Analyse HijackFermé

Question

Bonjour, mon ordi est lent depuis plusieurs jours, pourriez vous jetter un oeil

merci ;-)


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:55:53, on 4/04/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17023)
Boot mode: Normal

Running processes:
C:\WINDOWS.0\System32\smss.exe
C:\WINDOWS.0\SYSTEM32\winlogon.exe
C:\WINDOWS.0\system32\services.exe
C:\WINDOWS.0\system32\lsass.exe
C:\WINDOWS.0\system32\svchost.exe
C:\WINDOWS.0\System32\svchost.exe
C:\WINDOWS.0\System32\svchost.exe
C:\WINDOWS.0\System32\WLTRYSVC.EXE
C:\WINDOWS.0\System32\bcmwltry.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS.0\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\ExtraFilm Designer BE FR\EFUploadSrv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS.0\system32
vsvc32.exe
C:\WINDOWS.0\system32\svchost.exe
C:\WINDOWS.0\system32	lntsvr.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS.0\system32\wbem\wmiapsrv.exe
C:\WINDOWS.0\Explorer.EXE
C:\Program Files\Razerazerhid.exe
C:\WINDOWS.0\system32\RUNDLL32.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Razerazerofa.exe
C:\Program Files\Belgacom\bin\sprtcmd.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS.0\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Michaël\Bureau\Sécurité\EliBaglA.exe
C:\Program Files\Java\jre6\bin\jucheck.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Documents and Settings\Michaël\Bureau\Sécurité\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.be/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local;*.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: BrowserHelper Class - {8A9D74F9-560B-4FE7-ABEB-3B2E638E5CD6} - C:\Program Files\SGPSA\SearchAssistant.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll
O2 - BHO: (no name) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - (no file)
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [razer] C:\Program Files\Razerazerhid.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS.0\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS.0\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Belgacom] "C:\Program Files\Belgacom\bin\sprtcmd.exe" /P Belgacom
O4 - HKLM\..\Run: [Acc2010] C:\Acc\Acc.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS.0\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [idfzeeau] "c:\documents and settings\michaël\local settings\application data\idfzeeau.exe" idfzeeau
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS.0\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS.0\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-21-1708537768-261903793-839522115-1006\..\Run: [CTFMON.EXE] C:\WINDOWS.0\system32\ctfmon.exe (User 'Caro')
O4 - HKUS\S-1-5-21-1708537768-261903793-839522115-1006\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" (User 'Caro')
O4 - HKUS\S-1-5-21-1708537768-261903793-839522115-1006\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'Caro')
O4 - HKUS\S-1-5-21-1708537768-261903793-839522115-1006\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" (User 'Caro')
O4 - HKUS\S-1-5-21-1708537768-261903793-839522115-500\..\Run: [CTFMON.EXE] C:\WINDOWS.0\system32\ctfmon.exe (User 'Administrateur')
O4 - HKUS\S-1-5-21-1708537768-261903793-839522115-500\..\RunOnce: [NeroHomeFirstStart] "C:\Program Files\Fichiers communs\Ahead\Lib\NMFirstStart.exe" (User 'Administrateur')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS.0\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS.0\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Outil de détection de support Picture Motion Browser.lnk = C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users.WINDOWS.0\Application Data\Winamp Toolbar\ieToolbaresources\en-US\local\search.html
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
O9 - Extra button: Rip YouTube File - {38E51477-DDB4-4aed-9D61-D0C193E10749} - C:\Program Files\AllMusicConverter\YouTubeRipper.dll
O9 - Extra 'Tools' menuitem: Rip YouTube file embedded in this page - {38E51477-DDB4-4aed-9D61-D0C193E10749} - C:\Program Files\AllMusicConverter\YouTubeRipper.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS.0\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS.0\bdoscandel.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS.0\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS.0\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=about:blank
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://colruyt.fujiprint.be/Colruyt/UserControls/Part/Upload/ImageUploader4.cab
O16 - DPF: {6E704581-CCAE-46D2-9C64-20D724B3624E} (UnagiAx Class) - http://radaol-prod-web-rr.streamops.aol.com/mediaplugin/3.0.84.2/win32/unagi3.0.84.2.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: ExtraFilm upload service (EFUploadSrv) - Textalk AB - C:\Program Files\ExtraFilm Designer BE FR\EFUploadSrv.exe
O23 - Service: Service Google Update (gupdate1ca83bc752cc3c) (gupdate1ca83bc752cc3c) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS.0\system32
vsvc32.exe
O23 - Service: SiSoftware Deployment Agent Service (SandraAgentSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2009.SP2\RpcAgentSrv.exe
O23 - Service: SoundMovieServer - SoundMovieServer - C:\WINDOWS.0\system32\snmvtsvc.exe
O23 - Service: U.S. Robotics Wireless LAN Service (wltrysvc) - Unknown owner - C:\WINDOWS.0\System32\WLTRYSVC.EXE

Destrio5 · Answer

Bonjour,


1/

--> Démarre Spybot, clique sur Mode, coche Mode avancé.
--> A gauche, clique sur Outils, puis sur Résident.
--> Décoche la case devant Résident "TeaTimer" :
http://sd-1.archive-host.com/membres/up/3288717712384394/TeaTimer.jpg
--> Quitte Spybot.


2/

&#9679; Télécharge Ad-Remover (de C_XX) sur ton Bureau.
&#9679; Déconnecte-toi d'Internet et ferme toutes applications en cours. 
&#9679; Double-clique sur le programme AD-R situé sur ton Bureau.
&#9679; Clique sur Nettoyer puis valide.
&#9679; Poste le rapport généré (C:\Ad-Report-CLEAN.log).

(CTRL+A pour tout sélectionner, CTRL+C pour copier et CTRL+V pour coller)

Zmmike · Answer

Merci voici le rapport
.
======= RAPPORT D'AD-REMOVER 2.0.0.0,B | UNIQUEMENT XP/VISTA/7 =======
.
Mis à jour par C_XX le 31/03/10 à 21:30
Contact: AdRemover.contact@gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Lancé à: 13:30:36 le 04/04/2010 | Mode normal | Option: CLEAN
Exécuté de: C:\Ad-Remover\ADR.exe
SE: Microsoft® Windows XP(TM)  Service Pack 3 - X86
Nom du PC: MIKE | Utilisateur actuel: Michaël (Administrateur)
.
============== ÉLÉMENT(S) NEUTRALISÉ(S) ==============
.
.
C:\Documents and Settings\All Users.WINDOWS.0\Menu Démarrer\Programmes\PokerStars
C:\Documents and Settings\Caro\Local Settings\Application Data\AskToolbar
C:\Documents and Settings\Michaël\Local Settings\Application Data\AskToolbar
C:\Documents and Settings\Michaël\Local Settings\Application Data\idfzeeau.dat
C:\Documents and Settings\Michaël\Local Settings\Application Data\idfzeeau_nav.dat
C:\Documents and Settings\Michaël\Local Settings\Application Data\idfzeeau_navps.dat
C:\Program Files\Ask.com
C:\Program Files\PokerStars
C:\Program Files\SGPSA
C:\WINDOWS.0\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
C:\WINDOWS.0\Tasks\Scheduled Update for Ask Toolbar.job

(!) -- Fichiers temporaires supprimés.
.
HKCU\Software\AppDataLow\AskToolbarInfo
HKCU\Software\Ask.com
HKCU\Software\AskToolbar
HKCU\Software\fcn
HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{19F2B849-4ADE-4d4b-85F9-C31C643DBDE9}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8A9D74F9-560B-4FE7-ABEB-3B2E638E5CD6}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
HKCU\Software\PartyGaming
HKLM\Software\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
HKLM\Software\Classes\AppID\GenericAskToolbar.DLL
HKLM\Software\Classes\CLSID\{8A9D74F9-560B-4FE7-ABEB-3B2E638E5CD6}
HKLM\Software\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
HKLM\Software\Classes\ComObject.DeskbarEnabler
HKLM\Software\Classes\ComObject.DeskbarEnabler.1
HKLM\Software\Classes\GenericAskToolbar.ToolbarWnd
HKLM\Software\Classes\GenericAskToolbar.ToolbarWnd.1
HKLM\Software\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
HKLM\Software\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
HKLM\Software\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
HKLM\Software\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
HKLM\Software\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
HKLM\Software\Classes\TypeLib\{4509D3CC-B642-4745-B030-645B79522C6D}
HKLM\Software\Classes\TypeLib\{77AA25E8-6083-4949-A831-9CB11861DC10}
HKLM\Software\Classes\urlsearchhook.toolbarurlsearchhook
HKLM\Software\Classes\urlsearchhook.toolbarurlsearchhook.1
HKLM\Software\Microsoft\Internet Explorer\Extensions\{3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF}
HKLM\Software\Microsoft\Internet Explorer\Extensions\{B7FE5D70-9AA2-40F1-9C6B-12A255F085E1}
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2685B256-4BE4-4d12-80A5-213189433A8A}
HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8A9D74F9-560B-4FE7-ABEB-3B2E638E5CD6}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser|{1BB22D38-A411-4B13-A746-C2A4F4EC7344}
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser|{D4027C7F-154A-4066-A1AD-4243D8127440}
HKLM\Software\Microsoft\Internet Explorer\Toolbar|{D4027C7F-154A-4066-A1AD-4243D8127440}
HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\Ask.com\GenericAskToolbar.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\Ask.com\UpdateTask.exe
.
(Orpheline) BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} (CLSID manquant)
.
============== SCAN ADDITIONNEL ==============
.
.
* Internet Explorer Version 7.0.5730.13 *
.
[HKCU\Software\Microsoft\Internet Explorer\Main]
.
AutoHide: yes
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Do404Search: 0x01000000
Enable Browser Extensions: yes
Local Page: C:\WINDOWS.0\system32\blank.htm
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Show_ToolBar: yes
Start Page: hxxp://fr.msn.com/
Use Custom Search URL: 1
Use Search Asst: no
.
[HKLM\Software\Microsoft\Internet Explorer\Main]
.
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Delete_Temp_Files_On_Exit: yes
Local Page: %SystemRoot%\system32\blank.htm
Search bar: hxxp://search.msn.com/spbasic.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://fr.msn.com/
.
[HKLM\Software\Microsoft\Internet Explorer\ABOUTURLS]
.
Tabs: res://ieframe.dll/tabswelcome.htm
Blank: res://mshtml.dll/blank.htm
.
============== SUSPECT(S) ==============
.
C:\Documents and Settings\Michaël\Mes documents\My Games\Old Ms-Dos Games Pack\Supaplex\CRACK.NFO
.
========================================
.
C:\WINDOWS.0	emp: 3 Fichier(s), 2 Dossier(s)
Temporary Internet Files: 2 Fichier(s), 6 Dossier(s)
.
C:\Ad-Remover\Quarantine: 4 Fichier(s)
C:\Ad-Remover\Backup: 13 Fichier(s)
.
C:\Ad-Report-CLEAN[1].txt - 5837 Octet(s)
.
Fin à: 13:39:57, 04/04/2010
.
============== E.O.F - CLEAN[1] ==============

Destrio5 · Answer

--> Relance Ad-Remover et choisis Désinstaller.

--> Télécharge OTL (de OldTimer) sur ton Bureau.
--> Double-clique sur OTL pour le lancer.
(Sous Vista/Win7, il faut cliquer droit sur OTL et choisir Exécuter en tant qu'administrateur)
--> Une fenêtre apparaît. Dans la section Output en haut de cette fenêtre, coche Minimal Output.
--> Coche également les cases à côté de LOP Check et Purity Check.
--> Enfin, clique sur le bouton Run Scan. Le scan ne prendra pas beaucoup de temps.
--> Une fois l'analyse terminée, deux fenêtres vont s'ouvrir dans le Bloc-notes : OTL.txt et Extras.txt. Ils se trouvent au même endroit que OTL (donc par défaut sur le Bureau).

Pour me transmettre les rapports :
--> Clique sur ce lien : http://www.cijoint.fr/
--> Clique sur Parcourir... et cherche le fichier du rapport que tu souhaites me transmettre.
--> Clique sur Ouvrir.
--> Clique sur Cliquez ici pour déposer le fichier.
--> Un lien de cette forme, hxxp://www.cijoint.fr/cjlink.php?file=cj200905/cijSKAP5fU.txt, est ajouté dans la page.
--> Copie-colle ce lien dans ta réponse.

Zmmike · Answer

Voici
http://www.cijoint.fr/cjlink.php?file=cj201004/cijW3RS6R8.txt  et
http://www.cijoint.fr/cjlink.php?file=cj201004/cijGpqp9yl.txt

Destrio5 · Answer

--> Télécharge Lop S&D (par Eric_71 & Angeldark) sur ton Bureau.

--> Double-clique dessus pour lancer l'installation.

--> Puis double-clique sur Lop S&D présent sur ton Bureau.
(Sous Vista/Win7, il faut cliquer droit sur Lop S&D et choisir Exécuter en tant qu'administrateur)

--> Sélectionne la langue souhaitée, puis choisis l'option 1 (Recherche).

--> Patiente jusqu'à la fin du scan.

--> Poste le rapport généré (C:\lopR.txt).

Zmmike · Answer

--------------------\  Lop S&D 4.2.5-0   XP/Vista

   Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
   X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 CPU          6400  @ 2.13GHz )
   BIOS : Phoenix - AwardBIOS v6.00PG
   USER : Michaël ( Administrator )
   BOOT : Normal boot
   Antivirus : avast! antivirus 4.8.1368 [VPS 100403-1] 4.8.1368 (Activated)
   A:\ (USB)
   C:\ (Local Disk) - NTFS - Total:232 Go (Free:92 Go)
   D:\ (CD or DVD)
   E:\ (CD or DVD)

   "C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
   Option : [1] ( dim. 04/04/2010|15:24 )
 
   --------------------\  Listing des dossiers dans APPLIC~1

   [08/04/2007|21:13] C:\DOCUME~1\ADMINI~1\APPLIC~1\Identities
   [24/04/2008|18:02] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft
   [08/04/2007|23:46] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft Web Folders

   [03/03/2007|23:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft

   [14/03/2009|19:31] C:\DOCUME~1\ALLUSE~1.0\APPLIC~1\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
   [04/04/2010|12:00] C:\DOCUME~1\ALLUSE~1.0\APPLIC~1\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
   [15/11/2009|13:56] C:\DOCUME~1\ALLUSE~1.0\APPLIC~1\{755AC846-7372-4AC8-8550-C52491DAA8BD}
   [21/05/2009|11:55] C:\DOCUME~1\ALLUSE~1.0\APPLIC~1\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
   [23/06/2009|07:29] C:\DOCUME~1\ALLUSE~1.0\APPLIC~1\Adobe
   [09/09/2008|22:19] C:\DOCUME~1\ALLUSE~1.0\APPLIC~1\Adobe Systems
   [25/05/2009|20:50] C:\DOCUME~1\ALLUSE~1.0\APPLIC~1\Apowersoft
   [16/06/2009|18:52] C:\DOCUME~1\ALLUSE~1.0\APPLIC~1\Apple
   [22/12/2007|13:38] C:\DOCUME~1\ALLUSE~1.0\APPLIC~1\Apple Computer
   [24/04/2008|18:02] C:\DOCUME~1\ALLUSE~1.0\APPLIC~1\Avg7
   [05/02/2008|19:24] C:\DOCUME~1\ALLUSE~1.0\APPLIC~1\Avira
   [07/09/2007|14:36] C:\DOCUME~1\ALLUSE~1.0\APPLIC~1\BufferZone
   [20/05/2008|13:32] C:\DOCUME~1\ALLUSE~1.0\APPLIC~1\CanonBJ
   [03/03/2010|19:25] C:\DOCUME~1\ALLUSE~1.0\APPLIC~1\DAEMON Tools Lite
   [05/01/2010|23:13] C:\DOCUME~1\ALLUSE~1.0\APPLIC~1\ExtraFilm
   [12/02/2009|23:59] C:\DOCUME~1\ALLUSE~1.0\APPLIC~1\Google
   [26/06/2009|18:12] C:\DOCUME~1\ALLUSE~1.0\APPLIC~1\Google Updater
   [24/04/2008|18:01] C:\DOCUME~1\ALLUSE~1.0\APPLIC~1\Grisoft
   [20/05/2008|13:41] C:\DOCUME~1\ALLUSE~1.0\APPLIC~1\InstallShield
   [23/04/2008|18:25] C:\DOCUME~1\ALLUSE~1.0\APPLIC~1\Lavasoft
   [20/06/2009|10:22] C:\DOCUME~1\ALLUSE~1.0\APPLIC~1\Malwarebytes
   [05/03/2009|22:07] C:\DOCUME~1\ALLUSE~1.0\APPLIC~1\Microsoft
   [09/07/2007|22:31] C:\DOCUME~1\ALLUSE~1.0\APPLIC~1\Nero
   [08/04/2007|20:52] C:\DOCUME~1\ALLUSE~1.0\APPLIC~1\NVIDIA
   [08/04/2007|20:53] C:\DOCUME~1\ALLUSE~1.0\APPLIC~1
View_Profiles
   [23/12/2009|12:39] C:\DOCUME~1\ALLUSE~1.0\APPLIC~1\Real
   [07/03/2010|18:38] C:\DOCUME~1\ALLUSE~1.0\APPLIC~1\ReviverSoft
   [20/05/2008|13:41] C:\DOCUME~1\ALLUSE~1.0\APPLIC~1\ScanSoft
   [04/04/2010|13:28] C:\DOCUME~1\ALLUSE~1.0\APPLIC~1\Spybot - Search & Destroy
   [01/06/2007|14:13] C:\DOCUME~1\ALLUSE~1.0\APPLIC~1\Support.com
   [15/11/2009|17:29] C:\DOCUME~1\ALLUSE~1.0\APPLIC~1\SupportSoft
   [20/03/2010|01:52] C:\DOCUME~1\ALLUSE~1.0\APPLIC~1\TrackMania
   [16/06/2008|17:59] C:\DOCUME~1\ALLUSE~1.0\APPLIC~1\Winamp Toolbar
   [09/01/2008|00:23] C:\DOCUME~1\ALLUSE~1.0\APPLIC~1\Windows Genuine Advantage
   [06/06/2007|21:31] C:\DOCUME~1\ALLUSE~1.0\APPLIC~1\Windows Live Toolbar
   [24/11/2008|23:55] C:\DOCUME~1\ALLUSE~1.0\APPLIC~1\WLInstaller
   [22/04/2008|18:08] C:\DOCUME~1\ALLUSE~1.0\APPLIC~1\Yahoo! Companion

   [15/01/2009|20:42] C:\DOCUME~1\Caro\APPLIC~1\Adobe
   [10/07/2007|09:23] C:\DOCUME~1\Caro\APPLIC~1\Ahead
   [23/01/2010|16:27] C:\DOCUME~1\Caro\APPLIC~1\Apple Computer
   [20/09/2008|14:54] C:\DOCUME~1\Caro\APPLIC~1\Canon
   [05/01/2010|23:16] C:\DOCUME~1\Caro\APPLIC~1\ExtraFilm
   [31/05/2007|21:42] C:\DOCUME~1\Caro\APPLIC~1\Google
   [24/04/2007|20:45] C:\DOCUME~1\Caro\APPLIC~1\Help
   [08/04/2007|21:45] C:\DOCUME~1\Caro\APPLIC~1\Identities
   [29/07/2009|22:54] C:\DOCUME~1\Caro\APPLIC~1\InstallShield
   [25/07/2007|20:25] C:\DOCUME~1\Caro\APPLIC~1\LimeWire
   [04/11/2007|11:52] C:\DOCUME~1\Caro\APPLIC~1\Macromedia
   [31/10/2008|17:45] C:\DOCUME~1\Caro\APPLIC~1\Microsoft
   [06/02/2008|21:35] C:\DOCUME~1\Caro\APPLIC~1\Mozilla
   [05/06/2008|00:00] C:\DOCUME~1\Caro\APPLIC~1\ScanSoft
   [29/07/2009|23:10] C:\DOCUME~1\Caro\APPLIC~1\Sony Corporation
   [17/09/2007|23:05] C:\DOCUME~1\Caro\APPLIC~1\Sun
   [06/02/2008|21:36] C:\DOCUME~1\Caro\APPLIC~1\Talkback
   [07/06/2008|23:33] C:\DOCUME~1\Caro\APPLIC~1\U3
   [23/03/2010|22:41] C:\DOCUME~1\Caro\APPLIC~1\WinRAR

   [03/03/2007|23:40] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

   [08/04/2007|21:11] C:\DOCUME~1\DEFAUL~1.0\APPLIC~1\Microsoft

   [03/03/2007|23:40] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

   [23/04/2008|18:16] C:\DOCUME~1\LOCALS~1.AUT\APPLIC~1\AVG7
   [24/04/2008|18:02] C:\DOCUME~1\LOCALS~1.AUT\APPLIC~1\Microsoft


   [31/01/2009|10:59] C:\DOCUME~1\MICHAL~1\APPLIC~1\Adobe
   [08/11/2007|23:16] C:\DOCUME~1\MICHAL~1\APPLIC~1\AdobeUM
   [10/07/2007|09:25] C:\DOCUME~1\MICHAL~1\APPLIC~1\Ahead
   [15/11/2009|14:11] C:\DOCUME~1\MICHAL~1\APPLIC~1\Apple Computer
   [24/04/2008|17:58] C:\DOCUME~1\MICHAL~1\APPLIC~1\AVG7
   [10/03/2010|20:41] C:\DOCUME~1\MICHAL~1\APPLIC~1\BitTorrent
   [28/05/2008|17:53] C:\DOCUME~1\MICHAL~1\APPLIC~1\Canon
   [10/03/2009|21:41] C:\DOCUME~1\MICHAL~1\APPLIC~1\DAEMON Tools
   [03/03/2010|19:34] C:\DOCUME~1\MICHAL~1\APPLIC~1\DAEMON Tools Lite
   [10/03/2009|21:41] C:\DOCUME~1\MICHAL~1\APPLIC~1\DAEMON Tools Pro
   [16/03/2010|23:20] C:\DOCUME~1\MICHAL~1\APPLIC~1\dvdcss
   [05/01/2010|23:13] C:\DOCUME~1\MICHAL~1\APPLIC~1\ExtraFilm
   [06/03/2010|21:39] C:\DOCUME~1\MICHAL~1\APPLIC~1\Facebook
   [31/05/2007|20:50] C:\DOCUME~1\MICHAL~1\APPLIC~1\Google
   [05/05/2007|20:15] C:\DOCUME~1\MICHAL~1\APPLIC~1\Help
   [08/04/2007|18:41] C:\DOCUME~1\MICHAL~1\APPLIC~1\Identities
   [29/07/2009|22:55] C:\DOCUME~1\MICHAL~1\APPLIC~1\InstallShield
   [25/07/2007|20:18] C:\DOCUME~1\MICHAL~1\APPLIC~1\LimeWire
   [21/07/2008|18:52] C:\DOCUME~1\MICHAL~1\APPLIC~1\lovefourjunk
   [31/05/2007|20:29] C:\DOCUME~1\MICHAL~1\APPLIC~1\Macromedia
   [20/06/2009|10:22] C:\DOCUME~1\MICHAL~1\APPLIC~1\Malwarebytes
   [29/07/2009|22:57] C:\DOCUME~1\MICHAL~1\APPLIC~1\Microsoft
   [01/04/2009|22:00] C:\DOCUME~1\MICHAL~1\APPLIC~1\Mount&Blade
   [23/12/2009|12:52] C:\DOCUME~1\MICHAL~1\APPLIC~1\Real
   [24/05/2009|15:17] C:\DOCUME~1\MICHAL~1\APPLIC~1\Ripdev
   [20/05/2008|13:41] C:\DOCUME~1\MICHAL~1\APPLIC~1\ScanSoft
   [29/07/2009|23:06] C:\DOCUME~1\MICHAL~1\APPLIC~1\Sony Corporation
   [14/04/2007|17:59] C:\DOCUME~1\MICHAL~1\APPLIC~1\Sports Interactive
   [29/06/2007|12:55] C:\DOCUME~1\MICHAL~1\APPLIC~1\Sun
   [03/02/2008|19:01] C:\DOCUME~1\MICHAL~1\APPLIC~1\Talkback
   [08/06/2008|01:12] C:\DOCUME~1\MICHAL~1\APPLIC~1\U3
   [17/10/2008|16:52] C:\DOCUME~1\MICHAL~1\APPLIC~1\ValuSoft
   [19/03/2010|19:15] C:\DOCUME~1\MICHAL~1\APPLIC~1\vlc
   [14/03/2010|11:50] C:\DOCUME~1\MICHAL~1\APPLIC~1\WinRAR

   [03/03/2007|23:40] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

   [24/04/2008|18:02] C:\DOCUME~1\NETWOR~1.AUT\APPLIC~1\Microsoft

   [03/03/2007|23:46] C:\DOCUME~1\SHS\APPLIC~1\Identities
   [04/03/2007|00:07] C:\DOCUME~1\SHS\APPLIC~1\Microsoft
   [04/03/2007|00:58] C:\DOCUME~1\SHS\APPLIC~1\Mozilla
 
   --------------------\  Tâches planifiées dans C:\WINDOWS.0	asks

   [04/04/2010 13:45][--a------] C:\WINDOWS.0	asks\Registry Reviver-Micha0/00l-Startup.job
   [04/04/2010 14:59][--a------] C:\WINDOWS.0	asks\GoogleUpdateTaskMachineUA.job
   [04/04/2010 13:45][--a------] C:\WINDOWS.0	asks\GoogleUpdateTaskMachineCore.job
   [23/03/2010 21:49][--a------] C:\WINDOWS.0	asks\AppleSoftwareUpdate.job
   [04/04/2010 13:45][--ah-----] C:\WINDOWS.0	asks\SA.DAT
   [07/09/2002 02:00][-r-h-----] C:\WINDOWS.0	asks\desktop.ini

   --------------------\  Listing des dossiers dans C:\Program Files

   [10/07/2007|13:17] C:\Program Files\Acoustica MP3 Audio Mixer
   [25/12/2007|03:02] C:\Program Files\Activision Value
   [23/06/2009|07:28] C:\Program Files\Adobe
   [05/07/2009|15:22] C:\Program Files\Aimersoft
   [05/07/2009|14:58] C:\Program Files\AllMusicConverter
   [05/02/2008|19:51] C:\Program Files\Alwil Software
   [06/04/2007|21:16] C:\Program Files\Analog Devices
   [25/05/2009|20:50] C:\Program Files\Apowersoft
   [16/08/2008|22:03] C:\Program Files\Apple Software Update
   [15/11/2009|17:29] C:\Program Files\Belgacom
   [27/02/2010|20:08] C:\Program Files\BitTorrent
   [04/04/2010|11:43] C:\Program Files\Bonjour
   [13/03/2010|11:50] C:\Program Files\bwin
   [20/05/2008|13:48] C:\Program Files\Canon
   [20/05/2008|13:31] C:\Program Files\CanonBJ
   [07/03/2010|18:41] C:\Program Files\CCleaner
   [29/05/2007|22:31] C:\Program Files\Common Files
   [09/03/2008|13:15] C:\Program Files\CyberQix
   [03/03/2010|19:27] C:\Program Files\DAEMON Tools Lite
   [02/06/2007|11:40] C:\Program Files\DFX
   [15/03/2009|16:10] C:\Program Files\DOSBox-0.70
   [18/08/2007|12:55] C:\Program Files\Easy TM
   [06/03/2010|19:21] C:\Program Files\eMule
   [05/01/2010|23:13] C:\Program Files\ExtraFilm Designer BE FR
   [23/12/2009|12:52] C:\Program Files\Fichiers communs
   [01/05/2009|18:01] C:\Program Files\filehippo.com
   [19/10/2008|13:39] C:\Program Files\FindyKill
   [27/10/2008|20:00] C:\Program Files\Foxit Software
   [04/03/2007|01:00] C:\Program Files\Free Easy Burner
   [27/10/2008|20:06] C:\Program Files\Free PDF to Word Doc Converter
   [04/03/2007|00:11] C:\Program Files\Futuremark
   [26/04/2008|16:34] C:\Program Files\Games
   [23/12/2009|12:38] C:\Program Files\Google
   [15/11/2009|16:44] C:\Program Files\InstallShield Installation Information
   [03/03/2007|23:57] C:\Program Files\Intel
   [30/03/2010|23:42] C:\Program Files\Internet Explorer
   [25/05/2009|14:02] C:\Program Files\Iphone
   [04/04/2010|11:59] C:\Program Files\iPod
   [04/04/2010|12:00] C:\Program Files\iTunes
   [15/11/2009|16:57] C:\Program Files\Java
   [15/03/2010|20:58] C:\Program Files\JetFlash Recovery Tool
   [23/04/2008|18:24] C:\Program Files\Lavasoft
   [24/04/2008|19:32] C:\Program Files\Lopxp
   [13/04/2009|21:37] C:\Program Files\Lucasarts Collection
   [09/07/2007|17:26] C:\Program Files\LucasFan Games
   [04/04/2010|13:45] C:\Program Files\Malwarebytes' Anti-Malware
   [01/10/2008|19:19] C:\Program Files\Messenger
   [30/07/2007|19:03] C:\Program Files\Micro Application
   [20/05/2008|22:55] C:\Program Files\Microsoft CAPICOM 2.1.0.2
   [08/04/2007|23:46] C:\Program Files\microsoft frontpage
   [13/02/2009|13:46] C:\Program Files\Microsoft Games
   [08/04/2007|23:46] C:\Program Files\Microsoft Office
   [08/04/2007|23:48] C:\Program Files\Microsoft Visual Studio
   [12/03/2010|08:48] C:\Program Files\Movie Maker
   [21/06/2009|15:11] C:\Program Files\Mozilla Firefox
   [04/03/2007|00:55] C:\Program Files\MSBuild
   [03/03/2007|23:36] C:\Program Files\MSN
   [01/10/2008|19:27] C:\Program Files\msn gaming zone
   [03/10/2008|20:33] C:\Program Files\MSN Messenger
   [10/07/2007|15:54] C:\Program Files\MSXML 4.0
   [09/07/2007|22:31] C:\Program Files\Nero
   [01/10/2008|19:13] C:\Program Files\NetMeeting
   [04/03/2007|00:00] C:\Program Files\NVIDIA
   [03/03/2007|23:36] C:\Program Files\Online Services
   [12/08/2009|23:54] C:\Program Files\Outlook Express
   [21/03/2010|13:03] C:\Program Files\Paint.NET
   [20/03/2010|10:52] C:\Program Files\PokerOffice5
   [04/04/2010|11:53] C:\Program Files\QuickTime
   [14/02/2009|20:11] C:\Program Files\RamBoost XP
   [08/04/2007|21:23] C:\Program Files\Razer
   [23/12/2009|12:37] C:\Program Files\Real
   [04/03/2007|00:08] C:\Program Files\Realtek AC97
   [04/03/2007|00:51] C:\Program Files\Reference Assemblies
   [24/05/2009|15:13] C:\Program Files\Ripdev
   [04/04/2010|11:37] C:\Program Files\Safari
   [20/05/2008|13:41] C:\Program Files\ScanSoft
   [03/03/2007|23:39] C:\Program Files\Services en ligne
   [23/10/2007|19:03] C:\Program Files\Setup
   [10/02/2009|19:18] C:\Program Files\SiSoftware
   [29/06/2007|14:40] C:\Program Files\SoftwareDepo.com
   [29/07/2009|22:57] C:\Program Files\Sony
   [08/05/2008|17:40] C:\Program Files\Sports Interactive
   [25/12/2009|13:31] C:\Program Files\Spybot - Search & Destroy
   [05/07/2008|17:42] C:\Program Files\Sun
   [01/06/2007|14:13] C:\Program Files\Support.com
   [20/03/2010|00:51] C:\Program Files\TmUnitedForever
   [03/03/2007|23:46] C:\Program Files\Uninstall Information
   [04/03/2007|01:04] C:\Program Files\VideoLAN
   [03/02/2008|22:13] C:\Program Files\VS Revo Group
   [13/03/2010|11:38] C:\Program Files\WinamaxPoker
   [16/10/2008|21:22] C:\Program Files\Winamp
   [16/06/2008|17:59] C:\Program Files\Winamp Toolbar
   [24/11/2008|23:57] C:\Program Files\Windows Live
   [07/06/2007|22:44] C:\Program Files\Windows Live Toolbar
   [01/10/2008|19:16] C:\Program Files\Windows Media Player
   [01/10/2008|19:13] C:\Program Files\Windows NT
   [03/03/2007|23:39] C:\Program Files\WindowsUpdate
   [14/03/2010|11:50] C:\Program Files\WinRAR
   [01/10/2008|19:27] C:\Program Files\xerox
   [22/04/2008|18:02] C:\Program Files\Yahoo!
   [22/09/2008|20:25] C:\Program Files\Youdagames
   [17/09/2007|23:08] C:\Program Files\Zero G Registry

   --------------------\  Listing des dossiers dans C:\Program Files\Fichiers communs

   [23/06/2009|07:28] C:\Program Files\Fichiers communs\Adobe
   [09/09/2008|22:19] C:\Program Files\Fichiers communs\Adobe Systems Shared
   [09/07/2007|22:32] C:\Program Files\Fichiers communs\Ahead
   [04/04/2010|11:59] C:\Program Files\Fichiers communs\Apple
   [20/05/2008|13:37] C:\Program Files\Fichiers communs\CANON
   [08/04/2007|23:48] C:\Program Files\Fichiers communs\Designer
   [20/05/2008|13:41] C:\Program Files\Fichiers communs\InstallShield
   [29/06/2007|12:53] C:\Program Files\Fichiers communs\Java
   [07/03/2010|21:39] C:\Program Files\Fichiers communs\Microsoft Shared
   [03/03/2007|23:38] C:\Program Files\Fichiers communs\MSSoap
   [29/03/2008|01:45] C:\Program Files\Fichiers communs\NSV
   [04/03/2007|00:25] C:\Program Files\Fichiers communs\ODBC
   [23/12/2009|12:52] C:\Program Files\Fichiers communs\Real
   [20/05/2008|13:41] C:\Program Files\Fichiers communs\ScanSoft Shared
   [03/03/2007|23:38] C:\Program Files\Fichiers communs\Services
   [04/03/2007|00:25] C:\Program Files\Fichiers communs\SpeechEngines
   [15/11/2009|17:29] C:\Program Files\Fichiers communs\SupportSoft
   [01/10/2008|19:13] C:\Program Files\Fichiers communs\System
   [24/11/2008|23:57] C:\Program Files\Fichiers communs\WindowsLiveInstaller
   [02/08/2009|10:00] C:\Program Files\Fichiers communs\Wise Installation Wizard

   --------------------\  Process

   ( 56 Processes )

   ... OK !

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   C:\DOCUME~1\MICHAL~1\APPLIC~1\lovefourjunk
   C:\DOCUME~1\MICHAL~1\Cookies\michaël@ads1.adultadvertising[1].txt
   C:\DOCUME~1\MICHAL~1\Cookies\michaël@ads2.adultadvertising[1].txt
 
   --------------------\  Verification du Registre

   [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 

   [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
 
   ..... OK !

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2010-04-04 15:25:35
   Windows 5.1.2600 Service Pack 3 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 8
 
   --------------------\  Recherche d'autres infections

   --------------------\  ROOTKIT !!

   Rootkit Bagle ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\srosa]
   Rootkit Bagle ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\srosa]



   [F:3][D:2]-> C:\DOCUME~1\MICHAL~1\LOCALS~1\Temp
   [F:47][D:0]-> C:\DOCUME~1\MICHAL~1\Cookies
   [F:696][D:8]-> C:\DOCUME~1\MICHAL~1\LOCALS~1\TEMPOR~1\content.IE5

   1 - "C:\Lop SD\LopR_1.txt" - dim. 04/04/2010|15:27 - Option : [1]

   --------------------\  Fin du rapport a 15:27:01

Destrio5 · Answer

Pourquoi postes-tu les rapports là-haut ?

--> Double-clique sur Lop S&D pour le lancer.
(Sous Vista/Win7, il faut cliquer droit sur Lop S&D et choisir Exécuter en tant qu'administrateur) 

--> Choisis cette fois-ci l'option 2 (Suppression).

--> Ne ferme pas la fenêtre lors de la suppression !

--> Poste le rapport généré (C:\lopR.txt).

(Si le Bureau ne réapparaît pas, presse Ctrl+Alt+Suppr, Onglet Fichier, Nouvelle tâche, tape explorer.exe et valide)

Analyse Hijack

7 réponses

Discussions similaires

Newsletters