Problème de redirection google

Bonsoir,

3eme essai, le message ne passe pas:


############################## | UsbFix V6.093 |

User : Utilisateur (Administrateurs) # ASUS-V4
Update on 10/02/2010 by El Desaparecido , C_XX & Chimay8
Start at: 17:08:41 | 13/02/2010
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com

Intel(R) Celeron(R) CPU E1200 @ 1.60GHz
Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 7.0.5730.13
Windows Firewall Status : Enabled
AV : AntiVir Desktop 9.0.1.32 [ Enabled | Updated ]
FW : ZoneAlarm Firewall[ Enabled ]7.0.483.000

C:\ -> Disque fixe local # 58,59 Go (33,57 Go free) [WinXP] # NTFS
D:\ -> Disque CD-ROM
E:\ -> Disque fixe local # 239,49 Go (77,26 Go free) [DATA] # NTFS
F:\ -> Disque amovible
G:\ -> Disque amovible # 7,45 Go (3,56 Go free) [KINGSTON] # FAT32

############################## | Processus actifs |

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avscan.exe
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Hotspot Shield\bin\openvpnas.exe
C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\TUProgSt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## | Elements infectieux |

Supprimé ! C:\DOCUME~1\UTILIS~1\Bureau\u95.exe
Supprimé ! C:\Recycler\S-1-5-21-2000478354-484763869-1644491937-1004
Supprimé ! E:\Recycler\S-1-5-21-2000478354-484763869-1644491937-1004

################## | Registre |

Supprimé ! [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe]

################## | Mountpoints2 |

Supprimé ! HKCU\...\Explorer\MountPoints2\{633b0867-eede-11de-8c90-000a78a04a4d}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{68c0aead-76f0-11de-9749-000a78a04a4d}\Shell\Auto\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{89b50dfe-e3fa-11dd-b23f-00235406d136}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{eba40e1d-e966-11dd-8adf-000a78a04a4d}\Shell\AutoRun\Command

################## | Listing des fichiers présent |

[13/02/2010 17:08|--a------|19785] C:\aaw7boot.log
[13/02/2010 00:22|--a------|3255] C:\Ad-Report-CLEAN[1].log
[16/01/2009 18:36|--a------|0] C:\AUTOEXEC.BAT
[16/01/2009 18:31|---hs----|216] C:\boot.ini
[14/04/2008 13:00|-rahs----|4952] C:\Bootfont.bin
[16/01/2009 18:36|--a------|0] C:\CONFIG.SYS
[16/01/2009 18:36|-rahs----|0] C:\IO.SYS
[16/01/2009 18:36|-rahs----|0] C:\MSDOS.SYS
[14/04/2008 13:00|-rahs----|47564] C:\NTDETECT.COM
[14/04/2008 13:00|-rahs----|252240] C:\ntldr
[29/02/2004 16:44|--a------|52576] C:\orange.bmp
[?|?|?] C:\pagefile.sys
[12/02/2010 23:27|--a------|1606] C:\rapport.txt
[16/01/2009 19:09|--a------|522] C:\RHDSetup.log
[16/01/2009 19:24|--ah-----|46] C:\splash.idx
[13/02/2010 17:13|--a------|3916] C:\UsbFix.txt
[15/08/2008 20:02|--ah-----|5632] C:\version
[28/03/2009 15:33|--a------|4582807552] E:\DE_L_AUTRE_COTE___DVD1.ISO
[20/01/2009 18:04|-ra------|9112110] E:\Money Linou.mbf
[18/01/2009 16:03|-ra------|2360254] E:\Money Sauvegarde.mbf
[20/01/2009 18:04|--a------|9162752] E:\MoneyLinou2.mny
[02/01/2010 22:41|--a------|210416] G:\zaSetup_fr.exe
[04/12/2006 11:17|--a------|2680148] G:\M& L-2.jpg
[04/12/2006 11:15|--a------|2734423] G:\M& L.jpg
[13/11/2008 14:54|--a------|13730] G:\prise en charge transports.odt
[22/12/2008 11:42|--a------|38230361] G:\Le Cahier de Tatari.odp
[23/12/2008 18:22|--a------|36778107] G:\Les Dossiers de TATARI.odp
[04/12/2006 11:34|--a------|81364] G:\Lucile 2.jpg
[04/02/2010 10:57|--a------|31744] G:\Certification rapport.doc
[05/09/2009 15:13|--a------|1237967294] G:\Geopolis_L'Espagne_Mars 1996 (43mn).avi
[27/05/2003 23:30|--a------|7494605] G:\Mana - Revolucion de amor - 05 - Pobre Juan.mp3
[02/02/2009 12:59|--a------|16816896] G:\tuneup-utilities-2009_tuneup_utilities_2009_8.0.1100.43_francais_14995.exe
[04/11/2007 21:24|--a------|712843264] G:\Maitres du temps (les) - Rene Laloux - 1982.avi
[15/10/2007 18:40|--a------|11776111] G:\smplayer_smplayer_0.5.21_francais_36467.exe
[24/10/2009 10:29|--a------|17872712] G:\TU2009TrialFR.exe
[24/10/2009 10:25|--a------|11131] G:\Tune Up - Cl‚s produit.odt
[24/12/2009 17:16|--a------|8143344] G:\Firefox Setup 3.5.6.exe
[12/11/2009 19:59|--a------|21321544] G:\TU2010TrialFR.exe
[02/01/2010 22:35|--a------|267152] G:\zonealarm_zone_alarm_gratuit_8.0.298.0_francais_10494.exe
[20/06/2009 20:59|--a------|30143928] G:\avira_antivir_personal_free.exe
[30/07/2008 19:07|--a------|21226896] G:\zaasSetup_70_483_000_fr.exe
[23/12/2009 19:11|--a------|16409960] G:\spybot-search-destroy_spybot_-_search_destroy_1.6.2.46_francais_10965.exe
[24/12/2009 02:45|--a------|849108] G:\bookmarks.html
[27/12/2009 12:39|--a------|4011208] G:\hitman-pro_hitman_pro_2.6.0_anglais_13745.exe
[08/08/2008 16:44|--a------|134290536] G:\OOo_2.4.1_Win32Intel_install_wJRE_fr.exe

################## | Vaccination |

# C:\autorun.inf -> Dossier créé par UsbFix .
# E:\autorun.inf -> Dossier créé par UsbFix .
# G:\autorun.inf -> Dossier créé par UsbFix .

################## | Upload |

Veuillez envoyer le fichier : C:\UsbFix_Upload_Me_ASUS-V4.zip : https://www.ionos.fr/?affiliate_id=77097
Merci pour votre contribution .

################## | ! Fin du rapport # UsbFix V6.093 ! |

Voilà le rapport:

All processes killed
========== FILES ==========
C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe moved successfully.
C:\Program Files\Hotspot Shield\hssie\HssIE.dll moved successfully.
========== REGISTRY ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 5806442 bytes

User: Utilisateur
->Temp folder emptied: 30840007 bytes
->Temporary Internet Files folder emptied: 1114514 bytes
->Java cache emptied: 51642379 bytes
->FireFox cache emptied: 51488406 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2351795 bytes
%systemroot%\System32 .tmp files removed: 3072 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 735038 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 9607288 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 715999 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 147,00 mb


OTM by OldTimer - Version 3.1.8.0 log created on 02132010_191946

Files moved on Reboot...
File C:\Documents and Settings\Utilisateur\Local Settings\Temp\[Torrentsworld.net] - Eleventh Hour S01E01 VOSTFR HDTV XviD-ReFLeX[www maroctorrent net].torrent not found!
C:\WINDOWS\temp\ZLT017ee.TMP moved successfully.
C:\WINDOWS\temp\ZLT017f1.TMP moved successfully.

Registry entries deleted on Reboot...

Je viens de faire plusieurs essais... J'ai cru que ça marchait, mais ça recommence...
Je me retrouve sur ce genre d'adresse: http://88.214.193.251/click/woland1970
Je n'y comprends rien!!!

Juste quelques précisions, j'ai désactivé l'antivirus mais je n'ai pas pu arrêter Antivir Desktop (je ne trouvais pas comment faire), et à un moment, Combofix a voulu se connecter à Internet, pour la console de récupération (est-ce qu'il faut que je l'installe d'ailleurs?) mais je n'ai pas réussi à rétablir la connection à ce moment-là...

J'ai aussi fait quelques tests avant de revenir ici, on dirait que cette fois ça marche!!!

Je te remercie BEAUCOUP pour ton aide, et voilà le rapport:
(est-ce qu'il y a un moyen de se protéger pour éviter une nouvelle infection? J'ai déjà Avira, Zone Alarm, résident Spy Bot et Ad-Aware d'activés...)

ComboFix 10-02-12.01 - Utilisateur 13/02/2010 19:56:57.1.2 - x86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.3037.2337 [GMT 1:00]
Lancé depuis: e:\programmes\Nettoyage\ComboFix.exe
AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
FW: ZoneAlarm Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users.\documents\settings
c:\documents and settings\Utilisateur\Application Data\Mozilla\Firefox\Profiles\7l8gn7nb.default\extensions\{d8579e04-ddc2-4bc7-8f59-763f624fe04f}
c:\documents and settings\Utilisateur\Application Data\Mozilla\Firefox\Profiles\7l8gn7nb.default\extensions\{d8579e04-ddc2-4bc7-8f59-763f624fe04f}\chrome.manifest
c:\documents and settings\Utilisateur\Application Data\Mozilla\Firefox\Profiles\7l8gn7nb.default\extensions\{d8579e04-ddc2-4bc7-8f59-763f624fe04f}\chrome\xulcache.jar
c:\documents and settings\Utilisateur\Application Data\Mozilla\Firefox\Profiles\7l8gn7nb.default\extensions\{d8579e04-ddc2-4bc7-8f59-763f624fe04f}\defaults\preferences\xulcache.js
c:\documents and settings\Utilisateur\Application Data\Mozilla\Firefox\Profiles\7l8gn7nb.default\extensions\{d8579e04-ddc2-4bc7-8f59-763f624fe04f}\install.rdf
c:\windows\system32\drivers\tqdkdplm.sys
c:\windows\system32\tmp.reg

.
((((((((((((((((((((((((((((( Fichiers créés du 2010-01-13 au 2010-02-13 ))))))))))))))))))))))))))))))))))))
.

2010-02-13 16:13 . 2010-02-13 16:13 432318 ----a-w- C:\UsbFix_Upload_Me_ASUS-V4.zip
2010-02-13 16:05 . 2010-02-13 16:13 -------- d-----w- C:\UsbFix
2010-02-13 10:14 . 2010-02-13 10:14 -------- d-----w- C:\rsit
2010-02-12 23:15 . 2010-02-12 23:22 -------- d-----w- C:\Ad-Remover
2010-02-09 10:20 . 2010-02-09 10:20 604488 ----a-w- c:\windows\system32\TUProgSt.exe
2010-02-09 10:20 . 2009-07-15 09:48 29000 ----a-w- c:\windows\system32\uxtuneup.dll
2010-02-09 10:20 . 2010-02-09 10:20 361288 ----a-w- c:\windows\system32\TuneUpDefragService.exe
2010-02-03 07:44 . 2010-02-07 15:42 -------- d-----w- c:\documents and settings\Utilisateur\Local Settings\Application Data\containerex.info
2010-01-23 18:10 . 2010-01-23 18:10 -------- d-----w- c:\documents and settings\Utilisateur\Local Settings\Application Data\WMTools Downloaded Files

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-13 19:01 . 2009-01-17 18:20 311543840 --sha-w- c:\windows\system32\drivers\fidbox.dat
2010-02-13 18:53 . 2009-12-27 11:21 -------- d-----w- c:\documents and settings\Utilisateur\Application Data\Vidalia
2010-02-13 18:24 . 2009-01-17 15:34 -------- d-----w- c:\program files\Mozilla Thunderbird
2010-02-13 18:20 . 2009-01-17 18:20 3655148 --sha-w- c:\windows\system32\drivers\fidbox.idx
2010-02-13 16:43 . 2009-01-22 21:02 1 ----a-w- c:\documents and settings\Utilisateur\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-02-13 09:09 . 2009-05-05 06:41 9142707 ----a-w- c:\windows\Internet Logs\tvDebug.zip
2010-02-12 22:28 . 2009-12-23 18:09 5115824 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-02-09 10:54 . 2009-01-17 15:15 -------- d-----w- c:\program files\Protection
2010-02-09 10:20 . 2009-11-01 12:44 -------- d-----w- c:\program files\TuneUp Utilities 2009
2010-02-09 10:10 . 2008-04-14 12:00 96512 ----a-w- c:\windows\system32\drivers\atapi.sys
2010-02-09 10:07 . 2009-12-27 12:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Hitman Pro
2010-02-09 10:03 . 2009-12-27 12:42 15944 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys
2010-02-07 15:08 . 2009-01-20 16:35 13500 ----a-w- c:\documents and settings\Utilisateur\Application Data\wklnhst.dat
2010-02-05 23:49 . 2010-02-06 09:00 187392 ----a-w- c:\windows\Internet Logs\xDB4F.tmp
2010-02-04 19:09 . 2009-12-27 13:09 389784 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\UpdateManager.dll
2010-02-04 19:09 . 2009-12-27 13:09 3803208 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AutoLaunch.exe
2010-02-04 19:09 . 2009-12-27 13:08 823928 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareAdmin.exe
2010-02-04 19:09 . 2009-12-27 13:08 1181328 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWService.exe
2010-02-01 19:09 . 2009-01-18 17:48 -------- d-----w- c:\program files\Video
2010-02-01 08:49 . 2010-02-01 17:36 631808 ----a-w- c:\windows\Internet Logs\xDB4E.tmp
2010-01-24 10:12 . 2009-01-17 09:57 -------- d-----w- c:\program files\Microsoft Silverlight
2010-01-23 18:08 . 2009-03-10 20:03 -------- d-----w- c:\program files\Avidemux 2.4
2010-01-17 13:08 . 2009-01-17 18:13 4212 ---h--w- c:\windows\system32\zllictbl.dat
2010-01-17 01:17 . 2010-01-17 13:07 148992 ----a-w- c:\windows\Internet Logs\xDB4C.tmp
2010-01-17 01:17 . 2010-01-17 13:07 1465344 ----a-w- c:\windows\Internet Logs\xDB4D.tmp
2010-01-14 22:58 . 2010-01-15 07:37 92160 ----a-w- c:\windows\Internet Logs\xDB4B.tmp
2010-01-13 22:51 . 2010-01-14 07:34 95744 ----a-w- c:\windows\Internet Logs\xDB49.tmp
2010-01-13 22:51 . 2010-01-14 07:34 1458176 ----a-w- c:\windows\Internet Logs\xDB4A.tmp
2010-01-12 22:52 . 2010-01-13 06:34 1458176 ----a-w- c:\windows\Internet Logs\xDB48.tmp
2010-01-12 22:52 . 2010-01-13 06:34 62976 ----a-w- c:\windows\Internet Logs\xDB47.tmp
2010-01-12 12:38 . 2010-01-12 17:10 58880 ----a-w- c:\windows\Internet Logs\xDB45.tmp
2010-01-12 12:38 . 2010-01-12 17:10 1455104 ----a-w- c:\windows\Internet Logs\xDB46.tmp
2010-01-11 23:42 . 2010-01-12 09:12 249344 ----a-w- c:\windows\Internet Logs\xDB44.tmp
2010-01-07 23:12 . 2010-01-08 08:10 239616 ----a-w- c:\windows\Internet Logs\xDB43.tmp
2010-01-07 15:07 . 2009-06-20 17:19 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 15:07 . 2009-06-20 17:19 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-06 11:08 . 2010-01-08 08:15 4726272 ----a-w- c:\documents and settings\Utilisateur\Application Data\Mozilla\Firefox\Profiles\7l8gn7nb.default\extensions\piclens@cooliris.com\libs\cooliris190.dll
2010-01-06 11:08 . 2010-01-08 08:15 103424 ----a-w- c:\documents and settings\Utilisateur\Application Data\Mozilla\Firefox\Profiles\7l8gn7nb.default\extensions\piclens@cooliris.com\libs\pixomatic.dll
2010-01-06 11:08 . 2010-01-08 08:15 545280 ----a-w- c:\documents and settings\Utilisateur\Application Data\Mozilla\Firefox\Profiles\7l8gn7nb.default\extensions\piclens@cooliris.com\libs\PicLensHelper.exe
2010-01-06 11:08 . 2010-01-08 08:15 4725760 ----a-w- c:\documents and settings\Utilisateur\Application Data\Mozilla\Firefox\Profiles\7l8gn7nb.default\extensions\piclens@cooliris.com\libs\cooliris192.dll
2010-01-06 11:08 . 2010-01-08 08:15 57856 ----a-w- c:\documents and settings\Utilisateur\Application Data\Mozilla\Firefox\Profiles\7l8gn7nb.default\extensions\piclens@cooliris.com\components\coolirisstub.dll
2010-01-06 11:08 . 2010-01-08 08:15 153600 ----a-w- c:\documents and settings\Utilisateur\Application Data\Mozilla\Firefox\Profiles\7l8gn7nb.default\extensions\piclens@cooliris.com\plugins\npcoolirisplugin.dll
2010-01-06 11:08 . 2010-01-08 08:15 344064 ----a-w- c:\documents and settings\Utilisateur\Application Data\Mozilla\Firefox\Profiles\7l8gn7nb.default\extensions\piclens@cooliris.com\libs\LaunchCooliris.exe
2010-01-05 09:56 . 2008-04-14 12:00 832512 ----a-w- c:\windows\system32\wininet.dll
2010-01-05 09:56 . 2008-04-14 12:00 78336 ----a-w- c:\windows\system32\ieencode.dll
2010-01-05 09:56 . 2008-04-14 12:00 17408 ----a-w- c:\windows\system32\corpol.dll
2010-01-04 23:24 . 2010-01-05 08:36 166400 ----a-w- c:\windows\Internet Logs\xDB42.tmp
2010-01-03 00:38 . 2010-01-03 09:18 189440 ----a-w- c:\windows\Internet Logs\xDB40.tmp
2010-01-03 00:38 . 2010-01-03 09:18 1429504 ----a-w- c:\windows\Internet Logs\xDB41.tmp
2009-12-31 16:50 . 2008-04-14 12:00 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-31 00:16 . 2009-12-31 00:17 94208 ----a-w- c:\windows\Internet Logs\xDB3F.tmp
2009-12-30 01:12 . 2009-12-30 12:12 161792 ----a-w- c:\windows\Internet Logs\xDB3D.tmp
2009-12-30 01:12 . 2009-12-30 12:12 1417216 ----a-w- c:\windows\Internet Logs\xDB3E.tmp
2009-12-28 19:10 . 2009-12-28 19:10 -------- d-----w- c:\documents and settings\Utilisateur\Application Data\Actecom
2009-12-28 19:10 . 2009-12-28 19:10 -------- d-----w- c:\documents and settings\All Users\Application Data\Video
2009-12-28 11:32 . 2009-01-16 18:09 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-12-27 15:18 . 2009-12-27 15:19 319488 ----a-w- c:\windows\Internet Logs\xDB3C.tmp
2009-12-27 13:09 . 2009-12-27 13:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2009-12-27 13:07 . 2009-12-27 13:07 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}
2009-12-27 13:07 . 2009-12-27 13:07 -------- d-----w- c:\program files\Lavasoft
2009-12-27 11:22 . 2009-04-08 19:36 -------- d-----w- c:\documents and settings\Utilisateur\Application Data\tor
2009-12-27 11:22 . 2009-12-25 17:52 -------- d-----w- c:\documents and settings\Utilisateur\Application Data\HouseCall 6.6
2009-12-27 11:22 . 2009-12-27 11:22 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2009-12-27 11:22 . 2009-02-17 13:27 -------- d-----w- c:\program files\SystemRequirementsLab
2009-12-27 11:22 . 2009-02-17 13:27 -------- d-----w- c:\documents and settings\Utilisateur\Application Data\SystemRequirementsLab
2009-12-27 11:14 . 2009-12-27 11:14 -------- d-----w- c:\documents and settings\Utilisateur\Application Data\Vidalia(2)
2009-12-26 12:19 . 2009-12-26 12:20 1398272 ----a-w- c:\windows\Internet Logs\xDB3A.tmp
2009-12-26 12:19 . 2009-12-26 12:20 136704 ----a-w- c:\windows\Internet Logs\xDB39.tmp
2009-12-26 12:17 . 2009-01-16 18:02 -------- d-----w- c:\program files\Intel
2009-12-25 20:24 . 2009-12-25 20:24 89863 ----a-w- c:\windows\Internet Logs\vsmon_2nd_2009_12_25_21_08_13_small.dmp.zip
2009-12-25 20:17 . 2009-12-24 10:49 -------- d-----w- c:\program files\Ad-Remover
2009-12-25 20:17 . 2009-12-23 18:12 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-12-25 20:16 . 2009-12-25 20:18 1359872 ----a-w- c:\windows\Internet Logs\xDB38.tmp
2009-12-25 20:08 . 2009-12-25 20:10 76800 ----a-w- c:\windows\Internet Logs\xDB37.tmp
2009-12-25 17:34 . 2009-12-25 17:35 171520 ----a-w- c:\windows\Internet Logs\xDB35.tmp
2009-12-25 17:34 . 2009-12-25 17:35 1350144 ----a-w- c:\windows\Internet Logs\xDB36.tmp
2009-12-25 17:30 . 2009-12-27 11:24 1340928 ----a-w- c:\windows\Internet Logs\xDB3B.tmp
2009-12-24 09:35 . 2008-04-14 12:00 84526 ----a-w- c:\windows\system32\perfc00C.dat
2009-12-24 09:35 . 2008-04-14 12:00 510324 ----a-w- c:\windows\system32\perfh00C.dat
2009-12-24 01:36 . 2009-12-23 23:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Norton
2009-12-24 01:36 . 2009-12-23 23:38 -------- d-----w- c:\documents and settings\All Users\Application Data\NortonInstaller
2009-12-24 00:24 . 2009-12-24 00:30 1216000 ----a-w- c:\windows\Internet Logs\xDB33.tmp
2009-12-24 00:02 . 2009-12-24 00:24 1249792 ----a-w- c:\windows\Internet Logs\xDB32.tmp
2009-12-24 00:02 . 2009-12-24 02:18 12800 ----a-w- c:\windows\Internet Logs\xDB34.tmp
2009-12-24 00:02 . 2009-12-24 00:24 12800 ----a-w- c:\windows\Internet Logs\xDB31.tmp
2009-12-23 23:58 . 2009-12-24 00:02 1250816 ----a-w- c:\windows\Internet Logs\xDB30.tmp
2009-12-23 23:58 . 2009-12-24 00:02 12800 ----a-w- c:\windows\Internet Logs\xDB2F.tmp
2009-12-23 23:56 . 2009-12-23 23:58 1249792 ----a-w- c:\windows\Internet Logs\xDB2E.tmp
2009-12-23 23:56 . 2009-12-23 23:58 12800 ----a-w- c:\windows\Internet Logs\xDB2D.tmp
2009-12-23 23:54 . 2009-12-23 23:56 1175040 ----a-w- c:\windows\Internet Logs\xDB2C.tmp
2009-12-23 23:54 . 2009-12-23 23:56 9216 ----a-w- c:\windows\Internet Logs\xDB2B.tmp
2009-12-23 23:53 . 2009-12-23 23:54 1193472 ----a-w- c:\windows\Internet Logs\xDB2A.tmp
2009-12-23 23:53 . 2009-12-23 23:54 9216 ----a-w- c:\windows\Internet Logs\xDB29.tmp
2009-12-23 23:45 . 2009-12-23 23:53 1189888 ----a-w- c:\windows\Internet Logs\xDB28.tmp
2009-12-23 23:45 . 2009-12-23 23:53 9216 ----a-w- c:\windows\Internet Logs\xDB27.tmp
2009-12-23 23:43 . 2009-12-23 23:45 2585600 ----a-w- c:\windows\Internet Logs\xDB25.tmp
2009-12-23 23:43 . 2009-12-23 23:45 12800 ----a-w- c:\windows\Internet Logs\xDB24.tmp
2009-12-23 23:42 . 2009-12-23 23:45 2585600 ----a-w- c:\windows\Internet Logs\xDB26.tmp
2009-12-23 23:42 . 2009-12-23 23:43 129024 ----a-w- c:\windows\Internet Logs\xDB23.tmp
2009-12-23 23:40 . 2009-12-23 23:42 2587136 ----a-w- c:\windows\Internet Logs\xDB22.tmp
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Vidalia"="c:\program files\Navigation\Vidalia Bundle\Vidalia\vidalia.exe" [2009-01-21 4033618]
"Rainlendar2"="c:\program files\Rainlendar2\Rainlendar2.exe" [2009-02-21 4333568]
"SpybotSD TeaTimer"="c:\program files\Protection\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2008-05-16 16862720]
"Six Engine"="c:\program files\ASUS\EPU-4 Engine\FourEngine.exe" [2008-06-25 5625344]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2007-03-14 71216]
"LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2007-01-08 52256]
"NeroFilterCheck"="c:\program files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
"ZoneAlarm Client"="c:\program files\Protection\ZoneAlarm\zlclient.exe" [2008-07-09 919016]
"EPSON Stylus Photo RX620 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATI9HE.EXE" [2004-05-20 98304]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-01-21 134656]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-01-21 166912]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-01-21 134656]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"ArcSoft Connection Service"="c:\program files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2009-10-10 203264]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Privoxy.lnk - c:\program files\Navigation\Vidalia Bundle\Privoxy\privoxy.exe [2006-11-20 250368]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"HonorAutoRunSetting"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"HonorAutoRunSetting"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Octoshape Streaming Services]
2009-01-08 13:44 70936 ----a-w- c:\documents and settings\Utilisateur\Application Data\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" /background
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
"iTunesHelper"="c:\program files\Musique\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [27/12/2009 14:10 64288]
R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [20/06/2009 22:43 108289]
R2 X4HSX32Ex;X4HSX32Ex;c:\program files\Player Metaboli\X4HSX32Ex.sys [17/02/2009 09:49 29856]
R3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI Service;c:\windows\system32\drivers\IntcHdmi.sys [16/01/2009 19:11 109568]
S2 ebjsdkgs;AGP Bus wf762 Monitor;c:\windows\System32\svchost.exe -k netsvcs [14/04/2008 13:00 14336]
S2 freenet;Freenet background service;"c:\program files\Navigation\Freenet\bin\wrapper-windows-x86-32.exe" -s "c:\program files\Navigation\Freenet\wrapper.conf" --> c:\program files\Navigation\Freenet\bin\wrapper-windows-x86-32.exe [?]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [24/09/2009 12:17 1181328]
S3 hitmanpro2;Hitman Pro 2 Driver;c:\program files\Protection\Hitman Pro\hitmanpro2.sys [24/01/2007 15:04 10336]
S3 MRVW225;802.11g/b Wireless LAN Dirver for Windows XP;c:\windows\system32\drivers\MRVW225.sys [17/01/2009 16:05 299904]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
ebjsdkgs
UxTuneUp
.
Contenu du dossier 'Tâches planifiées'

2010-02-13 c:\windows\Tasks\Ad-Aware Update (Daily 1).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 19:09]

2010-02-13 c:\windows\Tasks\Ad-Aware Update (Daily 2).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 19:09]

2010-02-13 c:\windows\Tasks\Ad-Aware Update (Daily 3).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 19:09]

2010-02-13 c:\windows\Tasks\Ad-Aware Update (Daily 4).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 19:09]

2010-02-13 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 19:09]

2010-02-03 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]

2010-02-13 c:\windows\Tasks\Maintenance en 1 clic.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2009-07-16 09:00]
.
.
------- Examen supplémentaire -------
.
uInternet Settings,ProxyOverride = local
FF - ProfilePath - c:\documents and settings\Utilisateur\Application Data\Mozilla\Firefox\Profiles\7l8gn7nb.default\
FF - prefs.js: browser.startup.homepage - www.google.fr
FF - component: c:\documents and settings\Utilisateur\Application Data\Mozilla\Firefox\Profiles\7l8gn7nb.default\extensions\piclens@cooliris.com\components\coolirisstub.dll
FF - plugin: c:\documents and settings\Utilisateur\Application Data\Mozilla\Firefox\Profiles\7l8gn7nb.default\extensions\piclens@cooliris.com\plugins\npcoolirisplugin.dll
FF - plugin: c:\program files\Musique\iTunes\Mozilla Plugins\npitunes.dll
FF - plugin: c:\program files\Navigation\Opera\program\plugins\npdsplay.dll
FF - plugin: c:\program files\Navigation\Opera\program\plugins\npqtplugin.dll
FF - plugin: c:\program files\Navigation\Opera\program\plugins\npqtplugin2.dll
FF - plugin: c:\program files\Navigation\Opera\program\plugins\npqtplugin3.dll
FF - plugin: c:\program files\Navigation\Opera\program\plugins\npqtplugin4.dll
FF - plugin: c:\program files\Navigation\Opera\program\plugins\npqtplugin5.dll
FF - plugin: c:\program files\Navigation\Opera\program\plugins\npqtplugin6.dll
FF - plugin: c:\program files\Navigation\Opera\program\plugins\npqtplugin7.dll
FF - plugin: c:\program files\Navigation\Opera\program\plugins\NPSWF32.dll
FF - plugin: c:\program files\Navigation\Opera\program\plugins\npwmsdrm.dll
FF - plugin: c:\program files\Video\DivX\DivX Player\npDivxPlayerPlugin.dll
FF - plugin: c:\program files\Video\DivXP\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Video\VideoLAN\VLC\npvlc.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "https://www.mozilla.org/en-US/firefox/new/?redirect_source=firefox-com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - ORPHELINS SUPPRIMES - - - -

BHO-{F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-13 20:01
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
Heure de fin: 2010-02-13 20:02:48
ComboFix-quarantined-files.txt 2010-02-13 19:02

Avant-CF: 36 095 746 048 octets libres
Après-CF: 36 059 381 760 octets libres

Current=2 Default=2 Failed=1 LastKnownGood=4 Sets=1,2,3,4
- - End Of File - - BF87721D9D7299BF7B006BB6D088C0F7

Ah, petit souci, ToolsCleaner se bloque systématiquement... Et comme je n'ai pas de message d'erreur, je ne sais pas d'où ça peut venir...