Ca rame.... A quoi est-ce dû ?

Zorinho désolée mais j'arrive pas du tout à virer Norton, déjà c'est pas le même windows et en plus a priori pas le même norton alors ça suffit pour une novice comme moi à me perdre :(

En fait j'ai fait C-> program -> Symantec -> LiveUpdate mais y'a pas le setup (j'ai tenté d'adapter comme j'ai pu pour retrouver les bons fichiers)....

Du coup j'vois pas comment l'enlever. Puis j'ose pas installer Antivir on me l'avait pourtant recommandé mais vu à quel point ça rame....

Benur, voici mes imprim' écran.

Alors au démarrage j'aime bien avoir mon panneau d'accueil windows même sil me sert pas (j'suis compliquée, suis une fille c'est normal lol), et mon ordi est un acer alors apparemment y'a le empowering technology qui se lance, j'aime bien aussi, et il se connecte tout seul, ça j'adore et je voudrais également garder (mais je crois que c'est dans empowering technology si j'ai tout compris).

Tu pourrais me dire stp ce qu'on va désactiver que je tente d'y comprendre quelque chose (j'sais pas y'a ptet un code qui me permettrait de m'y retrouver la prochaine fois) ? Merci encore de votre aide à tous les deux :)

Egalement je voudrais aussi virer le logiciel AOL mais j'me permets de vous demander (si j'abuse faites signe) car je sais qu'AOL a le don de laisser aussi des fichiers trainer partout :(

http://nsa02.casimages.com/img/2008/08/11/080811032912889356.jpg

http://nsa02.casimages.com/img/2008/08/11/08081103294969944.jpg

http://nsa02.casimages.com/img/2008/08/11/080811033010107331.jpg

salut

tu va telecharger Ccleaner http://www.commentcamarche.net/telecharger/telecharger 168 ccleaner

ouvre "Ccleaner" vas dans l'onglet "Option" puis "Avancé" puis décoches "Effacer uniquement les fichiers, du dossier temp de Windows, plus vieux que 48 heures."

. Puis vas dans l'onglet "Nettoyeur" fais "Analyse" puis "Lancer le nettoyage".
Puis vas dans l'onglet "Registre" puis fait "Chercher des erreurs" puis "Réparer les erreurs sélectionnée"
. Tu refais tous ca 4-5 fois (le nettoyage et le registre).

Puis reste dans "Ccleaner" puis va dans "Option" puis "Propriété" puis coches "Nettoyer automatiquement l'ordinateur au démarrage".

apres sa fait ceçi

poste un rapport hijackthis (outil de diagnostic)et quelqun te regardera sa

http://www.commentcamarche.net/telecharger/telecharger 159 hijackthis

mode d'emploi pour creer un rapport :

http://pageperso.aol.fr/balltrap34/demohijack.htm

Je conseille de renomer Hijackthis, pour contrer une éventuelle infection de Vundo.

ex:Renomme le fichier HijackThis.exe en Cçm.exe pour cela, fais un clic droit sur le fichier HijackThis.exe et choisis renommer dans la liste

Ensuite avec Explorer créer un dossier c:\hijackthis
Décompresser Hijackthis dans ce dossier.
C'est important pour les sauvegardes."

rien d'anormal dans le rapport Hijackthis...

Le problème vient probablement de Norton qui bouffe beaucoup de mémoire.

Je l'ai encore expérimenté récemment sur un ordi d'un ami. Il était d'une lenteur épouvantable. J'ai désinstallé Norton et installé ESET. Et là , toit d'un coup, l'ordi a ressuscité.

Tu as déjà payé pour norton??? Ou est-ce temporaire?

A plus

Zor

salut

je ne suis pas trop un fan de vista mais on attendant que quelqun te viennent on aide avance le topic avec sa

telecharge malwarbyte http://www.commentcamarche.net/telecharger/telecharger 34055379 malwarebyte s anti malware a l'intallation verifie que mise a jour et lançer program et scan complet sont bien cocher

Une fois a jour, le programme va se lancer; click sur l´onglet parametre, et coche la case : "Arreter internet explorer pendant la suppression".

A la fin du scan clique sur Afficher les résultats

Suppression des éléments détectés >>>> clique sur Supprimer la sélection ou supprimer tout
S'il t'es demandé de redémarrer >>> clique sur "Yes"

Et tu poste le raport generer
et on attendant une reponse tu peut refaire un scan malwarbyte mais on mode sans echec car beaucoup plus efficace

comment demarer on mode sans echec içi tuto http://www.infos-du-net.com/forum/272325-11-tuto-demarrer-mode-echec

tu enregistre le raport generer de facon a le retrouver et tu poste le nouveau rapport raport

ok no problem

Merci beaucoup pour cette manipulation, je vais la faire dès demain matin.

Si tu peux remercier également Benur de ma part stp :)

Et donc je vous posterais le nouveau rapport HiJackThis après cette manip' là :)

Alors le rapport Hijackthis :

Par contre un ptit truc que je ne comprends pas c'est que Symantec continue à se lancer ??
Je pensais qu'on l'avait enlevé le Norton ? En fait là il s'est lancé quand j'ai fait la manip HiJackThis...

Egalement, pendant la manipulation HijackThis, j'ai eu une fenêtre toute bizarre que j'vous ai prise en photo :
https://www.casimages.com/i/080813112801982495.jpg.html

J'ai l'impression d'avoir repris un peu de vitesse (bon j'veux pas trop m'avancer non plus trop vite mais a priori y'a un mieux), merci beaucoup :)

Et puis quand vous m'aurez décodé tout ça si j'abuse pas je me permettrais une ou deux ptites questions que je me pose sur mon ordi svp :)


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:44:19, on 05/08/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16681)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Windows\BR040286.exe
C:\Program Files\Launch Manager\LManager.exe
C:\Acer\Empowering Technology\eDSMSNfix.exe
C:\Program Files\Common Files\aol\1193534802\ee\aolsoftware.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Orange\Systray\SystrayApp.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Windows\ehome\ehmsas.exe
C:\Acer\Empowering Technology\ENET\ENMTRAY.EXE
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Acer\Empowering Technology\EPOWER\EPOWER_DMC.EXE
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\conime.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\Macromed\Flash\FlashUtil9e.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ycomp/defaults/sp/*https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ycomp/defaults/su/*https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
O1 - Hosts: ::1 localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Windows\system32\ActiveToolBand.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [IS CfgWiz] "C:\Program Files\Common Files\Symantec Shared\OPC\{31011D49-D90C-4da0-878B-78D28AD507AF}\cltUIStb.exe" /MODULE CfgWiz /GUID {BC8D3EAF-F864-4d4b-AB4D-B3D0C32E2840} /MODE CfgWiz /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [BisonInst0402] C:\Windows\BR040286.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [eDSMSNfix] C:\Acer\Empowering Technology\eDSMSNfix.exe
O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1193534802\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\Orange\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\Orange\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [] (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [] (User 'Default user')
O4 - Startup: OneNote 2007 - Capture d'écran et lancement.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Empowering Technology Launcher.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Plugin Control) - http://appldnld.apple.com/QuickTime/qtactivex/qtplugin.cab
O16 - DPF: {04CB5B64-5915-4629-B869-8945CEBADD21} (Module de délivrance de certificat MINEFI) - https://static.impots.gouv.fr/abos/static/securite/certdgi1.cab
O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerVistaADP-1.1.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/JSCDL/jdk/6u7/jinstall-6u7-windows-i586-jc.cab?e=1216890298185&h=ea2e8ec7b2cf4df6b03cda799f853d6a/&filename=jinstall-6u7-windows-i586-jc.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - AppInit_DLLs: eNetHook.dll
O23 - Service: ALaunch Service (ALaunchService) - Unknown owner - C:\Acer\ALaunch\ALaunchSvc.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Validation de mot de passe Symantec IS (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

Merci Chiquitine, j'y vais et je te poste le rapport en revenant...

Y'a une petite chose qui me dérange par contre c'est que depuis les dernières manipulations, mon word2007 est hyper long à s'ouvrir (je pense qu'on a dû le désactiver au démarrage, ça doit être lié non ?) et surtout il bug une fois sur deux :/

Allez je file au mode sans échec, à tout de suite et encore merci de ton aide :)

Alors la première partie j'ai un ptit peu galéré (le programme répondait pas par moments), mais ça a fini par me trouver quelques trucs que je vais te copier coller ci dessous.
En fait il n'a pas pu crééer le rapport pour accès refusé. Donc je t'ai sauvé ce qu'il y avait dans la fenêtre.

Pour HijackThis ça a tendance à m'énerver lol, en fait j'ai tout fait bien comme tu m'as dit mais re-message d'erreurs comme hier je comprends pas :/
Voici l'imprim'écran du message d'erreur :

https://www.casimages.com/i/080814091648156327.jpg.html

Voici ce que je t'ai sauvé (les deux rapports l'un sous l'autre)

Edit : la grosse galère, c'est encore pas les bonnes dates/heures pour Hijackthis :( :( :(

:

-->- Recherche:

C:\_OtMoveIt: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !
C:\Users\pipo\AppData\Local\VirtualStore\Program Files\Trend Micro\HijackThis: trouvé !
C:\Users\pipo\Desktop\HJTInstall.exe: trouvé !

---------------------------------
-->- Suppression:

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: Erreur de suppression !
C:\Users\pipo\Desktop\HJTInstall.exe: supprimé !
C:\_OtMoveIt: supprimé !
C:\Program Files\Trend Micro\HijackThis: Erreur de suppression !
C:\Users\pipo\AppData\Local\VirtualStore\Program Files\Trend Micro\HijackThis: supprimé !


https://www.casimages.com/i/080814091648156327.jpg.html

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:44:19, on 05/08/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16681)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Windows\BR040286.exe
C:\Program Files\Launch Manager\LManager.exe
C:\Acer\Empowering Technology\eDSMSNfix.exe
C:\Program Files\Common Files\aol\1193534802\ee\aolsoftware.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Orange\Systray\SystrayApp.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Windows\ehome\ehmsas.exe
C:\Acer\Empowering Technology\ENET\ENMTRAY.EXE
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Acer\Empowering Technology\EPOWER\EPOWER_DMC.EXE
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\conime.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\Macromed\Flash\FlashUtil9e.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ycomp/defaults/sp/*https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ycomp/defaults/su/*https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
O1 - Hosts: ::1 localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Windows\system32\ActiveToolBand.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [IS CfgWiz] "C:\Program Files\Common Files\Symantec Shared\OPC\{31011D49-D90C-4da0-878B-78D28AD507AF}\cltUIStb.exe" /MODULE CfgWiz /GUID {BC8D3EAF-F864-4d4b-AB4D-B3D0C32E2840} /MODE CfgWiz /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [BisonInst0402] C:\Windows\BR040286.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [eDSMSNfix] C:\Acer\Empowering Technology\eDSMSNfix.exe
O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1193534802\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\Orange\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\Orange\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [] (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [] (User 'Default user')
O4 - Startup: OneNote 2007 - Capture d'écran et lancement.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Empowering Technology Launcher.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Plugin Control) - http://appldnld.apple.com/QuickTime/qtactivex/qtplugin.cab
O16 - DPF: {04CB5B64-5915-4629-B869-8945CEBADD21} (Module de délivrance de certificat MINEFI) - https://static.impots.gouv.fr/abos/static/securite/certdgi1.cab
O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerVistaADP-1.1.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/JSCDL/jdk/6u7/jinstall-6u7-windows-i586-jc.cab?e=1216890298185&h=ea2e8ec7b2cf4df6b03cda799f853d6a/&filename=jinstall-6u7-windows-i586-jc.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - AppInit_DLLs: eNetHook.dll
O23 - Service: ALaunch Service (ALaunchService) - Unknown owner - C:\Acer\ALaunch\ALaunchSvc.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Validation de mot de passe Symantec IS (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

Merci :)

C'est tout bon pour le HijackThis
Par contre le CC Cleaner m'a réparé plein de files Symantec je crois :/

Voici le rapport :)


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:45:02, on 14/08/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16711)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Windows\BR040286.exe
C:\Program Files\Launch Manager\LManager.exe
C:\Acer\Empowering Technology\eDSMSNfix.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Orange\Systray\SystrayApp.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\ehome\ehmsas.exe
C:\Acer\Empowering Technology\ENET\ENMTRAY.EXE
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Acer\Empowering Technology\EPOWER\EPOWER_DMC.EXE
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Windows\System32\mobsync.exe
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\conime.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ycomp/defaults/sp/*https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ycomp/defaults/su/*https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
O1 - Hosts: ::1 localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Windows\system32\ActiveToolBand.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: (no name) - {90222687-F593-4738-B738-FBEE9C7B26DF} - (no file)
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [IS CfgWiz] "C:\Program Files\Common Files\Symantec Shared\OPC\{31011D49-D90C-4da0-878B-78D28AD507AF}\cltUIStb.exe" /MODULE CfgWiz /GUID {BC8D3EAF-F864-4d4b-AB4D-B3D0C32E2840} /MODE CfgWiz /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [BisonInst0402] C:\Windows\BR040286.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [eDSMSNfix] C:\Acer\Empowering Technology\eDSMSNfix.exe
O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\Orange\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\Orange\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [MSConfig] "C:\Windows\system32\msconfig.exe" /auto
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [] (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [] (User 'Default user')
O4 - Global Startup: Empowering Technology Launcher.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Plugin Control) - http://appldnld.apple.com/QuickTime/qtactivex/qtplugin.cab
O16 - DPF: {04CB5B64-5915-4629-B869-8945CEBADD21} (Module de délivrance de certificat MINEFI) - https://static.impots.gouv.fr/abos/static/securite/certdgi1.cab
O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerVistaADP-1.1.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/JSCDL/jdk/6u7/jinstall-6u7-windows-i586-jc.cab?e=1216890298185&h=ea2e8ec7b2cf4df6b03cda799f853d6a/&filename=jinstall-6u7-windows-i586-jc.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - AppInit_DLLs: eNetHook.dll
O23 - Service: ALaunch Service (ALaunchService) - Unknown owner - C:\Acer\ALaunch\ALaunchSvc.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: COM Host (comHost) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe (file missing)
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Unknown owner - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE (file missing)
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

Merci de cette manip' Chiquitine...

Bon le pc va un peu mieux qu'avant (j'étais obligée de le surélever -c'est un portable- tellement il ronflait), mais c'est pas encore ça (en fait on a aussi un fixe qui a de moins bonnes caractéristiques à la base, plus de programmes dans le nez et qui surfe plus vite, j'en conclue que le mien a toujours quelque chose qui va pas ?).

Sinon, j'ai remarqué que Norton était encore dans le coin car il m'a mis un ptit message en bas à droite comme quoi Norton n'était pas à jour :/
Décidemment il a bien du mal à partir celui-ci...

Antivir n'a rien détecté d'anormal. J'avais peur qu'il ne s'occupe pas de D mais si, ouf :D
Faut que je le lance tous les combien à scanner tout l'ordi dans l'idéal ?

Hijackthis... On s'est encore pris la tête tous les deux et il a encore fallut que je le désinstalle/réinstalle. J'ai enfin compris que c'est parce que je suis sous vista et qu'il faut que je fasse "executer en tant qu'administrateur", ouf lol

Je file faire la manip' de DarkKiller :)



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:00:17, on 15/08/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16711)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Windows\BR040286.exe
C:\Program Files\Launch Manager\LManager.exe
C:\Acer\Empowering Technology\eDSMSNfix.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Orange\Systray\SystrayApp.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\ehome\ehmsas.exe
C:\Acer\Empowering Technology\ENET\ENMTRAY.EXE
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Acer\Empowering Technology\EPOWER\EPOWER_DMC.EXE
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Windows\System32\mobsync.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\conime.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ycomp/defaults/sp/*https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ycomp/defaults/su/*https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
O1 - Hosts: ::1 localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Windows\system32\ActiveToolBand.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: (no name) - {90222687-F593-4738-B738-FBEE9C7B26DF} - (no file)
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [IS CfgWiz] "C:\Program Files\Common Files\Symantec Shared\OPC\{31011D49-D90C-4da0-878B-78D28AD507AF}\cltUIStb.exe" /MODULE CfgWiz /GUID {BC8D3EAF-F864-4d4b-AB4D-B3D0C32E2840} /MODE CfgWiz /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [BisonInst0402] C:\Windows\BR040286.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [eDSMSNfix] C:\Acer\Empowering Technology\eDSMSNfix.exe
O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\Orange\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\Orange\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [MSConfig] "C:\Windows\system32\msconfig.exe" /auto
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [] (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [] (User 'Default user')
O4 - Global Startup: Empowering Technology Launcher.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Plugin Control) - http://appldnld.apple.com/QuickTime/qtactivex/qtplugin.cab
O16 - DPF: {04CB5B64-5915-4629-B869-8945CEBADD21} (Module de délivrance de certificat MINEFI) - https://static.impots.gouv.fr/abos/static/securite/certdgi1.cab
O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerVistaADP-1.1.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/JSCDL/jdk/6u7/jinstall-6u7-windows-i586-jc.cab?e=1216890298185&h=ea2e8ec7b2cf4df6b03cda799f853d6a/&filename=jinstall-6u7-windows-i586-jc.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - AppInit_DLLs: eNetHook.dll
O23 - Service: ALaunch Service (ALaunchService) - Unknown owner - C:\Acer\ALaunch\ALaunchSvc.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

Bon c'est fait, alors j'ai tout décoché, j'me suis permise de recocher avec le disque D qui était décoché et en cours de manip' j'ai vu qu'il y avait aussi un ADS ou ASD de coché... Je l'ai laissé, j'espère que c'est pas grave.

Merci d'être arrivé si vite et d'accepter d'y jeter un oeil aussi ;)

Voici le rapport, Chiquitine j'ai pas laissé le rapport antivir j'espère que ce n'est pas grave mais à priori j'ai pas eu l'encart disant qu'il y avait quelque chose d'infecté... Je le lancerais donc tous les combien à scanner antivir stp ?

Encore merci de votre aide :)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:01:56, on 15/08/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16711)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Windows\BR040286.exe
C:\Program Files\Launch Manager\LManager.exe
C:\Acer\Empowering Technology\eDSMSNfix.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Orange\Systray\SystrayApp.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\ehome\ehmsas.exe
C:\Acer\Empowering Technology\ENET\ENMTRAY.EXE
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Acer\Empowering Technology\EPOWER\EPOWER_DMC.EXE
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Windows\System32\mobsync.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\conime.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ycomp/defaults/sp/*https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ycomp/defaults/su/*https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
O1 - Hosts: ::1 localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Windows\system32\ActiveToolBand.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: (no name) - {90222687-F593-4738-B738-FBEE9C7B26DF} - (no file)
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [IS CfgWiz] "C:\Program Files\Common Files\Symantec Shared\OPC\{31011D49-D90C-4da0-878B-78D28AD507AF}\cltUIStb.exe" /MODULE CfgWiz /GUID {BC8D3EAF-F864-4d4b-AB4D-B3D0C32E2840} /MODE CfgWiz /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [BisonInst0402] C:\Windows\BR040286.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [eDSMSNfix] C:\Acer\Empowering Technology\eDSMSNfix.exe
O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\Orange\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\Orange\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [MSConfig] "C:\Windows\system32\msconfig.exe" /auto
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [] (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [] (User 'Default user')
O4 - Global Startup: Empowering Technology Launcher.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Plugin Control) - http://appldnld.apple.com/QuickTime/qtactivex/qtplugin.cab
O16 - DPF: {04CB5B64-5915-4629-B869-8945CEBADD21} (Module de délivrance de certificat MINEFI) - https://static.impots.gouv.fr/abos/static/securite/certdgi1.cab
O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerVistaADP-1.1.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/JSCDL/jdk/6u7/jinstall-6u7-windows-i586-jc.cab?e=1216890298185&h=ea2e8ec7b2cf4df6b03cda799f853d6a/&filename=jinstall-6u7-windows-i586-jc.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - AppInit_DLLs: eNetHook.dll
O23 - Service: ALaunch Service (ALaunchService) - Unknown owner - C:\Acer\ALaunch\ALaunchSvc.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

Voici le nouveau rapport :)
Il m'a viré un onglet au démarrage d'internet qui ne fonctionnait qu'une fois sur deux, dommage qu'il n'en ait pas profité pour faire le tri dans le bazar que j'ai mis dans mes favoris lol



ComboFix 08-08-14.03 - pipo 2008-08-15 17:10:03.1 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6000.0.1252.1.1036.18.1007 [GMT 2:00]
Endroit: C:\Users\pipo\Desktop\ComboFix.exe
* Création d'un nouveau point de restauration
.

((((((((((((((((((((((((((((( Fichiers créés 2008-07-15 to 2008-08-15 ))))))))))))))))))))))))))))))))))))
.

Pas de nouveau fichier créé dans cet espace de temps

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-15 12:03 --------- d-----w C:\ProgramData\Avira
2008-08-15 12:03 --------- d-----w C:\Program Files\Avira
2008-08-13 10:11 --------- d-----w C:\ProgramData\Microsoft Help
2008-08-06 12:59 --------- d-----w C:\Users\pipo\AppData\Roaming\Malwarebytes
2008-08-06 12:59 --------- d-----w C:\ProgramData\Malwarebytes
2008-08-06 12:59 --------- d-----w C:\Program Files\Malwarebytes' Anti-Malware
2008-08-05 06:43 --------- d-----w C:\Program Files\Trend Micro
2008-08-05 06:19 --------- d-----w C:\Program Files\CCleaner
2008-07-30 18:07 38,472 ----a-w C:\Windows\system32\drivers\mbamswissarmy.sys
2008-07-30 18:07 17,144 ----a-w C:\Windows\system32\drivers\mbam.sys
2008-07-24 09:06 --------- d-----w C:\Program Files\Java
2008-07-24 09:04 --------- d-----w C:\Program Files\Common Files\Java
2008-07-15 23:48 2,048 ----a-w C:\Windows\System32\tzres.dll
2008-07-10 17:09 174 --sha-w C:\Program Files\desktop.ini
2008-06-27 03:54 826,368 ----a-w C:\Windows\System32\wininet.dll
2008-06-27 03:54 56,320 ----a-w C:\Windows\System32\iesetup.dll
2008-06-27 03:54 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-06-27 03:54 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
2008-06-26 00:34 7,964,672 ----a-w C:\Windows\System32\NlsLexicons0024.dll
2008-06-26 00:33 9,892,864 ----a-w C:\Windows\System32\NlsLexicons000a.dll
2008-06-19 03:25 61,440 ----a-w C:\Windows\System32\winipsec.dll
2008-06-19 03:25 361,984 ----a-w C:\Windows\System32\IPSECSVC.DLL
2008-06-19 03:25 28,672 ----a-w C:\Windows\System32\FwRemoteSvr.dll
2008-06-19 03:25 272,896 ----a-w C:\Windows\System32\polstore.dll
2008-02-07 13:04 210 ----a-w C:\Users\pipo\AppData\Roaming\wklnhst.dat
2008-03-28 11:02 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2008-03-28 11:02 32,768 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2008-03-28 11:02 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-09 18:32 1232896]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 14:35 125440]
"WindowsWelcomeCenter"="oobefldr.dll" [2006-11-02 14:34 2159104 C:\Windows\System32\oobefldr.dll]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-10-23 05:00 815104]
"eDataSecurity Loader"="C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-02-07 00:04 464168]
"BisonInst0402"="C:\Windows\BR040286.exe" [2007-05-08 23:19 69632]
"LManager"="C:\PROGRA~1\LAUNCH~1\LManager.exe" [2006-12-08 10:24 614400]
"eDSMSNfix"="C:\Acer\Empowering Technology\eDSMSNfix.exe" [2007-02-08 19:40 13312]
"Acer Tour Reminder"="C:\Acer\AcerTour\Reminder.exe" [2007-01-17 09:01 151552]
"WarReg_PopUp"="C:\Acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 21:48 57344]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 07:00 33648]
"SystrayORAHSS"="C:\Program Files\Orange\Systray\SystrayApp.exe" [2007-09-25 20:08 94208]
"ORAHSSSessionManager"="C:\Program Files\Orange\SessionManager\SessionManager.exe" [2007-09-25 19:10 102400]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"MSConfig"="C:\Windows\system32\msconfig.exe" [2006-11-02 11:45 222208]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 14:28 266497]
"RtHDVCpl"="RtHDVCpl.exe" [2006-12-01 07:37 4186112 C:\Windows\RtHDVCpl.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35 90112]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Empowering Technology Launcher.lnk - C:\Acer\Empowering Technology\eAPLauncher.exe [2007-04-05 02:28:04 528384]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=eNetHook.dll

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\Windows\pss\Adobe Reader Speed Launch.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^Users^pipo^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 - Capture d'écran et lancement.lnk]
path=C:\Users\pipo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 - Capture d'écran et lancement.lnk
backup=C:\Windows\pss\OneNote 2007 - Capture d'écran et lancement.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
--a------ 2006-09-26 02:52 50736 C:\Program Files\Common Files\aol\1193534802\ee\aolsoftware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{BA099FE1-BF14-4B80-AE27-C519C3039686}"= UDP:C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\MCE Deluxe Suite.exe:CyberLink MCE Deluxe Suite
"{EF48618E-9856-413E-81F5-4C496E1F3F24}"= TCP:C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\MCE Deluxe Suite.exe:CyberLink MCE Deluxe Suite
"{90D82672-37F5-40A4-BC66-D707E1C779E8}"= UDP:C:\Program Files\Common Files\aol\acs\AOLDial.exe:AOL Autoconnect
"{8B3BAB1E-DB3A-4A60-8991-17B08A4E6B91}"= TCP:C:\Program Files\Common Files\aol\acs\AOLDial.exe:AOL Autoconnect
"{B78E130B-72D1-44DC-BAFE-1273DE1718F2}"= UDP:C:\Program Files\Common Files\aol\acs\AOLacsd.exe:module de connexion AOL
"{C67D83F9-203E-4DB9-86FB-7813189982FD}"= TCP:C:\Program Files\Common Files\aol\acs\AOLacsd.exe:module de connexion AOL
"{515993C6-E21C-48BF-8BB1-95FF4EB60377}"= UDP:C:\Program Files\Common Files\aol\1193534802\ee\aolsoftware.exe:AOL Shared Components
"{98A5CAFD-B003-49F5-A286-F5CD7446F3FD}"= TCP:C:\Program Files\Common Files\aol\1193534802\ee\aolsoftware.exe:AOL Shared Components
"{97783C35-CD5C-4FD3-9063-D03B35D1D0DF}"= UDP:C:\Program Files\AOL 9.0 VR\waol.exe:AOL
"{0FCD8F41-1124-4224-95D1-0D152F41289F}"= TCP:C:\Program Files\AOL 9.0 VR\waol.exe:AOL
"{EF7DF836-DC91-4A05-9A5C-E3EC01F394D2}"= UDP:C:\Program Files\Common Files\aol\TopSpeed\3.0\aoltpsd3.exe:AOL TopSpeed
"{FF20FA2A-3CA2-4E0B-9065-E768C71E6ADA}"= TCP:C:\Program Files\Common Files\aol\TopSpeed\3.0\aoltpsd3.exe:AOL TopSpeed
"{4833793C-73B1-4336-92AF-C6395799DD36}"= UDP:C:\Program Files\Common Files\aol\Loader\aolload.exe:AOL Loader
"{487C6A2A-913D-4D2B-BFC2-B4DA2BC7EDE3}"= TCP:C:\Program Files\Common Files\aol\Loader\aolload.exe:AOL Loader
"{61A887BC-BC67-40F0-8895-B7ABC6B51651}"= UDP:C:\Program Files\Common Files\aol\System Information\sinf.exe:AOL System Information
"{FB5CB196-F538-4E20-B0AD-3D5DE59D9D01}"= TCP:C:\Program Files\Common Files\aol\System Information\sinf.exe:AOL System Information
"{CE1F1A6E-43F2-41EC-A723-2DAFB673A380}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{FDF44FDF-EC83-4115-9F31-7A0AC2F2D75F}"= UDP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{A44924CF-0080-49B7-A6EF-C6D93A141624}"= TCP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{AC421A67-8DA9-4594-B108-93D1BCC67C1E}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{E59840BC-9246-4FB6-9D9C-C25044A1CAF2}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{294EF351-DEF5-43D0-BE70-A8478C61578F}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"C:\\Program Files\\Orange\\Connectivity\\ConnectivityManager.exe"= C:\Program Files\Orange\Connectivity\ConnectivityManager.exe:*:enabled:CSS

R2 ALaunchService;ALaunch Service;C:\Acer\ALaunch\ALaunchSvc.exe [2007-01-26 14:24]
R3 atikmdag;atikmdag;C:\Windows\system32\DRIVERS\atikmdag.sys [2007-04-06 00:36]
S3 IDSvix86;Symantec Intrusion Prevention Driver;C:\PROGRA~2\Symantec\DEFINI~1\SymcData\idsdefs\20061025.029\IDSvix86.sys [2006-11-21 06:30]
S3 PCAMp50;PCAMp50 NDIS Protocol Driver;C:\Windows\system32\Drivers\PCAMp50.sys [2006-11-28 21:46]
S3 PCASp50;PCASp50 NDIS Protocol Driver;C:\Windows\system32\Drivers\PCASp50.sys [2006-11-28 21:46]
S3 SMSCIRDA;SMSC Infrared Device Driver;C:\Windows\system32\DRIVERS\SMSCirda.sys [2006-10-18 09:44]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cc1c0ec0-cf21-11dc-a897-00038a000015}]
\shell\AutoRun\command - G:\LaunchU3.exe

*Newly Created Service* - AVGIO
*Newly Created Service* - AVGNTFLT
*Newly Created Service* - AVIPBB
*Newly Created Service* - CATCHME
*Newly Created Service* - COMHOST
*Newly Created Service* - GMER
*Newly Created Service* - LIVEUPDATE
*Newly Created Service* - PROCEXP90
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-Acer Tour Reminder - (no file)
HKLM-Run-IS CfgWiz - C:\Program Files\Common Files\Symantec Shared\OPC\{31011D49-D90C-4da0-878B-78D28AD507AF}\cltUIStb.exe
HKLM-Run-Acer Tour - (no file)
HKLM-Run-eRecoveryService - (no file)


.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://fr.fr.acer.yahoo.com
R0 -: HKCU-Main,SearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
R0 -: HKLM-Main,Start Page = hxxp://fr.fr.acer.yahoo.com
R1 -: HKCU-SearchURL,(Default) = hxxp://fr.rd.yahoo.com/customize/ycomp/defaults/su/*https://fr.yahoo.com/
O8 -: E&xporter vers Microsoft Excel - C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O16 -: {04CB5B64-5915-4629-B869-8945CEBADD21} - hxxps://static.impots.gouv.fr/abos/static/securite/certdgi1.cab
C:\Windows\Downloaded Program Files\CERTDGI1.dll

O16 -: {88764F69-3831-4EC1-B40B-FF21D8381345} - hxxps://static.impots.gouv.fr/tdir/static/adpform/AdSignerVistaADP-1.1.cab
C:\Windows\Downloaded Program Files\AdSignerADP.inf
C:\Windows\System32\msvcp60.dll
C:\Windows\System32\atl.dll
C:\Windows\Downloaded Program Files\AdVerifierADP.dll
C:\Windows\Downloaded Program Files\AdSignerADP.dll


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-15 17:12:53
Windows 6.0.6000 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-08-15 17:14:21
ComboFix-quarantined-files.txt 2008-08-15 15:14:14

Pre-Run: Le texte du message associé au numéro 0x2379 est introuvable dans le fichier de messages pour Application.
Post-Run: 30,676,512,768 octets libres

166 --- E O F --- 2008-08-13 10:12:03

Le rapport combofix (j'envoie le hijackthis après) :

ComboFix 08-08-14.03 - pipo 2008-08-15 20:09:57.2 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6000.0.1252.1.1036.18.1097 [GMT 2:00]
Endroit: C:\Users\pipo\Desktop\ComboFix.exe
Command switches used :: C:\Users\pipo\Desktop\CFScript.txt
* Création d'un nouveau point de restauration

FILE ::
C:\PROGRA~2\Symantec\DEFINI~1\SymcData\idsdefs\20061025.029\­IDSvix86.sys
G:\LaunchU3.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\PROGRA~2\Symantec
C:\PROGRA~2\Symantec\Common Client\settings.bak
C:\PROGRA~2\Symantec\Common Client\settings.dat
C:\PROGRA~2\Symantec\Definitions\SymcData\idsdefs\20061025.029\CATALOG.DAT
C:\PROGRA~2\Symantec\Definitions\SymcData\idsdefs\20061025.029\IDS9xx86.dll
C:\PROGRA~2\Symantec\Definitions\SymcData\idsdefs\20061025.029\IDSVia64.cat
C:\PROGRA~2\Symantec\Definitions\SymcData\idsdefs\20061025.029\IDSVia64.INF
C:\PROGRA~2\Symantec\Definitions\SymcData\idsdefs\20061025.029\IDSviA64.sys
C:\PROGRA~2\Symantec\Definitions\SymcData\idsdefs\20061025.029\IDSVix86.cat
C:\PROGRA~2\Symantec\Definitions\SymcData\idsdefs\20061025.029\IDSVix86.INF
C:\PROGRA~2\Symantec\Definitions\SymcData\idsdefs\20061025.029\IDSvix86.sys
C:\PROGRA~2\Symantec\Definitions\SymcData\idsdefs\20061025.029\IDSxpx86.dll
C:\PROGRA~2\Symantec\Definitions\SymcData\idsdefs\20061025.029\Metadata.dat
C:\PROGRA~2\Symantec\Definitions\SymcData\idsdefs\20061025.029\sigs.dat
C:\PROGRA~2\Symantec\Definitions\SymcData\idsdefs\20061025.029\SymIDSCo.sys
C:\PROGRA~2\Symantec\Definitions\SymcData\idsdefs\20061025.029\SymIDSCo.vxd
C:\PROGRA~2\Symantec\Definitions\SymcData\idsdefs\20061025.029\SymIDSI.dll
C:\PROGRA~2\Symantec\Definitions\SymcData\idsdefs\20061025.029\v.grd
C:\PROGRA~2\Symantec\Definitions\SymcData\idsdefs\20061025.029\v.sig
C:\PROGRA~2\Symantec\Definitions\SymcData\idsdefs\20061025.029\VIRSCAN1.DAT
C:\PROGRA~2\Symantec\Definitions\SymcData\idsdefs\20061025.029\zdone.dat
C:\PROGRA~2\Symantec\Definitions\SymcData\idsdefs\BinHub\catalog.dat
C:\PROGRA~2\Symantec\Definitions\SymcData\idsdefs\BinHub\ids9xx86.dll
C:\PROGRA~2\Symantec\Definitions\SymcData\idsdefs\BinHub\IDSVix86.CAT
C:\PROGRA~2\Symantec\Definitions\SymcData\idsdefs\BinHub\IDSVix86.INF
C:\PROGRA~2\Symantec\Definitions\SymcData\idsdefs\BinHub\IDSvix86.sys
C:\PROGRA~2\Symantec\Definitions\SymcData\idsdefs\BinHub\idsxpx86.dll
C:\PROGRA~2\Symantec\Definitions\SymcData\idsdefs\BinHub\metadata.dat
C:\PROGRA~2\Symantec\Definitions\SymcData\idsdefs\BinHub\sigs.dat
C:\PROGRA~2\Symantec\Definitions\SymcData\idsdefs\BinHub\symidsco.sys
C:\PROGRA~2\Symantec\Definitions\SymcData\idsdefs\BinHub\symidsco.vxd
C:\PROGRA~2\Symantec\Definitions\SymcData\idsdefs\BinHub\SymIDSI.dll
C:\PROGRA~2\Symantec\Definitions\SymcData\idsdefs\BinHub\v.grd
C:\PROGRA~2\Symantec\Definitions\SymcData\idsdefs\BinHub\v.sig
C:\PROGRA~2\Symantec\Definitions\SymcData\idsdefs\BinHub\virscan1.dat
C:\PROGRA~2\Symantec\Definitions\SymcData\idsdefs\BinHub\zdone.dat
C:\PROGRA~2\Symantec\Definitions\SymcData\idsdefs\definfo.dat
C:\PROGRA~2\Symantec\Definitions\SymcData\idsdefs\usage.dat
C:\PROGRA~2\Symantec\Definitions\SymcData\nco1.0defs\20061024.001\Catalog.dat
C:\PROGRA~2\Symantec\Definitions\SymcData\nco1.0defs\20061024.001\full-webauth.sql.bin
C:\PROGRA~2\Symantec\Definitions\SymcData\nco1.0defs\20061024.001\hub.scr
C:\PROGRA~2\Symantec\Definitions\SymcData\nco1.0defs\20061024.001\Identifiers.xml.bin
C:\PROGRA~2\Symantec\Definitions\SymcData\nco1.0defs\20061024.001\Indicators.xml.bin
C:\PROGRA~2\Symantec\Definitions\SymcData\nco1.0defs\20061024.001\PopularSites.xml.bin
C:\PROGRA~2\Symantec\Definitions\SymcData\nco1.0defs\20061024.001\Redirectors.xml.bin
C:\PROGRA~2\Symantec\Definitions\SymcData\nco1.0defs\20061024.001\Resources.xml.bin
C:\PROGRA~2\Symantec\Definitions\SymcData\nco1.0defs\20061024.001\SafeList.xml.bin
C:\PROGRA~2\Symantec\Definitions\SymcData\nco1.0defs\20061024.001\SearchServices.xml.bin
C:\PROGRA~2\Symantec\Definitions\SymcData\nco1.0defs\20061024.001\Throttle.xml.bin
C:\PROGRA~2\Symantec\Definitions\SymcData\nco1.0defs\20061024.001\TrustedDomains.xml.bin
C:\PROGRA~2\Symantec\Definitions\SymcData\nco1.0defs\20061024.001\URLAnalysis.xml.bin
C:\PROGRA~2\Symantec\Definitions\SymcData\nco1.0defs\20061024.001\v.grd
C:\PROGRA~2\Symantec\Definitions\SymcData\nco1.0defs\20061024.001\v.sig
C:\PROGRA~2\Symantec\Definitions\SymcData\nco1.0defs\20061024.001\virscan1.dat
C:\PROGRA~2\Symantec\Definitions\SymcData\nco1.0defs\20061024.001\WebHostingSites.xml.bin
C:\PROGRA~2\Symantec\Definitions\SymcData\nco1.0defs\BinHub\catalog.dat
C:\PROGRA~2\Symantec\Definitions\SymcData\nco1.0defs\BinHub\Identifiers.xml.bin
C:\PROGRA~2\Symantec\Definitions\SymcData\nco1.0defs\BinHub\Indicators.xml.bin
C:\PROGRA~2\Symantec\Definitions\SymcData\nco1.0defs\BinHub\PopularSites.xml.bin
C:\PROGRA~2\Symantec\Definitions\SymcData\nco1.0defs\BinHub\Redirectors.xml.bin
C:\PROGRA~2\Symantec\Definitions\SymcData\nco1.0defs\BinHub\Resources.xml.bin
C:\PROGRA~2\Symantec\Definitions\SymcData\nco1.0defs\BinHub\SafeList.xml.bin
C:\PROGRA~2\Symantec\Definitions\SymcData\nco1.0defs\BinHub\SearchServices.xml.bin
C:\PROGRA~2\Symantec\Definitions\SymcData\nco1.0defs\BinHub\Throttle.xml.bin
C:\PROGRA~2\Symantec\Definitions\SymcData\nco1.0defs\BinHub\TrustedDomains.xml.bin
C:\PROGRA~2\Symantec\Definitions\SymcData\nco1.0defs\BinHub\URLAnalysis.xml.bin
C:\PROGRA~2\Symantec\Definitions\SymcData\nco1.0defs\BinHub\v.grd
C:\PROGRA~2\Symantec\Definitions\SymcData\nco1.0defs\BinHub\v.sig
C:\PROGRA~2\Symantec\Definitions\SymcData\nco1.0defs\BinHub\virscan1.dat
C:\PROGRA~2\Symantec\Definitions\SymcData\nco1.0defs\BinHub\WebHostingSites.xml.bin
C:\PROGRA~2\Symantec\Definitions\SymcData\nco1.0defs\definfo.dat
C:\PROGRA~2\Symantec\Definitions\SymcData\nco1.0defs\latest-hub-webauth.sql.bin
C:\PROGRA~2\Symantec\Definitions\SymcData\nco1.0defs\usage.dat
C:\PROGRA~2\Symantec\Definitions\VirusDefs\20061106.064\CATALOG.DAT
C:\PROGRA~2\Symantec\Definitions\VirusDefs\20061106.064\CCERASER.DLL
C:\PROGRA~2\Symantec\Definitions\VirusDefs\20061106.064\ECBOOTIL.VXD
C:\PROGRA~2\Symantec\Definitions\VirusDefs\20061106.064\ECMSVR32.DLL
C:\PROGRA~2\Symantec\Definitions\VirusDefs\20061106.064\EECTRL.SYS
C:\PROGRA~2\Symantec\Definitions\VirusDefs\20061106.064\ERASER.GRD
C:\PROGRA~2\Symantec\Definitions\VirusDefs\20061106.064\ERASER.SIG
C:\PROGRA~2\Symantec\Definitions\VirusDefs\20061106.064\ERASER.SPM
C:\PROGRA~2\Symantec\Definitions\VirusDefs\20061106.064\ERASER.SYS
C:\PROGRA~2\Symantec\Definitions\VirusDefs\20061106.064\ESRDEF.BIN
C:\PROGRA~2\Symantec\Definitions\VirusDefs\20061106.064\HH
C:\PROGRA~2\Symantec\Definitions\VirusDefs\20061106.064\NAVENG.EXP
C:\PROGRA~2\Symantec\Definitions\VirusDefs\20061106.064\NAVENG.SYS
C:\PROGRA~2\Symantec\Definitions\VirusDefs\20061106.064\NAVENG.VXD
C:\PROGRA~2\Symantec\Definitions\VirusDefs\20061106.064\NAVENG32.DLL
C:\PROGRA~2\Symantec\Definitions\VirusDefs\20061106.064\NAVEX15.EXP
C:\PROGRA~2\Symantec\Definitions\VirusDefs\20061106.064\NAVEX15.SYS
C:\PROGRA~2\Symantec\Definitions\VirusDefs\20061106.064\NAVEX15.VXD
C:\PROGRA~2\Symantec\Definitions\VirusDefs\20061106.064\NAVEX32A.DLL
C:\PROGRA~2\Symantec\Definitions\VirusDefs\20061106.064\NCSACERT.TXT
C:\PROGRA~2\Symantec\Definitions\VirusDefs\20061106.064\SCRAUTH.DAT
C:\PROGRA~2\Symantec\Definitions\VirusDefs\20061106.064\SYMAVENG.CAT
C:\PROGRA~2\Symantec\Definitions\VirusDefs\20061106.064\SYMAVENG.INF
C:\PROGRA~2\Symantec\Definitions\VirusDefs\20061106.064\SYMERASE.CAT
C:\PROGRA~2\Symantec\Definitions\VirusDefs\20061106.064\SYMERASE.INF
C:\PROGRA~2\Symantec\Definitions\VirusDefs\20061106.064\TCDEFS.DAT
C:\PROGRA~2\Symantec\Definitions\VirusDefs\20061106.064\TCSCAN7.DAT
C:\PROGRA~2\Symantec\Definitions\VirusDefs\20061106.064\TCSCAN8.DAT
C:\PROGRA~2\Symantec\Definitions\VirusDefs\20061106.064\TCSCAN9.DAT
C:\PROGRA~2\Symantec\Definitions\VirusDefs\20061106.064\TECHNOTE.TXT
C:\PROGRA~2\Symantec\Definitions\VirusDefs\20061106.064\TINF.DAT
C:\PROGRA~2\Symantec\Definitions\VirusDefs\20061106.064\TINFIDX.DAT
C:\PROGRA~2\Symantec\Definitions\VirusDefs\20061106.064\TINFL.DAT
C:\PROGRA~2\Symantec\Definitions\VirusDefs\20061106.064\TSCAN1.DAT
C:\PROGRA~2\Symantec\Definitions\VirusDefs\20061106.064\TSCAN1HD.DAT
C:\PROGRA~2\Symantec\Definitions\VirusDefs\20061106.064\V.GRD
C:\PROGRA~2\Symantec\Definitions\VirusDefs\20061106.064\V.SIG
C:\PROGRA~2\Symantec\Definitions\VirusDefs\20061106.064\VIRSCAN.INF
C:\PROGRA~2\Symantec\Definitions\VirusDefs\20061106.064\VIRSCAN1.DAT
C:\PROGRA~2\Symantec\Definitions\VirusDefs\20061106.064\VIRSCAN2.DAT
C:\PROGRA~2\Symantec\Definitions\VirusDefs\20061106.064\VIRSCAN3.DAT
C:\PROGRA~2\Symantec\Definitions\VirusDefs\20061106.064\VIRSCAN4.DAT
C:\PROGRA~2\Symantec\Definitions\VirusDefs\20061106.064\VIRSCAN5.DAT
C:\PROGRA~2\Symantec\Definitions\VirusDefs\20061106.064\VIRSCAN6.DAT
C:\PROGRA~2\Symantec\Definitions\VirusDefs\20061106.064\VIRSCAN7.DAT
C:\PROGRA~2\Symantec\Definitions\VirusDefs\20061106.064\VIRSCAN8.DAT
C:\PROGRA~2\Symantec\Definitions\VirusDefs\20061106.064\VIRSCAN9.DAT
C:\PROGRA~2\Symantec\Definitions\VirusDefs\20061106.064\VIRSCANT.DAT
C:\PROGRA~2\Symantec\Definitions\VirusDefs\20061106.064\WHATSNEW.TXT
C:\PROGRA~2\Symantec\Definitions\VirusDefs\20061106.064\ZDONE.DAT
C:\PROGRA~2\Symantec\Definitions\VirusDefs\BinHub\catalog.dat
C:\PROGRA~2\Symantec\Definitions\VirusDefs\BinHub\cceraser.dll
C:\PROGRA~2\Symantec\Definitions\VirusDefs\BinHub\ecmsvr32.dll
C:\PROGRA~2\Symantec\Definitions\VirusDefs\BinHub\eeCtrl.sys
C:\PROGRA~2\Symantec\Definitions\VirusDefs\BinHub\ERASER.grd
C:\PROGRA~2\Symantec\Definitions\VirusDefs\BinHub\ERASER.sig
C:\PROGRA~2\Symantec\Definitions\VirusDefs\BinHub\ERASER.spm
C:\PROGRA~2\Symantec\Definitions\VirusDefs\BinHub\ERASER.sys
C:\PROGRA~2\Symantec\Definitions\VirusDefs\BinHub\esrdef.bin
C:\PROGRA~2\Symantec\Definitions\VirusDefs\BinHub\hh
C:\PROGRA~2\Symantec\Definitions\VirusDefs\BinHub\naveng.sys
C:\PROGRA~2\Symantec\Definitions\VirusDefs\BinHub\naveng32.dll
C:\PROGRA~2\Symantec\Definitions\VirusDefs\BinHub\navex15.sys
C:\PROGRA~2\Symantec\Definitions\VirusDefs\BinHub\navex32a.dll
C:\PROGRA~2\Symantec\Definitions\VirusDefs\BinHub\ncsacert.txt
C:\PROGRA~2\Symantec\Definitions\VirusDefs\BinHub\scrauth.dat
C:\PROGRA~2\Symantec\Definitions\VirusDefs\BinHub\symaveng.cat
C:\PROGRA~2\Symantec\Definitions\VirusDefs\BinHub\symaveng.inf
C:\PROGRA~2\Symantec\Definitions\VirusDefs\BinHub\SymErase.cat
C:\PROGRA~2\Symantec\Definitions\VirusDefs\BinHub\SymErase.inf
C:\PROGRA~2\Symantec\Definitions\VirusDefs\BinHub\tcdefs.dat
C:\PROGRA~2\Symantec\Definitions\VirusDefs\BinHub\tcscan7.dat
C:\PROGRA~2\Symantec\Definitions\VirusDefs\BinHub\tcscan8.dat
C:\PROGRA~2\Symantec\Definitions\VirusDefs\BinHub\tcscan9.dat
C:\PROGRA~2\Symantec\Definitions\VirusDefs\BinHub\technote.txt
C:\PROGRA~2\Symantec\Definitions\VirusDefs\BinHub\tinf.dat
C:\PROGRA~2\Symantec\Definitions\VirusDefs\BinHub\tinfidx.dat
C:\PROGRA~2\Symantec\Definitions\VirusDefs\BinHub\tinfl.dat
C:\PROGRA~2\Symantec\Definitions\VirusDefs\BinHub\tscan1.dat
C:\PROGRA~2\Symantec\Definitions\VirusDefs\BinHub\tscan1hd.dat
C:\PROGRA~2\Symantec\Definitions\VirusDefs\BinHub\v.grd
C:\PROGRA~2\Symantec\Definitions\VirusDefs\BinHub\v.sig
C:\PROGRA~2\Symantec\Definitions\VirusDefs\BinHub\virscan.inf
C:\PROGRA~2\Symantec\Definitions\VirusDefs\BinHub\virscan1.dat
C:\PROGRA~2\Symantec\Definitions\VirusDefs\BinHub\virscan2.dat
C:\PROGRA~2\Symantec\Definitions\VirusDefs\BinHub\virscan3.dat
C:\PROGRA~2\Symantec\Definitions\VirusDefs\BinHub\virscan4.dat
C:\PROGRA~2\Symantec\Definitions\VirusDefs\BinHub\virscan5.dat
C:\PROGRA~2\Symantec\Definitions\VirusDefs\BinHub\virscan6.dat
C:\PROGRA~2\Symantec\Definitions\VirusDefs\BinHub\virscan7.dat
C:\PROGRA~2\Symantec\Definitions\VirusDefs\BinHub\virscan8.dat
C:\PROGRA~2\Symantec\Definitions\VirusDefs\BinHub\virscan9.dat
C:\PROGRA~2\Symantec\Definitions\VirusDefs\BinHub\whatsnew.txt
C:\PROGRA~2\Symantec\Definitions\VirusDefs\BinHub\zdone.dat
C:\PROGRA~2\Symantec\Definitions\VirusDefs\definfo.dat
C:\PROGRA~2\Symantec\Definitions\VirusDefs\TextHub\virscant.dat
C:\PROGRA~2\Symantec\Definitions\VirusDefs\usage.dat
C:\PROGRA~2\Symantec\IDS\IDSSettg.BAK
C:\PROGRA~2\Symantec\IDS\IDSSettg.dat
C:\PROGRA~2\Symantec\LiveUpdate\1.Product.Inventory.LiveUpdate
C:\PROGRA~2\Symantec\LiveUpdate\1.Settings.LiveUpdate
C:\PROGRA~2\Symantec\LiveUpdate\10.Product.Inventory.LiveUpdate
C:\PROGRA~2\Symantec\LiveUpdate\10.Settings.LiveUpdate
C:\PROGRA~2\Symantec\LiveUpdate\2.Product.Inventory.LiveUpdate
C:\PROGRA~2\Symantec\LiveUpdate\2.Settings.LiveUpdate
C:\PROGRA~2\Symantec\LiveUpdate\2008-07-31_Log.ALUSchedulerSvc.LiveUpdate
C:\PROGRA~2\Symantec\LiveUpdate\2008-08-01_Log.ALUSchedulerSvc.LiveUpdate
C:\PROGRA~2\Symantec\LiveUpdate\2008-08-02_Log.ALUSchedulerSvc.LiveUpdate
C:\PROGRA~2\Symantec\LiveUpdate\2008-08-03_Log.ALUSchedulerSvc.LiveUpdate
C:\PROGRA~2\Symantec\LiveUpdate\2008-08-04_Log.ALUSchedulerSvc.LiveUpdate
C:\PROGRA~2\Symantec\LiveUpdate\2008-08-05_Log.ALUSchedulerSvc.LiveUpdate
C:\PROGRA~2\Symantec\LiveUpdate\2008-08-06_Log.ALUSchedulerSvc.LiveUpdate
C:\PROGRA~2\Symantec\LiveUpdate\2008-08-07_Log.ALUSchedulerSvc.LiveUpdate
C:\PROGRA~2\Symantec\LiveUpdate\2008-08-08_Log.ALUSchedulerSvc.LiveUpdate
C:\PROGRA~2\Symantec\LiveUpdate\2008-08-09_Log.ALUSchedulerSvc.LiveUpdate
C:\PROGRA~2\Symantec\LiveUpdate\2008-08-10_Log.ALUSchedulerSvc.LiveUpdate
C:\PROGRA~2\Symantec\LiveUpdate\2008-08-11_Log.ALUSchedulerSvc.LiveUpdate
C:\PROGRA~2\Symantec\LiveUpdate\2008-08-12_Log.ALUSchedulerSvc.LiveUpdate
C:\PROGRA~2\Symantec\LiveUpdate\2008-08-13_Log.ALUSchedulerSvc.LiveUpdate
C:\PROGRA~2\Symantec\LiveUpdate\3.Product.Inventory.LiveUpdate
C:\PROGRA~2\Symantec\LiveUpdate\3.Settings.LiveUpdate
C:\PROGRA~2\Symantec\LiveUpdate\4.Product.Inventory.LiveUpdate
C:\PROGRA~2\Symantec\LiveUpdate\4.Settings.LiveUpdate
C:\PROGRA~2\Symantec\LiveUpdate\5.Product.Inventory.LiveUpdate
C:\PROGRA~2\Symantec\LiveUpdate\5.Settings.LiveUpdate
C:\PROGRA~2\Symantec\LiveUpdate\6.Product.Inventory.LiveUpdate
C:\PROGRA~2\Symantec\LiveUpdate\6.Settings.LiveUpdate
C:\PROGRA~2\Symantec\LiveUpdate\7.Product.Inventory.LiveUpdate
C:\PROGRA~2\Symantec\LiveUpdate\7.Settings.LiveUpdate
C:\PROGRA~2\Symantec\LiveUpdate\8.Product.Inventory.LiveUpdate
C:\PROGRA~2\Symantec\LiveUpdate\8.Settings.LiveUpdate
C:\PROGRA~2\Symantec\LiveUpdate\9.Product.Inventory.LiveUpdate
C:\PROGRA~2\Symantec\LiveUpdate\9.Settings.LiveUpdate
C:\PROGRA~2\Symantec\LiveUpdate\Configuration.Log.LiveUpdate
C:\PROGRA~2\Symantec\LiveUpdate\Log.LiveUpdate
C:\PROGRA~2\Symantec\LiveUpdate\LUInstall.LiveUpdate
C:\PROGRA~2\Symantec\LiveUpdate\Product.Inventory.LiveUpdate
C:\PROGRA~2\Symantec\LiveUpdate\Settings.LiveUpdate
C:\PROGRA~2\Symantec\Norton AntiVirus\alert.dat
C:\PROGRA~2\Symantec\Norton AntiVirus\Tasks\drives.sca
C:\PROGRA~2\Symantec\Norton AntiVirus\Tasks\files.sca
C:\PROGRA~2\Symantec\Norton AntiVirus\Tasks\floppy.sca
C:\PROGRA~2\Symantec\Norton AntiVirus\Tasks\folders.sca
C:\PROGRA~2\Symantec\Norton AntiVirus\Tasks\mycomp.sca
C:\PROGRA~2\Symantec\Norton AntiVirus\Tasks\quick.sca
C:\PROGRA~2\Symantec\Norton AntiVirus\Tasks\rem.sca
C:\PROGRA~2\Symantec\SPBBC\BBConfig.log
C:\PROGRA~2\Symantec\SPBBC\BBDebug.log
C:\PROGRA~2\Symantec\SPBBC\BBDetect.log
C:\PROGRA~2\Symantec\SPBBC\BBNotify.log
C:\PROGRA~2\Symantec\SPBBC\BBRefr.log
C:\PROGRA~2\Symantec\SPBBC\BBSetCfg.log
C:\PROGRA~2\Symantec\SPBBC\BBSetCfg2.log
C:\PROGRA~2\Symantec\SPBBC\BBSetDev.log
C:\PROGRA~2\Symantec\SPBBC\BBSetLoc.log
C:\PROGRA~2\Symantec\SPBBC\BBSetUsr.log
C:\PROGRA~2\Symantec\SPBBC\BBStHash.log
C:\PROGRA~2\Symantec\SPBBC\BBValid.log
C:\PROGRA~2\Symantec\SPBBC\SPPolicy.log
C:\PROGRA~2\Symantec\SPBBC\SPStart.log
C:\PROGRA~2\Symantec\SPBBC\SPStop.log
C:\PROGRA~2\Symantec\SRTSP\SrtErEvt.log
C:\PROGRA~2\Symantec\SRTSP\SrtETmp\BF144D6E.TMP
C:\PROGRA~2\Symantec\SRTSP\SrtMoEvt.log
C:\PROGRA~2\Symantec\SRTSP\SrtNvEvt.log
C:\PROGRA~2\Symantec\SRTSP\SrtScEvt.log
C:\PROGRA~2\Symantec\SRTSP\SRTSPSE.DAT
C:\PROGRA~2\Symantec\SRTSP\SRTSPSO.DAT
C:\PROGRA~2\Symantec\SRTSP\SRTSPSP.DAT
C:\PROGRA~2\Symantec\SRTSP\SrtTxFEvt.log
C:\PROGRA~2\Symantec\SRTSP\SrtViEvt.log
C:\PROGRA~2\Symantec\SubEng\SCD.xml
C:\PROGRA~2\Symantec\SubEng\submissions.idx
C:\PROGRA~2\Symantec\SyKnAppS\patch25.dll
C:\PROGRA~2\Symantec\SyKnAppS\SyKnAppS.dll
C:\PROGRA~2\Symantec\SymNetDrv\Default.rul
C:\PROGRA~2\Symantec\SymNetDrv\Firewall.BAK
C:\PROGRA~2\Symantec\SymNetDrv\Firewall.rul
C:\PROGRA~2\Symantec\SymNetDrv\LocationMap.dat
C:\PROGRA~2\Symantec\SymNetDrv\Persist.BAK
C:\PROGRA~2\Symantec\SymNetDrv\Persist.Dat
C:\PROGRA~2\Symantec\SymNetDrv\TModule.Dat
C:\PROGRA~2\Symantec\SymNetDrv\TParent.Dat

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_IDSvix86


((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-07-15 to 2008-08-15 ))))))))))))))))))))))))))))))))))))
.

Pas de nouveau fichier cr‚‚ dans cet espace de temps

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-15 12:03 --------- d-----w C:\ProgramData\Avira
2008-08-15 12:03 --------- d-----w C:\Program Files\Avira
2008-08-13 10:11 --------- d-----w C:\ProgramData\Microsoft Help
2008-08-06 12:59 --------- d-----w C:\Users\pipo\AppData\Roaming\Malwarebytes
2008-08-06 12:59 --------- d-----w C:\ProgramData\Malwarebytes
2008-08-06 12:59 --------- d-----w C:\Program Files\Malwarebytes' Anti-Malware
2008-08-05 06:43 --------- d-----w C:\Program Files\Trend Micro
2008-08-05 06:19 --------- d-----w C:\Program Files\CCleaner
2008-07-30 18:07 38,472 ----a-w C:\Windows\system32\drivers\mbamswissarmy.sys
2008-07-30 18:07 17,144 ----a-w C:\Windows\system32\drivers\mbam.sys
2008-07-24 09:06 --------- d-----w C:\Program Files\Java
2008-07-24 09:04 --------- d-----w C:\Program Files\Common Files\Java
2008-07-10 17:09 174 --sha-w C:\Program Files\desktop.ini
2008-06-27 03:54 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-02-07 13:04 210 ----a-w C:\Users\pipo\AppData\Roaming\wklnhst.dat
2008-03-28 11:02 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2008-03-28 11:02 32,768 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2008-03-28 11:02 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
.

((((((((((((((((((((((((((((( snapshot@2008-08-15_17.13.46.08 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-10-20 18:02:28 163,328 ----a-w C:\Windows\erdnt\subs\ERDNT.EXE
- 2008-08-15 11:13:11 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2008-08-15 18:15:19 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2008-08-15 11:13:11 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2008-08-15 18:15:19 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2008-08-15 11:15:21 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-08-15 18:18:06 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-08-15 18:18:06 262,144 ---ha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat.LOG1
- 2008-08-15 11:15:16 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-08-15 18:18:06 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-08-15 18:18:06 262,144 ---ha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1
- 2008-08-15 15:03:33 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-08-15 18:17:13 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-08-15 15:03:33 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-08-15 18:17:13 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-08-15 15:03:33 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-08-15 18:17:13 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-08-15 11:15:45 7,476 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1932049473-3059525851-3175685927-1000_UserData.bin
+ 2008-08-15 18:20:08 7,602 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1932049473-3059525851-3175685927-1000_UserData.bin
- 2008-08-15 11:15:45 65,858 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-08-15 18:20:05 66,590 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
- 2008-08-15 11:15:39 52,106 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2008-08-15 17:55:19 52,870 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-09 18:32 1232896]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 14:35 125440]
"WindowsWelcomeCenter"="oobefldr.dll" [2006-11-02 14:34 2159104 C:\Windows\System32\oobefldr.dll]
"Acer Tour Reminder"="" [BU]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-10-23 05:00 815104]
"eDataSecurity Loader"="C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-02-07 00:04 464168]
"BisonInst0402"="C:\Windows\BR040286.exe" [2007-05-08 23:19 69632]
"LManager"="C:\PROGRA~1\LAUNCH~1\LManager.exe" [2006-12-08 10:24 614400]
"eDSMSNfix"="C:\Acer\Empowering Technology\eDSMSNfix.exe" [2007-02-08 19:40 13312]
"Acer Tour Reminder"="C:\Acer\AcerTour\Reminder.exe" [2007-01-17 09:01 151552]
"WarReg_PopUp"="C:\Acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 21:48 57344]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 07:00 33648]
"SystrayORAHSS"="C:\Program Files\Orange\Systray\SystrayApp.exe" [2007-09-25 20:08 94208]
"ORAHSSSessionManager"="C:\Program Files\Orange\SessionManager\SessionManager.exe" [2007-09-25 19:10 102400]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"MSConfig"="C:\Windows\system32\msconfig.exe" [2006-11-02 11:45 222208]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 14:28 266497]
"RtHDVCpl"="RtHDVCpl.exe" [2006-12-01 07:37 4186112 C:\Windows\RtHDVCpl.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35 90112]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Empowering Technology Launcher.lnk - C:\Acer\Empowering Technology\eAPLauncher.exe [2007-04-05 02:28:04 528384]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=eNetHook.dll

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\Windows\pss\Adobe Reader Speed Launch.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^Users^pipo^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 - Capture d'écran et lancement.lnk]
path=C:\Users\pipo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 - Capture d'écran et lancement.lnk
backup=C:\Windows\pss\OneNote 2007 - Capture d'écran et lancement.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
--a------ 2006-09-26 02:52 50736 C:\Program Files\Common Files\aol\1193534802\ee\aolsoftware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{BA099FE1-BF14-4B80-AE27-C519C3039686}"= UDP:C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\MCE Deluxe Suite.exe:CyberLink MCE Deluxe Suite
"{EF48618E-9856-413E-81F5-4C496E1F3F24}"= TCP:C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\MCE Deluxe Suite.exe:CyberLink MCE Deluxe Suite
"{90D82672-37F5-40A4-BC66-D707E1C779E8}"= UDP:C:\Program Files\Common Files\aol\acs\AOLDial.exe:AOL Autoconnect
"{8B3BAB1E-DB3A-4A60-8991-17B08A4E6B91}"= TCP:C:\Program Files\Common Files\aol\acs\AOLDial.exe:AOL Autoconnect
"{B78E130B-72D1-44DC-BAFE-1273DE1718F2}"= UDP:C:\Program Files\Common Files\aol\acs\AOLacsd.exe:module de connexion AOL
"{C67D83F9-203E-4DB9-86FB-7813189982FD}"= TCP:C:\Program Files\Common Files\aol\acs\AOLacsd.exe:module de connexion AOL
"{515993C6-E21C-48BF-8BB1-95FF4EB60377}"= UDP:C:\Program Files\Common Files\aol\1193534802\ee\aolsoftware.exe:AOL Shared Components
"{98A5CAFD-B003-49F5-A286-F5CD7446F3FD}"= TCP:C:\Program Files\Common Files\aol\1193534802\ee\aolsoftware.exe:AOL Shared Components
"{97783C35-CD5C-4FD3-9063-D03B35D1D0DF}"= UDP:C:\Program Files\AOL 9.0 VR\waol.exe:AOL
"{0FCD8F41-1124-4224-95D1-0D152F41289F}"= TCP:C:\Program Files\AOL 9.0 VR\waol.exe:AOL
"{EF7DF836-DC91-4A05-9A5C-E3EC01F394D2}"= UDP:C:\Program Files\Common Files\aol\TopSpeed\3.0\aoltpsd3.exe:AOL TopSpeed
"{FF20FA2A-3CA2-4E0B-9065-E768C71E6ADA}"= TCP:C:\Program Files\Common Files\aol\TopSpeed\3.0\aoltpsd3.exe:AOL TopSpeed
"{4833793C-73B1-4336-92AF-C6395799DD36}"= UDP:C:\Program Files\Common Files\aol\Loader\aolload.exe:AOL Loader
"{487C6A2A-913D-4D2B-BFC2-B4DA2BC7EDE3}"= TCP:C:\Program Files\Common Files\aol\Loader\aolload.exe:AOL Loader
"{61A887BC-BC67-40F0-8895-B7ABC6B51651}"= UDP:C:\Program Files\Common Files\aol\System Information\sinf.exe:AOL System Information
"{FB5CB196-F538-4E20-B0AD-3D5DE59D9D01}"= TCP:C:\Program Files\Common Files\aol\System Information\sinf.exe:AOL System Information
"{CE1F1A6E-43F2-41EC-A723-2DAFB673A380}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{FDF44FDF-EC83-4115-9F31-7A0AC2F2D75F}"= UDP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{A44924CF-0080-49B7-A6EF-C6D93A141624}"= TCP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{AC421A67-8DA9-4594-B108-93D1BCC67C1E}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{E59840BC-9246-4FB6-9D9C-C25044A1CAF2}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{294EF351-DEF5-43D0-BE70-A8478C61578F}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"C:\\Program Files\\Orange\\Connectivity\\ConnectivityManager.exe"= C:\Program Files\Orange\Connectivity\ConnectivityManager.exe:*:enabled:CSS

R2 ALaunchService;ALaunch Service;C:\Acer\ALaunch\ALaunchSvc.exe [2007-01-26 14:24]
R3 atikmdag;atikmdag;C:\Windows\system32\DRIVERS\atikmdag.sys [2007-04-06 00:36]
S3 PCAMp50;PCAMp50 NDIS Protocol Driver;C:\Windows\system32\Drivers\PCAMp50.sys [2006-11-28 21:46]
S3 PCASp50;PCASp50 NDIS Protocol Driver;C:\Windows\system32\Drivers\PCASp50.sys [2006-11-28 21:46]
S3 SMSCIRDA;SMSC Infrared Device Driver;C:\Windows\system32\DRIVERS\SMSCirda.sys [2006-10-18 09:44]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cc1c0ec0-cf21-11dc-a897-00038a000015}]
\shell\AutoRun\command - G:\LaunchU3.exe

*Newly Created Service* - COMHOST
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-15 20:18:16
Windows 6.0.6000 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Windows\System32\Ati2evxx.exe
C:\Windows\System32\audiodg.exe
C:\Windows\System32\Ati2evxx.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\aol\acs\AOLacsd.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
C:\Acer\Empowering Technology\eNet\eNet Service.exe
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\[u]0/u\FTRTSVC.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Acer\Mobility Center\MobilityService.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Windows\System32\drivers\XAudio.exe
C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
C:\Windows\System32\wbem\unsecapp.exe
C:\Windows\System32\conime.exe
C:\Program Files\Launch Manager\LManager.exe
C:\Windows\ehome\ehmsas.exe
C:\Acer\Empowering Technology\eNet\eNMTray.exe
C:\Program Files\Orange\Launcher\Launcher.exe
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\AlertModule\[u]0/u\AlertModule.exe
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Acer\Empowering Technology\Acer.Empowering.Framework.Supervisor.exe
C:\Windows\System32\msiexec.exe
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-08-15 20:25:46 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-15 18:25:32
ComboFix2.txt 2008-08-15 15:14:21

Pre-Run: Le texte du message associé au numéro 0x2379 est introuvable dans le fichier de messages pour Application.
Post-Run: 30,102,274,048 octets libres

454 --- E O F --- 2008-08-13 10:12:03

Oui on dirait pour norton, tant mieux :) Du coup j'peux virer l'icone qui est sur le bureau ?

Merci pour tout :) Les rapports sont bons il va bien ?

Ca va beaucoup mieux (je retrouve le haut débit et ça fait du bien lol), pareil ca m'avait buggé le Office y'a quelques jours mais ça refonctionne, est-ce que j'peux abuser avec une ou deux questions ?

J'édite, j'ai compris ToolsCleaner ne fonctionnait pas comme Hijackthis buggait, fallait les executer en tant qu'administrateur... Voici le nouveau rapport, je file désactiver/activer ma restau system ;)

Merci pour les questions, j'en ai quelques unes en tête, je les pose dès qu'on en a fini pour de bon avec ces manips là ;)

-->- Recherche:

C:\Qoobox: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programmes\HijackThis: trouvé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis: trouvé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis\HijackThis.lnk: trouvé !
C:\Users\All Users\Microsoft\Windows\Start Menu\Programmes\HijackThis: trouvé !
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\HijackThis: trouvé !
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\HijackThis\HijackThis.lnk: trouvé !
C:\Users\pipo\Desktop\ComboFix.exe: trouvé !
C:\Windows\Gmer.exe: trouvé !

---------------------------------
-->- Suppression:

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis\HijackThis.lnk: supprimé !
C:\Users\pipo\Desktop\ComboFix.exe: Erreur de suppression !
C:\Windows\Gmer.exe: Erreur de suppression !
C:\Qoobox: supprimé !
C:\Program Files\Trend Micro\HijackThis: supprimé !
C:\ProgramData\Microsoft\Windows\Start Menu\Programmes\HijackThis: Erreur de suppression !
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis: supprimé !

Merci, j'ai édité en fait message 46 j'ai trouvé d'où ça venait ;)