Trojan:Win32/Sefnit.G aide svp [Résolu]

Salut,

Envioie C:\windows\system32\config\systemprofile\Local Settings\Application Data\Windows Internet Name Service\wins.exe
sur http://upload.malekal.com

~~

Télécharge et installe Malwarebyte : http://www.malekal.com/tutorial_MalwareBytes_AntiMalware.php
Mets le à jour, fais un scan, supprime tout et poste le rapport ici.



puis :

Tu peux suivre les indications de cette page pour t'aider : http://www.malekal.com/2010/11/12/tutorial-otl/

* Télécharge http://oldtimer.geekstogo.com/OTL.exe sur ton bureau.
(Sous Vista/Win7, il faut cliquer droit sur OTL et choisir Exécuter en tant qu'administrateur)

* Lance OTL
* Sous Peronnalisation, copie-colle ce qu'il y a dans le cadre ci-dessous :
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE\%Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%temp%\.exe /s
%SYSTEMDRIVE%\*.exe
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
/md5start
explorer.exe
winlogon.exe
wininit.exe
/md5stop
CREATERESTOREPOINT
nslookup www.google.fr /c
* Clique sur le bouton Analyse.
* Quand le scan est fini, utilise le site http://www.cijoint.fr/ pour me donner les deux rapports : OTL.Txt et Extras.Txt.

Déjà un grand merci, dslé ça a pris un moment :

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Version de la base de données: 5630

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

28/01/2011 17:59:06
mbam-log-2011-01-28 (17-59-06).txt

Type d'examen: Examen complet (C:\|D:\|E:\|F:\|S:\|)
Elément(s) analysé(s): 197535
Temps écoulé: 1 heure(s), 38 minute(s), 3 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 18
Valeur(s) du Registre infectée(s): 9
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 51
Fichier(s) infecté(s): 136

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\CLSID\{50AD41D2-B1F0-47CC-9EA7-395355EAEEBD} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{8CEB185E-81A5-46D3-BC20-C555D605AFBD} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{A72522BA-9FF3-4C83-ABC6-9B476728A396} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{C5762628-AE15-4ca6-96C4-B00DD17F3419} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{D062E03E-65CA-49E4-9B15-31938BA98922} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Explorer\Bars\{B72681C0-A222-4b21-A0E2-53A5A5CA3D411} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\ExplorerBar.FunExplorer (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\ExplorerBar.FunExplorer.1 (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\ExplorerBar.FunRedirector (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\ExplorerBar.FunRedirector.1 (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\{D45817B8-3EAD-4d1d-8FCA-EC63A8E35DE2} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Internet System Controller (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Live Content Advancer (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Web Search Assistant (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Internet System Controller (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Live Content Advancer (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Web Search Assistant (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\AppDataLow\Software\Internet Content Updater (Adware.DoubleD) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{D45817B8-3EAD-4d1d-8FCA-EC63A8E35DE2} (Adware.DoubleD) -> Value: {D45817B8-3EAD-4d1d-8FCA-EC63A8E35DE2} -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{D45817B8-3EAD-4d1d-8FCA-EC63A8E35DE2} (Adware.DoubleD) -> Value: {D45817B8-3EAD-4d1d-8FCA-EC63A8E35DE2} -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\Extensions\{E63605FC-D583-4C81-867F-9457BDB3EA1B} (Adware.DoubleD) -> Value: {E63605FC-D583-4C81-867F-9457BDB3EA1B} -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\Extensions\{E63605FC-D583-4C81-867F-9457BDB3EA1B} (Adware.DoubleD) -> Value: {E63605FC-D583-4C81-867F-9457BDB3EA1B} -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\Extensions\{8141440E-08F0-4339-9959-5C31C6A69F23} (Adware.DoubleD) -> Value: {8141440E-08F0-4339-9959-5C31C6A69F23} -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\Extensions\{8141440E-08F0-4339-9959-5C31C6A69F23} (Adware.DoubleD) -> Value: {8141440E-08F0-4339-9959-5C31C6A69F23} -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\Extensions\{E889F097-B0BE-471B-89AD-B86B6F04B506} (Adware.DoubleD) -> Value: {E889F097-B0BE-471B-89AD-B86B6F04B506} -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\Extensions\{E889F097-B0BE-471B-89AD-B86B6F04B506} (Adware.DoubleD) -> Value: {E889F097-B0BE-471B-89AD-B86B6F04B506} -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions\{AA1ACB70-B5F1-4037-909E-1F725B04D2A8} (Adware.DoubleD) -> Value: {AA1ACB70-B5F1-4037-909E-1F725B04D2A8} -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
c:\program files\context management controller (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\context management controller\2.8.0.4360 (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\context management controller\2.8.0.4360\Chrome (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\context management controller\2.8.0.4360\Data (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\context management controller\2.8.0.4360\FF (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\context management controller\2.8.0.4360\FF\chrome (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\context management controller\2.8.0.4360\FF\chrome\content (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\context management controller\2.8.0.4360\FF\components (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\internet content updater (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\internet content updater\1.8.0.2650 (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\internet content updater\1.8.0.2650\data (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\internet system controller (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\internet system controller\5.8.0.3240 (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\internet system controller\5.8.0.3240\Chrome (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\internet system controller\5.8.0.3240\Data (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\internet system controller\5.8.0.3240\FF (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\internet system controller\5.8.0.3240\FF\chrome (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\internet system controller\5.8.0.3240\FF\chrome\content (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\internet system controller\5.8.0.3240\FF\components (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\live content advancer (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\live content advancer\5.8.0.7460 (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\live content advancer\5.8.0.7460\Chrome (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\live content advancer\5.8.0.7460\Data (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\live content advancer\5.8.0.7460\FF (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\live content advancer\5.8.0.7460\FF\chrome (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\live content advancer\5.8.0.7460\FF\chrome\content (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\live content advancer\5.8.0.7460\FF\components (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\web search assistant (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\web search assistant\5.8.0.3310 (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\web search assistant\5.8.0.3310\Chrome (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\web search assistant\5.8.0.3310\Chrome\Data (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\web search assistant\5.8.0.3310\Data (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\web search assistant\5.8.0.3310\FF (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\web search assistant\5.8.0.3310\FF\chrome (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\web search assistant\5.8.0.3310\FF\chrome\content (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\web search assistant\5.8.0.3310\FF\components (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\gamieplay toolbar (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\gamieplay toolbar\3.7.1.8090 (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\gamieplay toolbar\3.7.1.8090\bin (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\gamieplay toolbar\3.7.1.8090\Cache (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\gamieplay toolbar\3.7.1.8090\Data (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\gamieplay toolbar\3.7.1.8090\Icons (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\gamieplay toolbar\3.7.1.8090\Skins (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\internet connection wizard\1.8.0.2650 (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\internet content updater (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\internet system controller (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\internet system controller\5.8.0.3240 (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\live content advancer (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\live content advancer\5.8.0.7460 (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\web search assistant (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\web search assistant\5.8.0.3310 (Adware.DoubleD) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
c:\program files\context management controller\2.8.0.4360\cmcsh.dll (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\context management controller\2.8.0.4360\Chrome\cmcchromeaddon.dll (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\internet system controller\5.8.0.3240\isccommon.dll (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\web search assistant\5.8.0.3310\wsacommon.dll (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\web search assistant\5.8.0.3310\Chrome\wsacommon.dll (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\Favoris\myfastsearcher.url (Malware.Trace) -> Quarantined and deleted successfully.
c:\program files\context management controller\2.8.0.4360\config.mx (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\context management controller\2.8.0.4360\data.mx (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\context management controller\2.8.0.4360\exclude.mx (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\context management controller\2.8.0.4360\matchingdata.zd5 (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\context management controller\2.8.0.4360\pxtmpdata.mx (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\context management controller\2.8.0.4360\running.mx (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\context management controller\2.8.0.4360\unins000.dat (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\context management controller\2.8.0.4360\unins000.exe (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\context management controller\2.8.0.4360\Chrome\background.html (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\context management controller\2.8.0.4360\Chrome\contentscript.js (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\context management controller\2.8.0.4360\Chrome\manifest.json (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\context management controller\2.8.0.4360\FF\chrome.manifest (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\context management controller\2.8.0.4360\FF\install.rdf (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\context management controller\2.8.0.4360\FF\chrome\content\AddOn.js (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\context management controller\2.8.0.4360\FF\chrome\content\AddOn.xul (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\context management controller\2.8.0.4360\FF\components\cmcffaddon.xpt (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\internet content updater\1.8.0.2650\internettoday.ico (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\internet content updater\1.8.0.2650\internettoday.skf (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\internet content updater\1.8.0.2650\mfc80.dll (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\internet content updater\1.8.0.2650\microsoft.vc80.mfc.manifest (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\internet content updater\1.8.0.2650\skincrafterdll.dll (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\internet content updater\1.8.0.2650\unins000.dat (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\internet content updater\1.8.0.2650\unins000.exe (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\internet content updater\1.8.0.2650\data\itcfg.md (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\internet system controller\5.8.0.3240\unins000.dat (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\internet system controller\5.8.0.3240\unins000.exe (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\internet system controller\5.8.0.3240\Chrome\background.html (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\internet system controller\5.8.0.3240\Chrome\manifest.json (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\internet system controller\5.8.0.3240\Chrome\newtab.html (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\internet system controller\5.8.0.3240\Data\config.md (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\internet system controller\5.8.0.3240\FF\chrome.manifest (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\internet system controller\5.8.0.3240\FF\install.rdf (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\internet system controller\5.8.0.3240\FF\chrome\ISCAddOn.jar (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\internet system controller\5.8.0.3240\FF\chrome\content\ISCAddOn.js (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\internet system controller\5.8.0.3240\FF\chrome\content\ISCAddOn.xul (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\internet system controller\5.8.0.3240\FF\components\iscffaddon.xpt (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\internet system controller\5.8.0.3240\FF\components\iscffhelpercomponent.js (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\live content advancer\5.8.0.7460\unins000.dat (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\live content advancer\5.8.0.7460\unins000.exe (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\live content advancer\5.8.0.7460\Chrome\background.html (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\live content advancer\5.8.0.7460\Chrome\manifest.json (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\live content advancer\5.8.0.7460\Data\config.md (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\live content advancer\5.8.0.7460\FF\chrome.manifest (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\live content advancer\5.8.0.7460\FF\install.rdf (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\live content advancer\5.8.0.7460\FF\chrome\LCAAddOn.jar (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\live content advancer\5.8.0.7460\FF\chrome\content\LCAAddOn.js (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\live content advancer\5.8.0.7460\FF\chrome\content\LCAAddOn.xul (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\live content advancer\5.8.0.7460\FF\components\lcaffaddon.xpt (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\live content advancer\5.8.0.7460\FF\components\lcaffhelpercomponent.js (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\web search assistant\5.8.0.3310\unins000.dat (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\web search assistant\5.8.0.3310\unins000.exe (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\web search assistant\5.8.0.3310\Chrome\background.html (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\web search assistant\5.8.0.3310\Chrome\manifest.json (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\web search assistant\5.8.0.3310\Chrome\script.js (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\web search assistant\5.8.0.3310\Chrome\Data\config.md (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\web search assistant\5.8.0.3310\Data\config.md (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\web search assistant\5.8.0.3310\FF\chrome.manifest (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\web search assistant\5.8.0.3310\FF\install.rdf (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\web search assistant\5.8.0.3310\FF\chrome\WSAAddOn.jar (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\web search assistant\5.8.0.3310\FF\chrome\content\WSAAddOn.js (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\web search assistant\5.8.0.3310\FF\chrome\content\WSAAddOn.xul (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\web search assistant\5.8.0.3310\FF\components\wsaffaddon.xpt (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\program files\web search assistant\5.8.0.3310\FF\components\wsaffhelpercomponent.js (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\gamieplay toolbar\3.7.1.8090\Cache\default1.dat (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\gamieplay toolbar\3.7.1.8090\Cache\loading.dat (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\gamieplay toolbar\3.7.1.8090\Cache\loading.gif (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\gamieplay toolbar\3.7.1.8090\Data\module_logo.mx (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\gamieplay toolbar\3.7.1.8090\Data\module_option.mx (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\gamieplay toolbar\3.7.1.8090\Data\module_rss.mx (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\gamieplay toolbar\3.7.1.8090\Data\module_search.mx (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\gamieplay toolbar\3.7.1.8090\Data\module_smiley_config.mx (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\gamieplay toolbar\3.7.1.8090\Data\module_webdropdown_01.mx (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\gamieplay toolbar\3.7.1.8090\Data\module_webdropdown_02.mx (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\gamieplay toolbar\3.7.1.8090\Data\module_webdropdown_03.mx (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\gamieplay toolbar\3.7.1.8090\Data\module_webdropdown_04.mx (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\gamieplay toolbar\3.7.1.8090\Data\module_webdropdown_05.mx (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\gamieplay toolbar\3.7.1.8090\Data\module_webdropdown_06.mx (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\gamieplay toolbar\3.7.1.8090\Data\pixel.mx (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\gamieplay toolbar\3.7.1.8090\Data\productinfo.mx (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\gamieplay toolbar\3.7.1.8090\Data\profile.mx (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\gamieplay toolbar\3.7.1.8090\Data\searchenginelist.mx (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\gamieplay toolbar\3.7.1.8090\Data\tbcore.mx (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\gamieplay toolbar\3.7.1.8090\Data\toolbarlayout.mx (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\gamieplay toolbar\3.7.1.8090\Data\updatecentre.mx (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\gamieplay toolbar\3.7.1.8090\Data\updatecentrebk.mx (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\gamieplay toolbar\3.7.1.8090\Icons\module_webdropdown_02.mg (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\gamieplay toolbar\3.7.1.8090\Icons\About.mg (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\gamieplay toolbar\3.7.1.8090\Icons\component_combobox.mg (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\gamieplay toolbar\3.7.1.8090\Icons\module_logo.mg (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\gamieplay toolbar\3.7.1.8090\Icons\module_option.mg (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\gamieplay toolbar\3.7.1.8090\Icons\module_option_menu.mg (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\gamieplay toolbar\3.7.1.8090\Icons\module_rss.mg (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\gamieplay toolbar\3.7.1.8090\Icons\module_rss.png (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\gamieplay toolbar\3.7.1.8090\Icons\module_rss_menu.mg (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\gamieplay toolbar\3.7.1.8090\Icons\module_rss_menu.png (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\gamieplay toolbar\3.7.1.8090\Icons\module_search.mg (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\gamieplay toolbar\3.7.1.8090\Icons\module_webdropdown_01.mg (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\gamieplay toolbar\3.7.1.8090\Icons\module_webdropdown_01.png (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\gamieplay toolbar\3.7.1.8090\Icons\module_webdropdown_02.png (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\gamieplay toolbar\3.7.1.8090\Icons\module_webdropdown_03.mg (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\gamieplay toolbar\3.7.1.8090\Icons\module_webdropdown_03.png (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\gamieplay toolbar\3.7.1.8090\Icons\module_webdropdown_04.mg (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\gamieplay toolbar\3.7.1.8090\Icons\module_webdropdown_04.png (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\gamieplay toolbar\3.7.1.8090\Icons\module_webdropdown_05.mg (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\gamieplay toolbar\3.7.1.8090\Icons\module_webdropdown_05.png (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\gamieplay toolbar\3.7.1.8090\Icons\module_webdropdown_06.mg (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\gamieplay toolbar\3.7.1.8090\Icons\module_webdropdown_06.png (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\gamieplay toolbar\3.7.1.8090\Skins\myskin1.skf (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\gamieplay toolbar\3.7.1.8090\Skins\myskin2.skf (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\gamieplay toolbar\3.7.1.8090\Skins\myskin3.skf (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\gamieplay toolbar\3.7.1.8090\Skins\myskin4.skf (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\internet connection wizard\1.8.0.2650\itcfg.md (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\internet system controller\5.8.0.3240\config.md (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\internet system controller\5.8.0.3240\hjhp_20100718-011411.015.log (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\internet system controller\5.8.0.3240\hjhp_20100718-012142.390.log (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\live content advancer\5.8.0.7460\config.md (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\live content advancer\5.8.0.7460\ipdata.md (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\live content advancer\5.8.0.7460\np_20100718-011350.843.log (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\live content advancer\5.8.0.7460\np_20100718-011359.765.log (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\live content advancer\5.8.0.7460\np_20100718-012143.125.log (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\live content advancer\5.8.0.7460\np_20100718-122039.328.log (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\live content advancer\5.8.0.7460\np_20100718-122411.546.log (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\live content advancer\5.8.0.7460\np_20100718-122413.984.log (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\live content advancer\5.8.0.7460\np_20100718-122557.203.log (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\live content advancer\5.8.0.7460\np_20100718-122652.046.log (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\live content advancer\5.8.0.7460\np_20100718-122658.578.log (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\live content advancer\5.8.0.7460\State.ini (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\web search assistant\5.8.0.3310\config.md (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\web search assistant\5.8.0.3310\rState.ini (Adware.DoubleD) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\application data\web search assistant\5.8.0.3310\sState.ini (Adware.DoubleD) -> Quarantined and deleted successfully.

je reboot et je fais la suite :)

OTL: http://www.cijoint.fr/cjlink.php?file=cj201101/cijAlQYJYg.txt
Extras: http://www.cijoint.fr/cjlink.php?file=cj201101/cijorOMj2N.txt

merci

Relance OTL.
o sous Personnalisation, copie_colle le contenu du cadre ci dessous et clic Correction, un rapport apparraitra suite à l'operation que tu conserveras sur clé usb par exemple afin d'en coller le resultat:

:OTL
PRC - [2010/12/30 19:57:27 | 005,358,080 | ---- | M] () -- C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Windows Internet Name Service\wins.exe
:files
C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Windows Internet Name Service\

* redemarre le pc sous windows et poste le rapport ici


~~~

Refais un scan OTL et poste le rapport ici.

ok, log de la correction:
========== OTL ==========
Process wins.exe killed successfully!
========== FILES ==========
C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Windows Internet Name Service\temp folder moved successfully.
C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Windows Internet Name Service\pacman\bspatch folder moved successfully.
C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Windows Internet Name Service\pacman\archive folder moved successfully.
C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Windows Internet Name Service\pacman folder moved successfully.
C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Windows Internet Name Service\mtemp folder moved successfully.
C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Windows Internet Name Service\incoming folder moved successfully.
C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Windows Internet Name Service\cache folder moved successfully.
C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Windows Internet Name Service folder moved successfully.

OTL by OldTimer - Version 3.2.20.6 log created on 01282011_190446


reboot et re scan apres.... (avc les mêmes parametres que précedent)

merci

voila le scan OTL, cette fois ci il ne m'a pas donné d'extras! bon signe?

http://www.cijoint.fr/cjlink.php?file=cj201101/cijVIaXOMi.txt

il couine encore ton antivirus ?

pas pour l'instant, je vais reboot voir et lancer un scan complet :)

en tout cas un gros merci!!!! <3

je reviens après l'analyse etc

bonjour à tous

je suis nouvelle inscrite sur votre site .
je connais bien le site et je sais que vous me serai d'une grande aide .

j'ai lu pas mal de post sur mon probléme et je ne vois que vous pour m'aider .

j'ai mon syst32 qui est infecté .

j'ai télécharger malwarebyte anti-malware et voici le rapport :
( bien evidemment je ne sais pas le déchiffré lol )
Pouvez-vous m'aider à supprimer ce virus .
mes donnés sur le disque dur data sont accessible mais quand j'ouvre le disque C: ben c vide alors ca fait peur

merci d'avance cordialement

=> Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Version de la base de données: 6752

Windows 6.0.6001 Service Pack 1
Internet Explorer 7.0.6001.18000

02/06/2011 13:16:06
mbam-log-2011-06-02 (13-16-06).txt

Type d'examen: Examen complet (C:\|D:\|)
Elément(s) analysé(s): 267262
Temps écoulé: 48 minute(s), 33 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 6

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
c:\program files\mozilla firefox\rk_quarantine\39313144.exe.vir (Rogue.FakeHDD) -> Quarantined and deleted successfully.
c:\program files\mozilla firefox\rk_quarantine\iwtqjsalxi.exe.vir (Trojan.FakeMS) -> Quarantined and deleted successfully.
c:\programdata\iwtqjsalxi.exe (Trojan.FakeMS) -> Quarantined and deleted successfully.
c:\Users\sophie\AppData\Local\microsoft\Windows\temporary internet files\Content.IE5\VZ2E37LZ\calc[1].exe (Trojan.FakeMS) -> Quarantined and deleted successfully.
c:\Users\sophie\downloads\vlc-fr(2).exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\Users\sophie\downloads\vlc-fr.exe (Trojan.Dropper) -> Quarantined and deleted successfully.