E-mails intempestifs

salut c'est un ami à toi qui est infecté et qui envoie des mails automatiquement à toute sa boite , regarde dans la liste d'envoi du message tu dois pas etre le seul

mets en tentative de hameconnage ils vont se faire coincer par microsoft

http://cjoint.com/13sp/CIbwIhdioXe.htm

pas d'autre destinataire vu dans le message

ok et si tu les mets en indesirables ou en tentative de hameçonnage ils continuent à venir ?

il y a de mulitples expéditeurs, parfois avec mon nom dans l'adresse

fais ceci voir

https://www.security-helpzone.com/2013/04/26/usbfix-suppression-virus/

voici le log :

############################## | UsbFix V 7.133 | [Suppression]

Utilisateur: avld nicolas (Administrateur) # AVLD
Mis à jour le 27/08/2013 par El Desaparecido
Lancé à 13:59:24 | 27/08/2013

Site Web: https://www.sosvirus.net/
Upload Malware: http://sosvirus.net/viewtopic.php?f=6&t=489
Contact: eldesaparecido@sosvirus.net

PC: Dell Inc. (Latitude E5500 ) (X86-based PC)
CPU: Intel(R) Core(TM)2 Duo CPU T7250 @ 2.00GHz (1995)
RAM -> [Total : 2003 | Free : 1053]
BIOS: Phoenix ROM BIOS PLUS Version 1.10 A11
BOOT: Normal boot

OS: Microsoft Windows XP Professionnel (5.1.2600 32-Bit) # Service Pack 3
WB: Windows Internet Explorer 8.0.6001.18702

SC: Security Center Service [Enabled]
WU: Windows Update Service [Enabled]
FW: Windows FireWall Service [Enabled]

C:\ (%systemdrive%) -> Disque fixe # 149 Go (97 Go libre(s) - 65%) [OS] # NTFS
D:\ -> CD-ROM

################## | El Desaparecido Section |

HKLM\SOFTWARE | Run : [Apoint] - C:\Program Files\DellTPad\Apoint.exe
HKLM\SOFTWARE | Run : [AESTFltr] - %SystemRoot%\system32\AESTFltr.exe /NoDlg
HKLM\SOFTWARE | Run : [IgfxTray] - C:\WINDOWS\system32\igfxtray.exe
HKLM\SOFTWARE | Run : [HotKeysCmds] - C:\WINDOWS\system32\hkcmd.exe
HKLM\SOFTWARE | Run : [Persistence] - C:\WINDOWS\system32\igfxpers.exe
HKLM\SOFTWARE | Run : [SunJavaUpdateSched] - "C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe"
HKLM\SOFTWARE | Run : [IAAnotif] - C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
HKLM\SOFTWARE | Run : [ChangeTPMAuth] - C:\Program Files\Wave Systems Corp\Common\ChangeTPMAuth.exe /T:NTRU12
HKLM\SOFTWARE | Run : [WavXMgr] - C:\Program Files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe
HKLM\SOFTWARE | Run : [SecureUpgrade] - "C:\Program Files\Wave Systems Corp\SecureUpgrade.exe"
HKLM\SOFTWARE | Run : [EmbassySecurityCheck] - "C:\Program Files\Wave Systems Corp\EMBASSY Security Setup\EMBASSYSecurityCheck.exe"
HKLM\SOFTWARE | Run : [DellControlPoint] - "C:\Program Files\Dell\Dell ControlPoint\Dell.ControlPoint.exe"
HKLM\SOFTWARE | Run : [USCService] - C:\Program Files\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exe
HKLM\SOFTWARE | Run : [DellConnectionManager] - "C:\Program Files\Dell\Dell ControlPoint\Connection Manager\Dell.UCM.exe"
HKLM\SOFTWARE | Run : [PDVDDXSrv] - "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
HKLM\SOFTWARE | Run : [HP Software Update] - C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
HKLM\SOFTWARE | Run : [] -
HKLM\SOFTWARE | Run : [avast] - "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
HKLM\SOFTWARE | Run : [Adobe ARM] - "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
HKLM\SOFTWARE | RunOnce : [] -
HKU\S-1-5-21-3368285860-3421213333-4036477750-1005\SOFTWARE | Run : [ctfmon.exe] - C:\WINDOWS\system32\ctfmon.exe
HKU\S-1-5-21-3368285860-3421213333-4036477750-1005\SOFTWARE | Run : [LDM] - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
HKU\S-1-5-18\SOFTWARE | Run : [CTFMON.EXE] - C:\WINDOWS\system32\CTFMON.EXE

################## | Processus Stoppés |

Stoppé! C:\Program Files\Fingerprint Sensor\AtService.exe (1064)
Stoppé! C:\Program Files\Intel\WiFi\bin\S24EvMon.exe (1348)
Stoppé! C:\Program Files\AVAST Software\Avast\AvastSvc.exe (1648)
Stoppé! C:\WINDOWS\system32\spoolsv.exe (1776)
Stoppé! c:\drivers\audio\r213367\stacsv.exe (1816)
Stoppé! C:\WINDOWS\Explorer.EXE (504)
Stoppé! C:\Program Files\Dell\Dell ControlPoint\Connection Manager\SMManager.exe (148)
Stoppé! C:\Program Files\DellTPad\Apoint.exe (1592)
Stoppé! C:\WINDOWS\system32\AESTFltr.exe (1744)
Stoppé! C:\WINDOWS\system32\hkcmd.exe (1916)
Stoppé! C:\WINDOWS\system32\igfxpers.exe (1684)
Stoppé! C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe (1948)
Stoppé! C:\Program Files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe (568)
Stoppé! C:\WINDOWS\system32\igfxsrvc.exe (640)
Stoppé! C:\Program Files\Wave Systems Corp\SecureUpgrade.exe (672)
Stoppé! C:\Program Files\Dell\Dell ControlPoint\Dell.ControlPoint.exe (792)
Stoppé! C:\Program Files\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exe (1092)
Stoppé! C:\Program Files\Dell\Dell ControlPoint\Connection Manager\Dell.UCM.exe (1184)
Stoppé! C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe (1548)
Stoppé! C:\Program Files\HP\HP Software Update\HPWuSchd2.exe (1296)
Stoppé! C:\Program Files\AVAST Software\Avast\avastUI.exe (1528)
Stoppé! C:\WINDOWS\system32\ctfmon.exe (2052)
Stoppé! C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe (2100)
Stoppé! C:\Program Files\DellTPad\ApMsgFwd.exe (2108)
Stoppé! C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (2180)
Stoppé! C:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgr.exe (2208)
Stoppé! C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (2272)
Stoppé! C:\Program Files\DellTPad\HidFind.exe (2324)
Stoppé! C:\Program Files\DellTPad\Apntex.exe (2336)
Stoppé! C:\Program Files\Secunia\PSI\psi_tray.exe (2352)
Stoppé! C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe (2380)
Stoppé! C:\Program Files\Dell\Dell ControlPoint\DCPButtonSvc.exe (2432)
Stoppé! C:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe (2596)
Stoppé! C:\WINDOWS\system32\igfxext.exe (3072)
Stoppé! C:\Program Files\Intel\WiFi\bin\EvtEng.exe (3236)
Stoppé! C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE (3628)
Stoppé! C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe (4048)
Stoppé! C:\Program Files\Java\jre6\bin\jqs.exe (224)
Stoppé! C:\Program Files\Fichiers communs\Intel\WirelessCommon\RegSrvc.exe (1336)
Stoppé! C:\Program Files\Secunia\PSI\PSIA.exe (244)
Stoppé! C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe (3324)
Stoppé! C:\WINDOWS\system32\SearchIndexer.exe (3300)
Stoppé! C:\WINDOWS\system32\wbem\wmiapsrv.exe (300)
Stoppé! C:\Program Files\Secunia\PSI\sua.exe (4876)
Stoppé! C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe (5292)
Stoppé! C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe (5368)
Stoppé! C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe (5636)
Stoppé! C:\WINDOWS\system32\wuauclt.exe (3408)
Stoppé! C:\Program Files\Mozilla Firefox\firefox.exe (1800)

################## | Éléments infectieux |


(!) Fichiers temporaires supprimés.

################## | Registre |

Supprimé! HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System|DisableRegistryTools
Supprimé! HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System|DisableTaskMgr

################## | Mountpoints2 |


################## | Listing |

[04/11/2011 - 10:02:55 | D ] C:\Antes
[29/07/2011 - 18:48:27 | D ] C:\APIBAT
[06/02/2011 - 18:43:26 | RAD ] C:\Autorun.inf
[27/08/2010 - 15:14:57 | N | 212] C:\BOOT.BAK
[17/03/2013 - 16:00:25 | N | 293] C:\boot.ini
[14/04/2008 - 01:00:00 | N | 4952] C:\Bootfont.bin
[01/02/2011 - 16:10:56 | D ] C:\cmdcons
[14/04/2008 - 01:00:00 | N | 263504] C:\cmldr
[24/08/2013 - 01:37:42 | D ] C:\Config.Msi
[25/04/2008 - 20:00:56 | N | 0] C:\CONFIG.SYS
[14/09/2009 - 13:29:30 | D ] C:\DELL
[09/09/2009 - 07:28:27 | N | 5612] C:\dell.sdr
[14/09/2009 - 13:08:50 | D ] C:\Documents and Settings
[08/09/2009 - 23:00:07 | D ] C:\drivers
[15/09/2009 - 17:01:42 | D ] C:\f88094be1055d57a3d
[01/02/2011 - 10:31:21 | N | 1228854] C:\fsqwr.bmp
[27/08/2013 - 07:51:40 | ASH | 2100469760] C:\hiberfil.sys
[08/09/2009 - 22:41:48 | D ] C:\I386
[08/09/2009 - 23:00:56 | D ] C:\Intel
[25/04/2008 - 20:00:56 | N | 0] C:\IO.SYS
[25/04/2008 - 20:00:56 | N | 0] C:\MSDOS.SYS
[08/09/2009 - 23:15:17 | RD ] C:\MSOCache
[14/04/2008 - 01:00:00 | N | 47564] C:\NTDETECT.COM
[14/04/2008 - 01:00:00 | N | 252240] C:\ntldr
[27/08/2013 - 07:51:36 | ASH | 2145386496] C:\pagefile.sys
[22/08/2013 - 00:59:59 | D ] C:\Program Files
[07/03/2011 - 23:13:49 | SHD ] C:\RECYCLER
[16/06/2010 - 20:32:15 | D ] C:\rsc
[18/11/2009 - 09:12:04 | N | 889] C:\Settings.ini
[13/11/2006 - 13:21:34 | N | 13312638] C:\swipeall.avi
[06/02/2011 - 19:48:59 | D ] C:\SwSetup
[01/02/2011 - 16:54:23 | SHD ] C:\System Volume Information
[03/02/2011 - 11:48:25 | N | 3718] C:\Upload_avld nicolas.zip
[27/08/2013 - 14:02:14 | D ] C:\UsbFix
[27/08/2013 - 14:02:42 | A | 8426] C:\UsbFix [Clean 1] AVLD.txt
[27/08/2013 - 11:24:39 | D ] C:\WINDOWS
[01/02/2011 - 23:29:09 | N | 79360] C:\ZHPRegY0.zhp

################## | Vaccin |

C:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)

################## | E.O.F | https://www.sosvirus.net/ |

quid ?

Télécharge et enregistre (lien direct) http://general-changelog-team.fr/fr/downloads/finish/20-outils-de-xplode/2-adwcleaner ADWCleaner sur ton bureau :

Lance le,(Pour vista/7/8 => clic droit "executer en tant qu'administrateur") puis clique sur scan

une fois fait , clique sur nettoyer et poste C:\Adwcleaner[Sx].txt

# AdwCleaner v3.001 - Rapport créé le 28/08/2013 à 09:21:41
# Mis à jour le 24/08/2013 par Xplode
# Système d'exploitation : Microsoft Windows XP Service Pack 3 (32 bits)
# Nom d'utilisateur : avld nicolas - AVLD
# Exécuté depuis : C:\Documents and Settings\avld nicolas\Mes documents\Downloads\adwcleaner.exe
# Option : Nettoyer

***** [ Services ] *****


***** [ Fichiers / Dossiers ] *****

Dossier Supprimé : C:\Documents and Settings\avld nicolas\IECompatCache

***** [ Raccourcis ] *****


***** [ Registre ] *****

Clé Supprimée : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}
Clé Supprimée : HKCU\Software\Softonic
Clé Supprimée : HKCU\Software\YahooPartnerToolbar
Clé Supprimée : HKLM\Software\TENCENT
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{86D4B82A-ABED-442A-BE86-96357B70F4FE}

***** [ Navigateurs ] *****

-\\ Internet Explorer v8.0.6001.18702


-\\ Mozilla Firefox v23.0.1 (en-US)

[ Fichier : C:\Documents and Settings\avld nicolas\Application Data\Mozilla\Firefox\Profiles\o92voml2.default\prefs.js ]

Ligne Supprimée : user_pref("extensions.wrc.SearchRules.ask.com.style", ".WRCN {display:none} #yui-main .tsrc_vnru .title + .WRCN, #yui-main #teoma-results .title + .WRCN {display:inline !important; background: url(\"I[...]
Ligne Supprimée : user_pref("extensions.wrc.SearchRules.ask.com.url", "^hxxp(s)?\\:\\/\\/(.+\\.)?ask\\.com\\/.*");
Ligne Supprimée : user_pref("extensions.wrc.SearchRules.rambler.ru.style", ".WRCN {display:none} .search-results .title + .WRCN {display:inline !important; background: url(\"IMAGE\") right no-repeat}");

-\\ Google Chrome v28.0.1500.95

[ Fichier : C:\Documents and Settings\avld nicolas\Local Settings\Application Data\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [2019 octets] - [28/08/2013 09:19:54]
AdwCleaner[S0].txt - [1954 octets] - [28/08/2013 09:21:41]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2014 octets] ##########

re

execute ceci :

http://security-helpzone.com/gen-hackman/tutos-canneds/junkware-removal-tool/

re,

voici le rapport :

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 5.5.4 (08.22.2013:1)
OS: Microsoft Windows XP x86
Ran by avld nicolas on 28/08/2013 at 22:27:19,21
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ FireFox

Emptied folder: C:\Documents and Settings\avld nicolas\Application Data\mozilla\firefox\profiles\o92voml2.default\minidumps [3 files]





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 28/08/2013 at 22:32:57,71
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

bon on fait un diag

http://security-helpzone.com/gen-hackman/tutos-canneds/otl-2/

Voici les liens CJoint

http://cjoint.com/?CHCxTrQGWRL

https://www.cjoint.com/c/CHCxZTFHUX7

desinstalle Java 6 Update 23

=======

ATTENTION !!! : Script personnalisé pour cette machine uniquement , ne pas reproduire !!

si tu as XP => double clique
si tu as Vista ou windows 7 => clic droit "executer en tant que...."

sur OTL.exe pour le lancer.


▶Copie la liste qui se trouve en gras ci-dessous,

▶ colle-la dans la zone sous "Personnalisation" :


:processes
explorer.exe
iexplore.exe
firefox.exe
msnmsgr.exe
Teatimer.exe

:OTL
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..network.proxy.no_proxies_on: "*.local"
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found
O4 - Startup: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe (Logitech)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
[2009/09/15 17:01:42 | 000,000,000 | ---D | M] -- C:\f88094be1055d57a3d
[2009/09/18 08:01:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\avld nicolas\WINDOWS
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

:Reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
""=-
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"LDM"=-
[HKCU\Software]
"12B79064-EB17-4f82-9DFE-B975BD26D1DC"=-
"TIMEID"=-
[HKLM\Software]
"test"=-
"flash"=-
[-HKEY_LOCAL_MACHINE\Software\BrowserChoice]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP"=-
"445:TCP"=-
"137:UDP"=-
"138:UDP"=-
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall"=-
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP"=-
"2869:TCP"=-
"139:TCP"=-
"445:TCP"=-
"137:UDP"=-
"138:UDP"=-

:commands
[emptytemp]

▶ Clique sur "Correction" pour lancer la suppression.


▶ Poste le rapport qui logiquement s'ouvrira tout seul en fin de travail appres le redemarrage.

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
No active process named iexplore.exe was found!
No active process named firefox.exe was found!
No active process named msnmsgr.exe was found!
No active process named Teatimer.exe was found!
========== OTL ==========
Prefs.js: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23 removed from extensions.enabledItems
Prefs.js: "*.local" removed from network.proxy.no_proxies_on
Prefs.js: 0 removed from network.proxy.type
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Logitech Desktop Messenger.lnk moved successfully.
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Restrictions\ deleted successfully.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
C:\WINDOWS\Downloaded Program Files\gp.inf not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
C:\f88094be1055d57a3d\i386 folder moved successfully.
C:\f88094be1055d57a3d\amd64 folder moved successfully.
C:\f88094be1055d57a3d folder moved successfully.
C:\Documents and Settings\avld nicolas\WINDOWS\system folder moved successfully.
C:\Documents and Settings\avld nicolas\WINDOWS folder moved successfully.
C:\WINDOWS\system32\CONFIG.TMP deleted successfully.
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\LDM deleted successfully.
Registry value HKEY_CURRENT_USER\Software\\12B79064-EB17-4f82-9DFE-B975BD26D1DC deleted successfully.
Registry value HKEY_CURRENT_USER\Software\\TIMEID deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\\test deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\\flash deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\BrowserChoice\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List\\139:TCP deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List\\445:TCP deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List\\137:UDP deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List\\138:UDP deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\\EnableFirewall deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\\1900:UDP deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\\2869:TCP deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\\139:TCP deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\\445:TCP deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\\137:UDP deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\\138:UDP deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrateur
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: All Users

User: avld nicolas
->Temp folder emptied: 2194369 bytes
->Temporary Internet Files folder emptied: 7061816 bytes
->Java cache emptied: 73039614 bytes
->FireFox cache emptied: 108556791 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 660 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 49554 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 21779 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 299963448 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 67 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 468,00 mb


OTL by OldTimer - Version 3.2.69.0 log created on 08292013_135702

Files\Folders moved on Reboot...
File\Folder C:\Documents and Settings\avld nicolas\Local Settings\Temp\Perflib_Perfdata_d60.dat not found!
File\Folder C:\WINDOWS\temp\_avast_\Webshlock.txt not found!

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

passe malwarebytes :

https://www.security-helpzone.com/2013/04/17/malwarebytes-anti-malware-mbam-detecteur-generaliste-de-menaces/

j'ai fait examen rapide (est-ce suffisant ou faut-il faire l'examen complet ?) :

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Version de la base de données: v2013.08.26.04

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
avld nicolas :: AVLD [administrateur]

29/08/2013 14:53:09
mbam-log-2013-08-29 (14-53-09).txt

Type d'examen: Examen rapide
Options d'examen activées: Mémoire | Démarrage | Registre | Système de fichiers | Heuristique/Extra | Heuristique/Shuriken | PUP | PUM
Options d'examen désactivées: P2P
Elément(s) analysé(s): 239672
Temps écoulé: 5 minute(s), 35 seconde(s)

Processus mémoire détecté(s): 0
(Aucun élément nuisible détecté)

Module(s) mémoire détecté(s): 0
(Aucun élément nuisible détecté)

Clé(s) du Registre détectée(s): 0
(Aucun élément nuisible détecté)

Valeur(s) du Registre détectée(s): 0
(Aucun élément nuisible détecté)

Elément(s) de données du Registre détecté(s): 0
(Aucun élément nuisible détecté)

Dossier(s) détecté(s): 0
(Aucun élément nuisible détecté)

Fichier(s) détecté(s): 0
(Aucun élément nuisible détecté)

(fin)

c'est quoi qu'il y a ecrit ? tu ne lis pas ?