -------- d-----w- c:\program files\TOSHIBA
2010-01-06 17:06 . 2008-01-26 13:20 -------- d-----w- c:\program files\Google
2010-01-06 17:02 . 2006-11-02 15:47 724052 ----a-w- c:\windows\system32\perfh00C.dat
2010-01-06 17:02 . 2006-11-02 15:47 146398 ----a-w- c:\windows\system32\perfc00C.dat
2010-01-06 16:52 . 2006-11-02 10:25 665600 ----a-w- c:\windows\inf\drvindex.dat
2010-01-06 16:52 . 2010-01-06 16:52 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
2010-01-06 16:52 . 2010-01-06 16:52 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_07_00.Wdf
2010-01-06 10:30 . 2009-11-14 09:41 1 ----a-w- c:\users\frederique\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-01-06 10:18 . 2010-01-06 10:18 1372 ----a-w- c:\users\frederique\AppData\Roaming\CuPR1COaX1RLyUG.vbs
2010-01-06 09:52 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Calendar
2010-01-06 09:52 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-01-06 09:52 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Sidebar
2010-01-06 09:52 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Journal
2010-01-06 09:52 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Collaboration
2010-01-06 09:52 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Photo Gallery
2010-01-06 09:52 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Defender
2010-01-05 18:25 . 2009-09-26 14:02 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-01-05 18:23 . 2009-09-26 14:02 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2010-01-05 18:08 . 2007-07-18 09:46 -------- d-----w- c:\programdata\Symantec
2010-01-05 18:08 . 2007-07-18 09:46 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-01-05 18:01 . 2008-02-22 09:07 -------- d-----w- c:\program files\DivX
2009-12-29 17:45 . 2009-09-16 12:59 -------- d-----w- c:\program files\Microsoft Silverlight
2009-12-28 09:20 . 2009-12-28 09:20 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
2009-12-25 19:00 . 2008-05-02 08:04 -------- d-----w- c:\users\frederique\AppData\Roaming\LimeWire
2009-12-25 18:40 . 2009-12-25 18:40 1372 ----a-w- c:\users\frederique\AppData\Roaming\x6QHe0H.vbs
2009-12-12 20:59 . 2008-01-16 14:16 104040 ----a-w- c:\windows\system32\config\systemprofile\AppData\Local\GDIPFONTCACHEV1.DAT
2009-12-04 17:55 . 2009-12-04 17:53 -------- d-----w- c:\users\frederique\AppData\Roaming\Go Go Gourmet
2009-12-04 17:52 . 2009-01-29 12:56 -------- d-----w- c:\program files\Oberon Media
2009-12-04 17:02 . 2009-12-04 17:02 -------- d-----w- c:\users\frederique\AppData\Roaming\CupcakeCafe
2009-11-24 23:54 . 2009-09-26 14:24 1280480 ----a-w- c:\windows\system32\aswBoot.exe
2009-11-24 23:49 . 2009-09-26 14:25 48560 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-11-24 23:48 . 2009-09-26 14:25 23120 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-11-24 23:47 . 2009-09-26 14:25 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-11-21 06:40 . 2010-01-06 08:59 916480 ----a-w- c:\windows\system32\wininet.dll
2009-11-21 06:34 . 2010-01-06 08:59 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-11-21 06:34 . 2010-01-06 08:59 109056 ----a-w- c:\windows\system32\iesysprep.dll
2009-11-21 04:59 . 2010-01-06 08:59 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-11-14 09:40 . 2009-11-14 09:40 -------- d-----w- c:\users\frederique\AppData\Roaming\OpenOffice.org
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlay]
@="{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}"
[HKEY_CLASSES_ROOT\CLSID\{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}]
2006-12-03 15:03 2854912 ----a-w- c:\program files\Protector Suite QL\farchns.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlayOpen]
@="{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}"
[HKEY_CLASSES_ROOT\CLSID\{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}]
2006-12-03 15:03 2854912 ----a-w- c:\program files\Protector Suite QL\farchns.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD\toscdspd.exe" [2006-11-13 413696]
"MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ThpSrv"="c:\windows\system32\thpsrv" [X]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]
"00TCrdMain"="c:\program files\TOSHIBA\FlashCards\TCrdMain.exe" [2007-04-26 538744]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-05-11 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-05-11 8429568]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-05-11 81920]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-04-06 138008]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-04-06 154392]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-04-06 133912]
"RtHDVCpl"="RtHDVCpl.exe" [2007-03-09 4390912]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2006-09-11 180224]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"TosAutLk"="c:\program files\TOSHIBA\WirelessKeyLogon\TosAutLk.exe" [2007-06-13 116304]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2010-01-06 149280]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"FilterAdministratorToken"= 1 (0x1)
"DisableCAD"= 1 (0x1)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableLUA"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]
2006-12-03 14:50 90112 ----a-w- c:\windows\System32\psqlpwd.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli psqlpwd

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HSON]
2006-12-07 14:49 55416 ----a-w- c:\program files\TOSHIBA\TBS\HSON.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PSQLLauncher]
2006-12-03 14:29 49168 ----a-w- c:\program files\Protector Suite QL\launcher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmoothView]
2007-05-16 13:52 509496 ----a-w- c:\program files\TOSHIBA\SmoothView\SmoothView.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Speech Recognition]
2008-01-19 07:33 49664 ----a-w- c:\windows\Speech\Common\sapisvr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-01-06 17:29 149280 ----a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\topi]
2007-04-02 10:48 577536 ----a-w- c:\program files\TOSHIBA\Toshiba Online Product Information\TOPI.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TOSDCR]
2007-01-10 09:59 174200 ----a-w- c:\program files\TOSHIBA\PasswordUtility\TOSDCR.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Toshiba Registration]
2007-05-04 11:05 571024 ----a-w- c:\program files\TOSHIBA\Registration\ToshibaRegistration.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPwrMain]
2007-03-29 08:39 411192 ----a-w- c:\program files\TOSHIBA\Power Saver\TPwrMain.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):21,e5,97,31,b7,8e,ca,01

R0 Thpdrv;TOSHIBA HDD Protection Driver;c:\windows\System32\drivers\thpdrv.sys [27/04/2007 09:22 21504]
R0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver;c:\windows\System32\drivers\Thpevm.sys [07/02/2007 16:29 6528]
R1 aswSP;avast! Self Protection;c:\windows\System32\drivers\aswSP.sys [26/09/2009 15:24 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\System32\drivers\aswFsBlk.sys [26/09/2009 15:24 20560]
R2 aswMonFlt;aswMonFlt;c:\windows\System32\drivers\aswMonFlt.sys [26/09/2009 15:24 53328]
R2 TeamViewer4;TeamViewer 4;c:\program files\TeamViewer\Version4\TeamViewer_Service.exe [07/10/2009 13:50 185640]
R3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\System32\drivers\NETw5v32.sys [17/11/2008 15:40 3668480]
S3 FontCache;Service de cache de police Windows;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [21/06/2008 10:26 21504]
S3 fssfltr;FssFltr;c:\windows\System32\drivers\fssfltr.sys [16/09/2009 13:59 54632]
S3 fsssvc;Service Windows Live Contrôle parental;c:\program files\Windows Live\Family Safety\fsssvc.exe [05/08/2009 21:48 704864]
S4 gupdate1c99b42a509777f;Service Google Update (gupdate1c99b42a509777f);c:\program files\Google\Update\GoogleUpdate.exe [02/03/2009 15:24 133104]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
getPlusHelper REG_MULTI_SZ getPlusHelper
.
Contenu du dossier 'Tâches planifiées'

2010-01-11 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-01-26 14:44]

2010-01-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-02 14:24]

2010-01-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-02 14:24]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.orange.fr/
mWindow Title =
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
IE: {{76577871-04EC-495E-A12B-91F7C3600AFA} - http://rover.ebay.com/rover/1/709-44555-9400-3/4
IE: {{8A918C1D-E123-4E36-B562-5C1519E434CE} - http://www.amazon.fr/exec/obidos/redirect-home?tag=Toshibafrbholink-21&site=home
DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} - hxxps://secure.gopetslive.com/dev/GoPetsWeb.cab
.
- - - - ORPHELINS SUPPRIMES - - - -

MSConfigStartUp-Adobe Reader Speed Launcher - c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe
MSConfigStartUp-NDSTray - NDSTray.exe
MSConfigStartUp-PopUp Destroy - c:\program files\PopUp Destroy\Popup-Destroy.exe
MSConfigStartUp-swg - c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-11 10:51
Windows 6.0.6002 Service Pack 2 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'lsass.exe'(720)
c:\windows\system32\psqlpwd.dll
c:\program files\Protector Suite QL\homefus2.dll
c:\program files\Protector Suite QL\infra.dll
.
Heure de fin: 2010-01-11 10:56:31
ComboFix-quarantined-files.txt 2010-01-11 09:56

Avant-CF: 17 016 754 176 octets libres
Après-CF: 17 209 384 960 octets libres

- - End Of File - - E24724159CF83CBDAA06F2D71D9A4B15

Voilà qui est fait.
Encore des manipulations ?

http://www.cijoint.fr/cjlink.php?file=cj201001/cijEQY7ipu.txt

Voici ToolsCleaner, j'ai supprimé manuellement ce qui était en erreur. Je continue la suite.

[ Rapport ToolsCleaner version 2.3.11 (par A.Rothstein & dj QUIOU) ]

--> Recherche:

C:\Combofix.txt: trouvé !
C:\TB.txt: trouvé !
C:\Combofix: trouvé !
C:\GenProc: trouvé !
C:\Qoobox: trouvé !
C:\Toolbar SD: trouvé !
C:\Rsit: trouvé !
C:\GenProc\Genproc.exe: trouvé !
C:\GenProc\Outil\hijackthis.log: trouvé !
C:\GenProc\Outil\mbr.exe: trouvé !
C:\GenProc\Outil\ZHPDiag: trouvé !
C:\GenProc\Outil\ZHPDiag\ZHPdiag.exe: trouvé !
C:\GenProc\Page\GenProc[*].html: trouvé !
C:\Program Files\Ad-remover: trouvé !
C:\Program Files\Ad-Remover\BACKUP\Ad-R.exe: trouvé !
C:\Program Files\trend micro\HijackThis.exe: trouvé !
C:\Program Files\trend micro\hijackthis.log: trouvé !
C:\Qoobox\Quarantine\catchme.log: trouvé !
C:\Users\frederique\Desktop\ComboFix.exe: trouvé !
C:\Users\frederique\Desktop\Ad-R.exe: trouvé !
C:\Users\frederique\Desktop\ToolBarSD.exe: trouvé !
C:\Users\frederique\Desktop\Rsit.exe: trouvé !
C:\Users\frederique\Downloads\Ad-R.exe: trouvé !
C:\Windows\mbr.exe: trouvé !

---------------------------------
--> Suppression:

C:\GenProc\Outil\ZHPDiag\ZHPdiag.exe: supprimé !
C:\Program Files\Ad-Remover\BACKUP\Ad-R.exe: supprimé !
C:\Program Files\trend micro\HijackThis.exe: supprimé !
C:\Users\frederique\Desktop\ComboFix.exe: ERREUR DE SUPPRESSION !!
C:\Users\frederique\Desktop\Ad-R.exe: supprimé !
C:\Users\frederique\Desktop\ToolBarSD.exe: supprimé !
C:\Users\frederique\Downloads\Ad-R.exe: supprimé !
C:\Combofix.txt: supprimé !
C:\TB.txt: supprimé !
C:\GenProc\Genproc.exe: supprimé !
C:\GenProc\Outil\hijackthis.log: supprimé !
C:\GenProc\Outil\mbr.exe: supprimé !
C:\GenProc\Page\GenProc[*].html: ERREUR DE SUPPRESSION !!
C:\Program Files\trend micro\hijackthis.log: supprimé !
C:\Qoobox\Quarantine\catchme.log: supprimé !
C:\Users\frederique\Desktop\Rsit.exe: supprimé !
C:\Windows\mbr.exe: supprimé !
C:\Combofix: supprimé !
C:\GenProc: supprimé !
C:\Qoobox: supprimé !
C:\Toolbar SD: supprimé !
C:\Rsit: supprimé !
C:\Program Files\Ad-remover: supprimé !

Corbeille vidée!
Fichiers temporaires nettoyés !