[Résolu] Problème de pub ^^

Bonjour,

Il ne faut pas désinstaller IE, important, pour les mises à jour Windows par exemple.

Télécharge Hijackthis (de Trend Micro) sur ton Bureau.

Double clique sur HJTInstall.exe pour lancer l'installation.

Clique sur Install.

Double clique sur le raccourci d'HijackThis qui vient d'être créé pour le lancer. (Clique droit -> lancer en tant qu'admin si sous Vista)

Accepte la licence en cliquant sur Yes.

Clique sur "Do a system scan and save a logfile".

Poste ici[ le rapport généré.

Note : Le rapport se trouve également ici : C:\Program Files\Trend Micro\Hijackthis\Hijackthis.log

Aide : Comment utiliser HijackThis.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:11:06, on 15/06/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16681)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Ares\Ares.exe
C:\Users\michel\Desktop\Clavier\Clavier.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://fr.fr.acer.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.fr.acer.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ycomp/defaults/su/*http://fr.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [mfcd chic] "C:\ProgramData\RDR GPL GPL.j07hn"
O4 - HKCU\..\Run: [LESS CITY AMEN SETUP] "C:\ProgramData\Move mix enc.wc6kf"
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [Clavier+] C:\Users\michel\Desktop\Clavier\Clavier.exe
O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\michel\AppData\Local\Temp\byXQIAtT.dll,#1
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\michel\AppData\Local\Temp\mLeBSiIC.dll,c
O4 - HKCU\..\Run: [2826c118] rundll32.exe "C:\Users\michel\AppData\Local\Temp\tiyjvbef.dll",b
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [] (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [] (User 'Default user')
O4 - Startup: BOINC Manager.lnk = C:\Program Files\BOINC\boincmgr.exe
O4 - Startup: OneNote 2007 - Capture d'écran et lancement.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Empowering Technology Launcher.lnk = ?
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/fl...
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: ePerformance Service (AcerMemUsageCheckService) - Unknown owner - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Acer\Empowering Technology\eMode\PCM\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Acer\Empowering Technology\eMode\PCM\Kernel\TV\CLSched.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Validation de mot de passe Symantec IS (ISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Olivetti Monitor Service (olMntrService) - Olivetti - C:\Program Files\Olivetti\ANY_WAY\olMntrService.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\Windows\system32\PSIService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared files\RichVideo.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

--
End of file - 10161 bytes

Re,

Télécharge Lop S&D.exe (d’ Eric 71 & Angeldark) sur ton bureau.

Double-clique dessus pour lancer l'installation

Puis double-clique sur le raccourci Lop S&D présent sur ton bureau (Si tu es sous Vista, clique droit -> exécuter en tant qu'admin)

Séléctionne la langue souhaitée , puis choisis l'Option 1 (Recherche)

Patiente jusqu'à la fin du scan

Poste le rapport généré (C:\lopR.txt)

Si ton bureau ne réapparait pas, fais CTRL+ALT+SUPP pour ouvrir le gestionnaire de tâches.
Puis rends-toi à l'onglet "processus". Clique en haut à gauche sur fichiers et choisis "Nouvelle tâche (exécuter)"
Tapes explorer et valide. Cela te fera apparaitre ton bureau

-----------------------[ Lop S&D 4.2.1-4 XP/Vista ]---------------------

[ Windows 'Longhorn' (NT 6.0) Workstation Build 6000 ]
[ USER : michel ] [ "C:\Lop SD" ] [ Selection : 1 ]
[ 15/06/2008 | 15:19:58,06 ] [ PC : PC-DE-MICHEL ]
[ MAJ : 13-06-2008 | 02:10 ]
[ UAC => 0 ]

-------------[ Listing des dossiers dans Application Data ]------------

[17/04/2008|11:29] C:\Users\michel\AppData\Roaming\Adobe\AIR
[17/04/2008|11:29] C:\Users\michel\AppData\Roaming\Adobe\Adobe Media Player
[22/03/2008|14:40] C:\Users\michel\AppData\Roaming\Adobe\Acrobat
[19/03/2008|22:18] C:\Users\michel\AppData\Roaming\Adobe\Flash Player


[20/03/2008|09:18] C:\Users\michel\AppData\Roaming\ATI\ACE

[28/04/2008|12:39] C:\Users\michel\AppData\Roaming\Corel\Paint Shop Pro Photo
[28/04/2008|12:39] C:\Users\michel\AppData\Roaming\Corel\Messages

[22/03/2008|22:54] C:\Users\michel\AppData\Roaming\CyberLink\PowerCinema
[19/03/2008|23:31] C:\Users\michel\AppData\Roaming\CyberLink\MediaCache
[19/03/2008|23:31] C:\Users\michel\AppData\Roaming\CyberLink\PowerProducer
[19/03/2008|23:31] C:\Users\michel\AppData\Roaming\CyberLink\PowerDVD

[10/04/2008|22:40] C:\Users\michel\AppData\Roaming\DivX\DivX Codec

[10/05/2008|19:58] C:\Users\michel\AppData\Roaming\dvdcss\ZATOICHI-2008050213434500

[20/03/2008|01:16] C:\Users\michel\AppData\Roaming\eMule\config

[11/05/2008|12:27] C:\Users\michel\AppData\Roaming\EoRezo\eoDesktop
[11/05/2008|10:05] C:\Users\michel\AppData\Roaming\EoRezo\db

[19/03/2008|20:41] C:\Users\michel\AppData\Roaming\eSobi\eSobi2

[22/04/2008|16:15] C:\Users\michel\AppData\Roaming\Google\GoogleEarth

[19/03/2008|18:37] C:\Users\michel\AppData\Roaming\Identities\{AEFC1684-4516-4BA2-9431-836B3DA90C2B}

[28/04/2008|12:22] C:\Users\michel\AppData\Roaming\InstallShield\ISEngine12.0

[12/05/2008|10:22] C:\Users\michel\AppData\Roaming\ItsLabel\ItsTV

[22/04/2008|10:51] C:\Users\michel\AppData\Roaming\LimeWire\.AppSpecialShare
[22/04/2008|10:29] C:\Users\michel\AppData\Roaming\LimeWire\themes

[17/04/2008|11:29] C:\Users\michel\AppData\Roaming\Macromedia\Flash Player

[31/05/2008|21:34] C:\Users\michel\AppData\Roaming\Microsoft\Templates
[24/05/2008|10:47] C:\Users\michel\AppData\Roaming\Microsoft\Office
[24/05/2008|10:47] C:\Users\michel\AppData\Roaming\Microsoft\CLView
[23/05/2008|23:57] C:\Users\michel\AppData\Roaming\Microsoft\Excel
[15/05/2008|08:47] C:\Users\michel\AppData\Roaming\Microsoft\HTML Help
[14/05/2008|13:49] C:\Users\michel\AppData\Roaming\Microsoft\MSN Messenger
[28/04/2008|13:42] C:\Users\michel\AppData\Roaming\Microsoft\OIS
[22/04/2008|12:39] C:\Users\michel\AppData\Roaming\Microsoft\Windows Photo Gallery
[22/04/2008|09:51] C:\Users\michel\AppData\Roaming\Microsoft\MMC
[18/04/2008|20:25] C:\Users\michel\AppData\Roaming\Microsoft\Windows Live Call
[18/04/2008|20:25] C:\Users\michel\AppData\Roaming\Microsoft\IdentityCRL
[10/04/2008|22:09] C:\Users\michel\AppData\Roaming\Microsoft\Windows
[10/04/2008|22:07] C:\Users\michel\AppData\Roaming\Microsoft\OneNote
[05/04/2008|19:48] C:\Users\michel\AppData\Roaming\Microsoft\Crypto
[30/03/2008|22:38] C:\Users\michel\AppData\Roaming\Microsoft\UProof
[30/03/2008|22:37] C:\Users\michel\AppData\Roaming\Microsoft\Proof
[23/03/2008|12:12] C:\Users\michel\AppData\Roaming\Microsoft\Document Building Blocks
[23/03/2008|12:12] C:\Users\michel\AppData\Roaming\Microsoft\Word
[23/03/2008|12:12] C:\Users\michel\AppData\Roaming\Microsoft\AddIns
[23/03/2008|01:29] C:\Users\michel\AppData\Roaming\Microsoft\Installer
[20/03/2008|01:12] C:\Users\michel\AppData\Roaming\Microsoft\Speech
[19/03/2008|22:35] C:\Users\michel\AppData\Roaming\Microsoft\Internet Explorer
[19/03/2008|18:38] C:\Users\michel\AppData\Roaming\Microsoft\SystemCertificates
[19/03/2008|18:37] C:\Users\michel\AppData\Roaming\Microsoft\Protect
[19/03/2008|18:37] C:\Users\michel\AppData\Roaming\Microsoft\Credentials

[12/06/2008|13:26] C:\Users\michel\AppData\Roaming\Mozilla\Firefox



[26/05/2008|01:28] C:\Users\michel\AppData\Roaming\vlc\cache


[22/04/2008|00:33] C:\Users\michel\AppData\Roaming\Warsow\basewsw


----------------[ Tâches planifiées dans C:\Windows\tasks ]---------------

[15/06/2008 15:16][--ah-----] C:\Windows\tasks\SA.DAT
[15/06/2008 15:14][--a------] C:\Windows\tasks\SCHEDLGU.TXT

------[ Listing des dossiers dans C:\ProgramData ]------

[06/05/2007|23:16] C:\ProgramData\{174892B1-CBE7-44F5-86FF-AB555EFD73A3}
[17/04/2008|11:29] C:\ProgramData\Adobe
[02/11/2006|14:59] C:\ProgramData\Application Data
[16/05/2008|10:43] C:\ProgramData\BM2b15f284.txt
[25/05/2008|15:44] C:\ProgramData\BM2b15f284.xml
[19/03/2008|18:33] C:\ProgramData\Bureau
[13/05/2008|13:07] C:\ProgramData\CheckPoint
[28/04/2008|12:37] C:\ProgramData\Corel
[22/03/2008|22:56] C:\ProgramData\CyberLink
[02/11/2006|14:59] C:\ProgramData\Desktop
[02/11/2006|14:59] C:\ProgramData\Documents
[23/04/2008|08:05] C:\ProgramData\eMule
[19/03/2008|20:40] C:\ProgramData\eSobi
[19/03/2008|18:33] C:\ProgramData\Favoris
[02/11/2006|14:59] C:\ProgramData\Favorites
[15/06/2008|13:01] C:\ProgramData\Google Updater
[17/05/2008|11:31] C:\ProgramData\Lavasoft
[19/03/2008|18:33] C:\ProgramData\Menu D‚marrer
[21/05/2008|18:23] C:\ProgramData\Messenger Plus!
[25/05/2008|12:40] C:\ProgramData\Microsoft
[14/05/2008|20:04] C:\ProgramData\Microsoft Help
[19/03/2008|18:33] C:\ProgramData\ModŠles
[19/03/2008|22:32] C:\ProgramData\Move mix enc.wc6kf
[25/05/2008|15:47] C:\ProgramData\pskt.ini
[19/03/2008|22:31] C:\ProgramData\RDR GPL GPL.e3r3b
[19/04/2008|19:05] C:\ProgramData\RDR GPL GPL.j07hn
[19/03/2008|22:31] C:\ProgramData\RDR GPL GPL.v55nn7
[17/05/2008|11:29] C:\ProgramData\Spybot - Search & Destroy
[02/11/2006|14:59] C:\ProgramData\Start Menu
[25/05/2008|22:25] C:\ProgramData\Symantec
[02/11/2006|14:59] C:\ProgramData\Templates
[26/05/2008|01:28] C:\ProgramData\Tool Eggs Less City
[24/05/2008|16:21] C:\ProgramData\TrackMania
[03/05/2008|01:18] C:\ProgramData\WLInstaller
[19/03/2008|20:54] C:\ProgramData\Yahoo! Companion

---------------[ Listing des dossiers dans C:\Program Files ]--------------

[19/12/2007|16:40] C:\Program Files\Acer Inc
[06/05/2007|23:16] C:\Program Files\Activation Assistant for the 2007 Microsoft Office suites
[31/05/2008|21:58] C:\Program Files\Adobe
[17/04/2008|11:29] C:\Program Files\Adobe Media Player
[19/04/2008|17:20] C:\Program Files\Alex Feinman
[24/05/2008|22:49] C:\Program Files\Alwil Software
[20/03/2008|14:19] C:\Program Files\Ares
[19/12/2007|16:35] C:\Program Files\ATI
[19/12/2007|16:37] C:\Program Files\ATI Technologies
[15/06/2008|15:19] C:\Program Files\BOINC
[31/05/2008|22:00] C:\Program Files\Common Files
[28/04/2008|12:32] C:\Program Files\Corel
[06/05/2007|23:25] C:\Program Files\Cyberlink
[20/03/2008|01:28] C:\Program Files\desktop.ini
[12/06/2008|21:02] C:\Program Files\DivX
[11/05/2008|14:35] C:\Program Files\EoRezo
[06/05/2007|23:26] C:\Program Files\eSobi
[19/03/2008|18:33] C:\Program Files\Fichiers communs [C:\Program Files\Common Files]
[22/04/2008|14:50] C:\Program Files\Google
[12/05/2008|23:32] C:\Program Files\InstallShield Installation Information
[11/06/2008|20:17] C:\Program Files\Internet Explorer
[22/04/2008|10:14] C:\Program Files\Java
[17/05/2008|11:28] C:\Program Files\Lavasoft
[23/04/2008|08:55] C:\Program Files\Maxis
[21/05/2008|06:57] C:\Program Files\Messenger Plus! Live
[22/03/2008|01:18] C:\Program Files\Microsoft Games
[06/05/2007|23:16] C:\Program Files\Microsoft Office
[12/05/2008|21:24] C:\Program Files\Microsoft Works
[06/05/2007|23:14] C:\Program Files\Microsoft.NET
[09/06/2008|23:06] C:\Program Files\Minimizor
[23/04/2008|14:47] C:\Program Files\mnProjects
[02/11/2006|14:40] C:\Program Files\Movie Maker
[11/06/2008|21:43] C:\Program Files\Mozilla Firefox
[24/05/2008|22:34] C:\Program Files\Mozilla Firefox(1)
[02/11/2006|14:35] C:\Program Files\MSBuild
[02/11/2006|14:35] C:\Program Files\MSN
[20/03/2008|00:03] C:\Program Files\MSXML 4.0
[06/05/2007|23:12] C:\Program Files\NewTech Infosystems
[20/03/2008|01:24] C:\Program Files\Norton Internet Security
[13/05/2008|17:18] C:\Program Files\Norton Security Scan
[10/04/2008|21:44] C:\Program Files\Olivetti
[09/05/2008|15:01] C:\Program Files\PhotoFiltre Studio
[06/05/2007|23:00] C:\Program Files\Realtek
[02/11/2006|14:35] C:\Program Files\Reference Assemblies
[17/05/2008|11:38] C:\Program Files\Spybot - Search & Destroy
[19/03/2008|20:20] C:\Program Files\Symantec
[09/06/2008|21:47] C:\Program Files\Teamspeak2_RC2
[24/05/2008|15:25] C:\Program Files\TmNationsForever
[15/06/2008|13:10] C:\Program Files\Trend Micro
[02/11/2006|14:58] C:\Program Files\Uninstall Information
[12/04/2008|12:46] C:\Program Files\VideoLAN
[06/06/2008|21:00] C:\Program Files\VirtualDJ
[21/05/2008|06:37] C:\Program Files\VS Revo Group
[10/04/2008|17:22] C:\Program Files\VSO
[20/03/2008|01:22] C:\Program Files\Windows Calendar
[02/11/2006|14:40] C:\Program Files\Windows Collaboration
[20/03/2008|01:22] C:\Program Files\Windows Defender
[21/03/2008|09:02] C:\Program Files\Windows Live
[20/03/2008|01:22] C:\Program Files\Windows Mail
[20/03/2008|01:22] C:\Program Files\Windows Media Player
[19/03/2008|18:33] C:\Program Files\Windows NT
[02/11/2006|14:40] C:\Program Files\Windows Photo Gallery
[20/03/2008|01:22] C:\Program Files\Windows Sidebar
[13/04/2008|00:23] C:\Program Files\WinRAR
[11/06/2008|14:47] C:\Program Files\Wolfenstein - Enemy Territory
[19/03/2008|18:37] C:\Program Files\Yahoo!

------[ Listing des dossiers dans C:\Program Files\Common Files ]------

[31/05/2008|21:58] C:\Program Files\Common Files\Adobe
[17/04/2008|11:29] C:\Program Files\Common Files\Adobe AIR
[28/04/2008|12:34] C:\Program Files\Common Files\Corel
[06/05/2007|23:14] C:\Program Files\Common Files\DESIGNER
[06/05/2007|23:23] C:\Program Files\Common Files\InstallShield
[22/04/2008|10:12] C:\Program Files\Common Files\Java
[06/05/2007|23:11] C:\Program Files\Common Files\LightScribe
[20/03/2008|00:08] C:\Program Files\Common Files\microsoft shared
[06/05/2007|23:11] C:\Program Files\Common Files\muvee Technologies
[06/05/2007|23:12] C:\Program Files\Common Files\NewTech Infosystems
[09/04/2008|18:45] C:\Program Files\Common Files\PX Storage Engine
[02/11/2006|13:18] C:\Program Files\Common Files\Services
[02/11/2006|13:18] C:\Program Files\Common Files\SpeechEngines
[22/03/2008|22:48] C:\Program Files\Common Files\Steam
[25/05/2008|15:42] C:\Program Files\Common Files\Symantec Shared
[20/03/2008|01:22] C:\Program Files\Common Files\System
[31/05/2008|22:00] C:\Program Files\Common Files\Vbox
[19/03/2008|20:39] C:\Program Files\Common Files\WindowsLiveInstaller
[17/05/2008|11:27] C:\Program Files\Common Files\Wise Installation Wizard

---------------------------[ Process ]--------------------------

... 76

iexplore.exe ~ [168]

----------------------[ Recherche avec S_Lop ]---------------------

C:\ProgramData\Move mix enc.wc6kf
C:\ProgramData\RDR GPL GPL.e3r3b
C:\ProgramData\RDR GPL GPL.j07hn
C:\ProgramData\RDR GPL GPL.v55nn7
C:\ProgramData\RDR GPL GPL.e3r3b
C:\ProgramData\RDR GPL GPL.j07hn
C:\ProgramData\RDR GPL GPL.v55nn7

-----------------[ Recherche de Fichiers / Dossiers Lop ]-----------------

C:\ProgramData\Tool Eggs Less City
C:\ProgramData\Tool Eggs Less City\Program Fork.exe
C:\Windows\Prefetch\PROGRAM FORK.EXE-F6878BA7.pf
C:\Users\michel\AppData\Roaming\MICROS~1\Windows\Cookies\michel@www.adserver5[1].txt
C:\Users\michel\AppData\Roaming\MICROS~1\Windows\Cookies\michel@www.adserver5[2].txt
C:\Users\michel\AppData\Roaming\MICROS~1\Windows\Cookies\michel@adopt.euroclick[2].txt
C:\Users\michel\AppData\Roaming\MICROS~1\Windows\Cookies\michel@32vegas[1].txt
C:\Users\michel\AppData\Roaming\MICROS~1\Windows\Cookies\michel@banner.32vegas[2].txt
C:\Users\michel\AppData\Roaming\MICROS~1\Windows\Cookies\michel@2xmoinscher[2].txt
C:\Users\michel\AppData\Roaming\MICROS~1\Windows\Cookies\michel@www.2xmoinscher[2].txt

----------------------[ Verification du Registre ]----------------------

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

..... OK !

--------------------[ Verification du fichier Hosts ]---------------------

Fichier Hosts PROPRE


----------------[ Recherche de fichiers avec Catchme ]-----------------

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-15 15:21:09
Windows 6.0.6000 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 0

--------------------[ Recherche d'autres infections ]---------------------

=> C:\Users\michel\AppData\Roaming\uTorrent\install_virtualdj_v5+Crack.zip.torrent
=> C:\Users\michel\AppData\Roaming\uTorrent\Virtual.DJ.software(crack).torrent
=> C:\Users\michel\Documents\Downloads\virtual dj\crack
=> C:\Users\michel\Documents\Downloads\virtual dj\crack\virtualdj.exe
=> C:\Users\michel\Documents\Mes fichiers re‡us\michelallende4168305947\Historique\crackddf_933540969025.xml
=> C:\Users\michel\Documents\Mes Historiques de Conversation\mai 2008\crackddf_93@hotmail.fr.html


[F:2173][D:37]-> C:\Users\michel\AppData\Local\Temp
[F:491][D:1]-> C:\Users\michel\AppData\Roaming\MICROS~1\Windows\Cookies
[F:139][D:6]-> C:\Users\michel\AppData\Local\MICROS~1\Windows\TEMPOR~1\content.IE5
[F:19][D:8]-> C:\$Recycle.Bin

[ UAC => 1 ]

--------------------[ Fin du rapport a 15:24:02,92 ]----------------------

Sélectionne entièrement l'encadré ci-dessous , puis clique droit Copier



Relance Lop S&D

Choisis cette fois ci l'Option 4 (LopScript)

Une page blanche va s'ouvrir , clique droit dessus et choisis Coller

Ferme la page , il te sera demandé de l'enregistrer , clique sur [Enregistrer]

Ne ferme pas la fenêtre lors de la suppression !

Poste le rapport généré (C:\lopR.txt)

-----------------------[ Lop S&D 4.2.1-4 XP/Vista ]---------------------

[ Windows 'Longhorn' (NT 6.0) Workstation Build 6000 ]
[ USER : michel ] [ "C:\Lop SD" ] [ Selection : 4 ]
[ 15/06/2008 | 20:55:01,07 ] [ PC : PC-DE-MICHEL ]
[ MAJ : 13-06-2008 | 02:10 ]
[ UAC => 0 ]

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ LopScript //////////////////////////////////

C:\Users\michel\AppData\Roaming\EoRezo
C:\Program Files\EoRezo

Supprimé! - C:\Users\michel\AppData\Roaming\EoRezo
Supprimé! - C:\Program Files\EoRezo

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ SUPPRESSION /////////////////////////////

Supprimé! - C:\ProgramData\Tool Eggs Less City\Program Fork.exe
Supprimé! - C:\Windows\Prefetch\PROGRAM FORK.EXE-F6878BA7.pf
Supprimé! - C:\Users\michel\AppData\Roaming\MICROS~1\Windows\Cookies\michel@www.adserver5[2].txt
Supprimé! - C:\Users\michel\AppData\Roaming\MICROS~1\Windows\Cookies\michel@adopt.euroclick[2].txt
Supprimé! - C:\Users\michel\AppData\Roaming\MICROS~1\Windows\Cookies\michel@32vegas[1].txt
Supprimé! - C:\Users\michel\AppData\Roaming\MICROS~1\Windows\Cookies\michel@banner.32vegas[2].txt
Supprimé! - C:\Users\michel\AppData\Roaming\MICROS~1\Windows\Cookies\michel@2xmoinscher[2].txt
Supprimé! - C:\Users\michel\AppData\Roaming\MICROS~1\Windows\Cookies\michel@www.2xmoinscher[2].txt
Supprimé! - C:\ProgramData\Move mix enc.wc6kf
Supprimé! - C:\ProgramData\RDR GPL GPL.e3r3b
Supprimé! - C:\ProgramData\RDR GPL GPL.j07hn
Supprimé! - C:\ProgramData\RDR GPL GPL.v55nn7
Supprimé! - C:\ProgramData\Tool Eggs Less City
Restauré! - Fichier Hosts

//////////////////////////////////////-\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\


-------------[ Listing des dossiers dans Application Data ]------------

[17/04/2008|11:29] C:\Users\michel\AppData\Roaming\Adobe\AIR
[17/04/2008|11:29] C:\Users\michel\AppData\Roaming\Adobe\Adobe Media Player
[22/03/2008|14:40] C:\Users\michel\AppData\Roaming\Adobe\Acrobat
[19/03/2008|22:18] C:\Users\michel\AppData\Roaming\Adobe\Flash Player


[20/03/2008|09:18] C:\Users\michel\AppData\Roaming\ATI\ACE

[28/04/2008|12:39] C:\Users\michel\AppData\Roaming\Corel\Paint Shop Pro Photo
[28/04/2008|12:39] C:\Users\michel\AppData\Roaming\Corel\Messages

[22/03/2008|22:54] C:\Users\michel\AppData\Roaming\CyberLink\PowerCinema
[19/03/2008|23:31] C:\Users\michel\AppData\Roaming\CyberLink\MediaCache
[19/03/2008|23:31] C:\Users\michel\AppData\Roaming\CyberLink\PowerProducer
[19/03/2008|23:31] C:\Users\michel\AppData\Roaming\CyberLink\PowerDVD

[10/04/2008|22:40] C:\Users\michel\AppData\Roaming\DivX\DivX Codec

[10/05/2008|19:58] C:\Users\michel\AppData\Roaming\dvdcss\ZATOICHI-2008050213434500

[20/03/2008|01:16] C:\Users\michel\AppData\Roaming\eMule\config

[19/03/2008|20:41] C:\Users\michel\AppData\Roaming\eSobi\eSobi2

[22/04/2008|16:15] C:\Users\michel\AppData\Roaming\Google\GoogleEarth

[19/03/2008|18:37] C:\Users\michel\AppData\Roaming\Identities\{AEFC1684-4516-4BA2-9431-836B3DA90C2B}

[28/04/2008|12:22] C:\Users\michel\AppData\Roaming\InstallShield\ISEngine12.0

[12/05/2008|10:22] C:\Users\michel\AppData\Roaming\ItsLabel\ItsTV

[22/04/2008|10:51] C:\Users\michel\AppData\Roaming\LimeWire\.AppSpecialShare
[22/04/2008|10:29] C:\Users\michel\AppData\Roaming\LimeWire\themes

[17/04/2008|11:29] C:\Users\michel\AppData\Roaming\Macromedia\Flash Player

[31/05/2008|21:34] C:\Users\michel\AppData\Roaming\Microsoft\Templates
[24/05/2008|10:47] C:\Users\michel\AppData\Roaming\Microsoft\Office
[24/05/2008|10:47] C:\Users\michel\AppData\Roaming\Microsoft\CLView
[23/05/2008|23:57] C:\Users\michel\AppData\Roaming\Microsoft\Excel
[15/05/2008|08:47] C:\Users\michel\AppData\Roaming\Microsoft\HTML Help
[14/05/2008|13:49] C:\Users\michel\AppData\Roaming\Microsoft\MSN Messenger
[28/04/2008|13:42] C:\Users\michel\AppData\Roaming\Microsoft\OIS
[22/04/2008|12:39] C:\Users\michel\AppData\Roaming\Microsoft\Windows Photo Gallery
[22/04/2008|09:51] C:\Users\michel\AppData\Roaming\Microsoft\MMC
[18/04/2008|20:25] C:\Users\michel\AppData\Roaming\Microsoft\Windows Live Call
[18/04/2008|20:25] C:\Users\michel\AppData\Roaming\Microsoft\IdentityCRL
[10/04/2008|22:09] C:\Users\michel\AppData\Roaming\Microsoft\Windows
[10/04/2008|22:07] C:\Users\michel\AppData\Roaming\Microsoft\OneNote
[05/04/2008|19:48] C:\Users\michel\AppData\Roaming\Microsoft\Crypto
[30/03/2008|22:38] C:\Users\michel\AppData\Roaming\Microsoft\UProof
[30/03/2008|22:37] C:\Users\michel\AppData\Roaming\Microsoft\Proof
[23/03/2008|12:12] C:\Users\michel\AppData\Roaming\Microsoft\Document Building Blocks
[23/03/2008|12:12] C:\Users\michel\AppData\Roaming\Microsoft\Word
[23/03/2008|12:12] C:\Users\michel\AppData\Roaming\Microsoft\AddIns
[23/03/2008|01:29] C:\Users\michel\AppData\Roaming\Microsoft\Installer
[20/03/2008|01:12] C:\Users\michel\AppData\Roaming\Microsoft\Speech
[19/03/2008|22:35] C:\Users\michel\AppData\Roaming\Microsoft\Internet Explorer
[19/03/2008|18:38] C:\Users\michel\AppData\Roaming\Microsoft\SystemCertificates
[19/03/2008|18:37] C:\Users\michel\AppData\Roaming\Microsoft\Protect
[19/03/2008|18:37] C:\Users\michel\AppData\Roaming\Microsoft\Credentials

[12/06/2008|13:26] C:\Users\michel\AppData\Roaming\Mozilla\Firefox



[26/05/2008|01:28] C:\Users\michel\AppData\Roaming\vlc\cache


[22/04/2008|00:33] C:\Users\michel\AppData\Roaming\Warsow\basewsw


----------------[ Tâches planifiées dans C:\Windows\tasks ]---------------

[15/06/2008 20:52][--ah-----] C:\Windows\tasks\SA.DAT
[15/06/2008 20:51][--a------] C:\Windows\tasks\SCHEDLGU.TXT

------[ Listing des dossiers dans C:\ProgramData ]------

[06/05/2007|23:16] C:\ProgramData\{174892B1-CBE7-44F5-86FF-AB555EFD73A3}
[17/04/2008|11:29] C:\ProgramData\Adobe
[02/11/2006|14:59] C:\ProgramData\Application Data
[16/05/2008|10:43] C:\ProgramData\BM2b15f284.txt
[25/05/2008|15:44] C:\ProgramData\BM2b15f284.xml
[19/03/2008|18:33] C:\ProgramData\Bureau
[13/05/2008|13:07] C:\ProgramData\CheckPoint
[28/04/2008|12:37] C:\ProgramData\Corel
[22/03/2008|22:56] C:\ProgramData\CyberLink
[02/11/2006|14:59] C:\ProgramData\Desktop
[02/11/2006|14:59] C:\ProgramData\Documents
[23/04/2008|08:05] C:\ProgramData\eMule
[19/03/2008|20:40] C:\ProgramData\eSobi
[19/03/2008|18:33] C:\ProgramData\Favoris
[02/11/2006|14:59] C:\ProgramData\Favorites
[15/06/2008|13:01] C:\ProgramData\Google Updater
[17/05/2008|11:31] C:\ProgramData\Lavasoft
[19/03/2008|18:33] C:\ProgramData\Menu D‚marrer
[21/05/2008|18:23] C:\ProgramData\Messenger Plus!
[25/05/2008|12:40] C:\ProgramData\Microsoft
[14/05/2008|20:04] C:\ProgramData\Microsoft Help
[19/03/2008|18:33] C:\ProgramData\ModŠles
[25/05/2008|15:47] C:\ProgramData\pskt.ini
[17/05/2008|11:29] C:\ProgramData\Spybot - Search & Destroy
[02/11/2006|14:59] C:\ProgramData\Start Menu
[15/06/2008|18:16] C:\ProgramData\Symantec
[02/11/2006|14:59] C:\ProgramData\Templates
[24/05/2008|16:21] C:\ProgramData\TrackMania
[03/05/2008|01:18] C:\ProgramData\WLInstaller
[19/03/2008|20:54] C:\ProgramData\Yahoo! Companion

---------------[ Listing des dossiers dans C:\Program Files ]--------------

[19/12/2007|16:40] C:\Program Files\Acer Inc
[06/05/2007|23:16] C:\Program Files\Activation Assistant for the 2007 Microsoft Office suites
[31/05/2008|21:58] C:\Program Files\Adobe
[17/04/2008|11:29] C:\Program Files\Adobe Media Player
[19/04/2008|17:20] C:\Program Files\Alex Feinman
[24/05/2008|22:49] C:\Program Files\Alwil Software
[20/03/2008|14:19] C:\Program Files\Ares
[19/12/2007|16:35] C:\Program Files\ATI
[19/12/2007|16:37] C:\Program Files\ATI Technologies
[15/06/2008|20:55] C:\Program Files\BOINC
[31/05/2008|22:00] C:\Program Files\Common Files
[28/04/2008|12:32] C:\Program Files\Corel
[06/05/2007|23:25] C:\Program Files\Cyberlink
[20/03/2008|01:28] C:\Program Files\desktop.ini
[12/06/2008|21:02] C:\Program Files\DivX
[06/05/2007|23:26] C:\Program Files\eSobi
[19/03/2008|18:33] C:\Program Files\Fichiers communs [C:\Program Files\Common Files]
[22/04/2008|14:50] C:\Program Files\Google
[12/05/2008|23:32] C:\Program Files\InstallShield Installation Information
[11/06/2008|20:17] C:\Program Files\Internet Explorer
[22/04/2008|10:14] C:\Program Files\Java
[17/05/2008|11:28] C:\Program Files\Lavasoft
[23/04/2008|08:55] C:\Program Files\Maxis
[21/05/2008|06:57] C:\Program Files\Messenger Plus! Live
[22/03/2008|01:18] C:\Program Files\Microsoft Games
[06/05/2007|23:16] C:\Program Files\Microsoft Office
[12/05/2008|21:24] C:\Program Files\Microsoft Works
[06/05/2007|23:14] C:\Program Files\Microsoft.NET
[09/06/2008|23:06] C:\Program Files\Minimizor
[23/04/2008|14:47] C:\Program Files\mnProjects
[02/11/2006|14:40] C:\Program Files\Movie Maker
[11/06/2008|21:43] C:\Program Files\Mozilla Firefox
[24/05/2008|22:34] C:\Program Files\Mozilla Firefox(1)
[02/11/2006|14:35] C:\Program Files\MSBuild
[02/11/2006|14:35] C:\Program Files\MSN
[20/03/2008|00:03] C:\Program Files\MSXML 4.0
[06/05/2007|23:12] C:\Program Files\NewTech Infosystems
[20/03/2008|01:24] C:\Program Files\Norton Internet Security
[13/05/2008|17:18] C:\Program Files\Norton Security Scan
[10/04/2008|21:44] C:\Program Files\Olivetti
[09/05/2008|15:01] C:\Program Files\PhotoFiltre Studio
[06/05/2007|23:00] C:\Program Files\Realtek
[02/11/2006|14:35] C:\Program Files\Reference Assemblies
[17/05/2008|11:38] C:\Program Files\Spybot - Search & Destroy
[19/03/2008|20:20] C:\Program Files\Symantec
[09/06/2008|21:47] C:\Program Files\Teamspeak2_RC2
[24/05/2008|15:25] C:\Program Files\TmNationsForever
[15/06/2008|13:10] C:\Program Files\Trend Micro
[02/11/2006|14:58] C:\Program Files\Uninstall Information
[12/04/2008|12:46] C:\Program Files\VideoLAN
[06/06/2008|21:00] C:\Program Files\VirtualDJ
[21/05/2008|06:37] C:\Program Files\VS Revo Group
[10/04/2008|17:22] C:\Program Files\VSO
[20/03/2008|01:22] C:\Program Files\Windows Calendar
[02/11/2006|14:40] C:\Program Files\Windows Collaboration
[20/03/2008|01:22] C:\Program Files\Windows Defender
[21/03/2008|09:02] C:\Program Files\Windows Live
[20/03/2008|01:22] C:\Program Files\Windows Mail
[20/03/2008|01:22] C:\Program Files\Windows Media Player
[19/03/2008|18:33] C:\Program Files\Windows NT
[02/11/2006|14:40] C:\Program Files\Windows Photo Gallery
[20/03/2008|01:22] C:\Program Files\Windows Sidebar
[13/04/2008|00:23] C:\Program Files\WinRAR
[11/06/2008|14:47] C:\Program Files\Wolfenstein - Enemy Territory
[19/03/2008|18:37] C:\Program Files\Yahoo!

------[ Listing des dossiers dans C:\Program Files\Common Files ]------

[31/05/2008|21:58] C:\Program Files\Common Files\Adobe
[17/04/2008|11:29] C:\Program Files\Common Files\Adobe AIR
[28/04/2008|12:34] C:\Program Files\Common Files\Corel
[06/05/2007|23:14] C:\Program Files\Common Files\DESIGNER
[06/05/2007|23:23] C:\Program Files\Common Files\InstallShield
[22/04/2008|10:12] C:\Program Files\Common Files\Java
[06/05/2007|23:11] C:\Program Files\Common Files\LightScribe
[20/03/2008|00:08] C:\Program Files\Common Files\microsoft shared
[06/05/2007|23:11] C:\Program Files\Common Files\muvee Technologies
[06/05/2007|23:12] C:\Program Files\Common Files\NewTech Infosystems
[09/04/2008|18:45] C:\Program Files\Common Files\PX Storage Engine
[02/11/2006|13:18] C:\Program Files\Common Files\Services
[02/11/2006|13:18] C:\Program Files\Common Files\SpeechEngines
[22/03/2008|22:48] C:\Program Files\Common Files\Steam
[25/05/2008|15:42] C:\Program Files\Common Files\Symantec Shared
[20/03/2008|01:22] C:\Program Files\Common Files\System
[31/05/2008|22:00] C:\Program Files\Common Files\Vbox
[19/03/2008|20:39] C:\Program Files\Common Files\WindowsLiveInstaller
[17/05/2008|11:27] C:\Program Files\Common Files\Wise Installation Wizard

---------------------------[ Process ]--------------------------

... 70

... OK !

----------------------[ Recherche avec S_Lop ]---------------------

Aucun fichier / dossier Lop trouvé !

-----------------[ Recherche de Fichiers / Dossiers Lop ]-----------------

C:\Users\michel\AppData\Roaming\MICROS~1\Windows\Cookies\michel@adin.bigpoint[2].txt
C:\Users\michel\AppData\Roaming\MICROS~1\Windows\Cookies\michel@bigpoint[1].txt
C:\Users\michel\AppData\Roaming\MICROS~1\Windows\Cookies\michel@fr1.seafight.bigpoint[1].txt
C:\Users\michel\AppData\Roaming\MICROS~1\Windows\Cookies\michel@fr1.seafight.bigpoint[1].txt

----------------------[ Verification du Registre ]----------------------

..... OK !

--------------------[ Verification du fichier Hosts ]---------------------

Fichier Hosts PROPRE


----------------[ Recherche de fichiers avec Catchme ]-----------------

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-15 20:56:27
Windows 6.0.6000 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 0

--------------------[ Recherche d'autres infections ]---------------------

=> C:\Users\michel\AppData\Roaming\uTorrent\install_virtualdj_v5+Crack.zip.torrent
=> C:\Users\michel\AppData\Roaming\uTorrent\Virtual.DJ.software(crack).torrent
=> C:\Users\michel\Documents\Downloads\virtual dj\crack
=> C:\Users\michel\Documents\Downloads\virtual dj\crack\virtualdj.exe
=> C:\Users\michel\Documents\Mes fichiers re‡us\michelallende4168305947\Historique\crackddf_933540969025.xml
=> C:\Users\michel\Documents\Mes Historiques de Conversation\mai 2008\crackddf_93@hotmail.fr.html


[F:2184][D:36]-> C:\Users\michel\AppData\Local\Temp
[F:490][D:1]-> C:\Users\michel\AppData\Roaming\MICROS~1\Windows\Cookies
[F:140][D:6]-> C:\Users\michel\AppData\Local\MICROS~1\Windows\TEMPOR~1\content.IE5
[F:23][D:8]-> C:\$Recycle.Bin

[ UAC => 1 ]

--------------------[ Fin du rapport a 20:57:25,34 ]----------------------

Re,

Fais l'option 2 pour voir et poste le log final.

TU devrais supprimer ceci :

=> C:\Users\michel\AppData\Roaming\uTorrent\install_virtualdj_v5+Crack.zip.torrent
=> C:\Users\michel\AppData\Roaming\uTorrent\Virtual.DJ.software(crack).torrent
=> C:\Users\michel\Documents\Downloads\virtual dj\crack
=> C:\Users\michel\Documents\Downloads\virtual dj\crack\virtualdj.exe

Quand j'essaye quoi que ce soit Windows me met qu'il y a un problème avec les paramètres utilisateurs et Lop S&D fait redémarrer le PC

Sinon j'ai fait l'option 1 et ça donne ça


-----------------------[ Lop S&D 4.2.1-4 XP/Vista ]---------------------

[ Windows 'Longhorn' (NT 6.0) Workstation Build 6000 ]
[ USER : michel ] [ "C:\Lop SD" ] [ Selection : 1 ]
[ 16/06/2008 | 12:30:22,13 ] [ PC : PC-DE-MICHEL ]
[ MAJ : 13-06-2008 | 02:10 ]
[ UAC => 0 ]

-------------[ Listing des dossiers dans Application Data ]------------

[17/04/2008|11:29] C:\Users\michel\AppData\Roaming\Adobe\AIR
[17/04/2008|11:29] C:\Users\michel\AppData\Roaming\Adobe\Adobe Media Player
[22/03/2008|14:40] C:\Users\michel\AppData\Roaming\Adobe\Acrobat
[19/03/2008|22:18] C:\Users\michel\AppData\Roaming\Adobe\Flash Player


[20/03/2008|09:18] C:\Users\michel\AppData\Roaming\ATI\ACE

[28/04/2008|12:39] C:\Users\michel\AppData\Roaming\Corel\Paint Shop Pro Photo
[28/04/2008|12:39] C:\Users\michel\AppData\Roaming\Corel\Messages

[22/03/2008|22:54] C:\Users\michel\AppData\Roaming\CyberLink\PowerCinema
[19/03/2008|23:31] C:\Users\michel\AppData\Roaming\CyberLink\MediaCache
[19/03/2008|23:31] C:\Users\michel\AppData\Roaming\CyberLink\PowerProducer
[19/03/2008|23:31] C:\Users\michel\AppData\Roaming\CyberLink\PowerDVD

[10/04/2008|22:40] C:\Users\michel\AppData\Roaming\DivX\DivX Codec

[10/05/2008|19:58] C:\Users\michel\AppData\Roaming\dvdcss\ZATOICHI-2008050213434500

[20/03/2008|01:16] C:\Users\michel\AppData\Roaming\eMule\config

[19/03/2008|20:41] C:\Users\michel\AppData\Roaming\eSobi\eSobi2

[22/04/2008|16:15] C:\Users\michel\AppData\Roaming\Google\GoogleEarth

[19/03/2008|18:37] C:\Users\michel\AppData\Roaming\Identities\{AEFC1684-4516-4BA2-9431-836B3DA90C2B}

[28/04/2008|12:22] C:\Users\michel\AppData\Roaming\InstallShield\ISEngine12.0

[12/05/2008|10:22] C:\Users\michel\AppData\Roaming\ItsLabel\ItsTV

[22/04/2008|10:51] C:\Users\michel\AppData\Roaming\LimeWire\.AppSpecialShare
[22/04/2008|10:29] C:\Users\michel\AppData\Roaming\LimeWire\themes

[17/04/2008|11:29] C:\Users\michel\AppData\Roaming\Macromedia\Flash Player

[31/05/2008|21:34] C:\Users\michel\AppData\Roaming\Microsoft\Templates
[24/05/2008|10:47] C:\Users\michel\AppData\Roaming\Microsoft\Office
[24/05/2008|10:47] C:\Users\michel\AppData\Roaming\Microsoft\CLView
[23/05/2008|23:57] C:\Users\michel\AppData\Roaming\Microsoft\Excel
[15/05/2008|08:47] C:\Users\michel\AppData\Roaming\Microsoft\HTML Help
[14/05/2008|13:49] C:\Users\michel\AppData\Roaming\Microsoft\MSN Messenger
[28/04/2008|13:42] C:\Users\michel\AppData\Roaming\Microsoft\OIS
[22/04/2008|12:39] C:\Users\michel\AppData\Roaming\Microsoft\Windows Photo Gallery
[22/04/2008|09:51] C:\Users\michel\AppData\Roaming\Microsoft\MMC
[18/04/2008|20:25] C:\Users\michel\AppData\Roaming\Microsoft\Windows Live Call
[18/04/2008|20:25] C:\Users\michel\AppData\Roaming\Microsoft\IdentityCRL
[10/04/2008|22:09] C:\Users\michel\AppData\Roaming\Microsoft\Windows
[10/04/2008|22:07] C:\Users\michel\AppData\Roaming\Microsoft\OneNote
[05/04/2008|19:48] C:\Users\michel\AppData\Roaming\Microsoft\Crypto
[30/03/2008|22:38] C:\Users\michel\AppData\Roaming\Microsoft\UProof
[30/03/2008|22:37] C:\Users\michel\AppData\Roaming\Microsoft\Proof
[23/03/2008|12:12] C:\Users\michel\AppData\Roaming\Microsoft\Document Building Blocks
[23/03/2008|12:12] C:\Users\michel\AppData\Roaming\Microsoft\Word
[23/03/2008|12:12] C:\Users\michel\AppData\Roaming\Microsoft\AddIns
[23/03/2008|01:29] C:\Users\michel\AppData\Roaming\Microsoft\Installer
[20/03/2008|01:12] C:\Users\michel\AppData\Roaming\Microsoft\Speech
[19/03/2008|22:35] C:\Users\michel\AppData\Roaming\Microsoft\Internet Explorer
[19/03/2008|18:38] C:\Users\michel\AppData\Roaming\Microsoft\SystemCertificates
[19/03/2008|18:37] C:\Users\michel\AppData\Roaming\Microsoft\Protect
[19/03/2008|18:37] C:\Users\michel\AppData\Roaming\Microsoft\Credentials

[12/06/2008|13:26] C:\Users\michel\AppData\Roaming\Mozilla\Firefox



[26/05/2008|01:28] C:\Users\michel\AppData\Roaming\vlc\cache


[22/04/2008|00:33] C:\Users\michel\AppData\Roaming\Warsow\basewsw


----------------[ Tâches planifiées dans C:\Windows\tasks ]---------------

[16/06/2008 12:10][--ah-----] C:\Windows\tasks\SA.DAT
[16/06/2008 12:09][--a------] C:\Windows\tasks\SCHEDLGU.TXT

------[ Listing des dossiers dans C:\ProgramData ]------

[06/05/2007|23:16] C:\ProgramData\{174892B1-CBE7-44F5-86FF-AB555EFD73A3}
[17/04/2008|11:29] C:\ProgramData\Adobe
[02/11/2006|14:59] C:\ProgramData\Application Data
[16/05/2008|10:43] C:\ProgramData\BM2b15f284.txt
[25/05/2008|15:44] C:\ProgramData\BM2b15f284.xml
[19/03/2008|18:33] C:\ProgramData\Bureau
[13/05/2008|13:07] C:\ProgramData\CheckPoint
[28/04/2008|12:37] C:\ProgramData\Corel
[22/03/2008|22:56] C:\ProgramData\CyberLink
[02/11/2006|14:59] C:\ProgramData\Desktop
[02/11/2006|14:59] C:\ProgramData\Documents
[23/04/2008|08:05] C:\ProgramData\eMule
[19/03/2008|20:40] C:\ProgramData\eSobi
[19/03/2008|18:33] C:\ProgramData\Favoris
[02/11/2006|14:59] C:\ProgramData\Favorites
[15/06/2008|13:01] C:\ProgramData\Google Updater
[17/05/2008|11:31] C:\ProgramData\Lavasoft
[19/03/2008|18:33] C:\ProgramData\Menu D‚marrer
[21/05/2008|18:23] C:\ProgramData\Messenger Plus!
[25/05/2008|12:40] C:\ProgramData\Microsoft
[14/05/2008|20:04] C:\ProgramData\Microsoft Help
[19/03/2008|18:33] C:\ProgramData\ModŠles
[16/06/2008|11:42] C:\ProgramData\ntuser.pol
[25/05/2008|15:47] C:\ProgramData\pskt.ini
[17/05/2008|11:29] C:\ProgramData\Spybot - Search & Destroy
[02/11/2006|14:59] C:\ProgramData\Start Menu
[15/06/2008|21:02] C:\ProgramData\Symantec
[02/11/2006|14:59] C:\ProgramData\Templates
[24/05/2008|16:21] C:\ProgramData\TrackMania
[03/05/2008|01:18] C:\ProgramData\WLInstaller
[19/03/2008|20:54] C:\ProgramData\Yahoo! Companion

---------------[ Listing des dossiers dans C:\Program Files ]--------------

[19/12/2007|16:40] C:\Program Files\Acer Inc
[06/05/2007|23:16] C:\Program Files\Activation Assistant for the 2007 Microsoft Office suites
[31/05/2008|21:58] C:\Program Files\Adobe
[17/04/2008|11:29] C:\Program Files\Adobe Media Player
[19/04/2008|17:20] C:\Program Files\Alex Feinman
[24/05/2008|22:49] C:\Program Files\Alwil Software
[20/03/2008|14:19] C:\Program Files\Ares
[19/12/2007|16:35] C:\Program Files\ATI
[19/12/2007|16:37] C:\Program Files\ATI Technologies
[16/06/2008|12:13] C:\Program Files\BOINC
[31/05/2008|22:00] C:\Program Files\Common Files
[28/04/2008|12:32] C:\Program Files\Corel
[06/05/2007|23:25] C:\Program Files\Cyberlink
[20/03/2008|01:28] C:\Program Files\desktop.ini
[12/06/2008|21:02] C:\Program Files\DivX
[06/05/2007|23:26] C:\Program Files\eSobi
[19/03/2008|18:33] C:\Program Files\Fichiers communs [C:\Program Files\Common Files]
[22/04/2008|14:50] C:\Program Files\Google
[12/05/2008|23:32] C:\Program Files\InstallShield Installation Information
[11/06/2008|20:17] C:\Program Files\Internet Explorer
[22/04/2008|10:14] C:\Program Files\Java
[17/05/2008|11:28] C:\Program Files\Lavasoft
[23/04/2008|08:55] C:\Program Files\Maxis
[21/05/2008|06:57] C:\Program Files\Messenger Plus! Live
[22/03/2008|01:18] C:\Program Files\Microsoft Games
[06/05/2007|23:16] C:\Program Files\Microsoft Office
[12/05/2008|21:24] C:\Program Files\Microsoft Works
[06/05/2007|23:14] C:\Program Files\Microsoft.NET
[09/06/2008|23:06] C:\Program Files\Minimizor
[23/04/2008|14:47] C:\Program Files\mnProjects
[02/11/2006|14:40] C:\Program Files\Movie Maker
[11/06/2008|21:43] C:\Program Files\Mozilla Firefox
[24/05/2008|22:34] C:\Program Files\Mozilla Firefox(1)
[02/11/2006|14:35] C:\Program Files\MSBuild
[02/11/2006|14:35] C:\Program Files\MSN
[20/03/2008|00:03] C:\Program Files\MSXML 4.0
[06/05/2007|23:12] C:\Program Files\NewTech Infosystems
[20/03/2008|01:24] C:\Program Files\Norton Internet Security
[13/05/2008|17:18] C:\Program Files\Norton Security Scan
[10/04/2008|21:44] C:\Program Files\Olivetti
[09/05/2008|15:01] C:\Program Files\PhotoFiltre Studio
[06/05/2007|23:00] C:\Program Files\Realtek
[02/11/2006|14:35] C:\Program Files\Reference Assemblies
[17/05/2008|11:38] C:\Program Files\Spybot - Search & Destroy
[19/03/2008|20:20] C:\Program Files\Symantec
[09/06/2008|21:47] C:\Program Files\Teamspeak2_RC2
[24/05/2008|15:25] C:\Program Files\TmNationsForever
[15/06/2008|13:10] C:\Program Files\Trend Micro
[02/11/2006|14:58] C:\Program Files\Uninstall Information
[12/04/2008|12:46] C:\Program Files\VideoLAN
[06/06/2008|21:00] C:\Program Files\VirtualDJ
[21/05/2008|06:37] C:\Program Files\VS Revo Group
[10/04/2008|17:22] C:\Program Files\VSO
[20/03/2008|01:22] C:\Program Files\Windows Calendar
[02/11/2006|14:40] C:\Program Files\Windows Collaboration
[20/03/2008|01:22] C:\Program Files\Windows Defender
[21/03/2008|09:02] C:\Program Files\Windows Live
[20/03/2008|01:22] C:\Program Files\Windows Mail
[20/03/2008|01:22] C:\Program Files\Windows Media Player
[19/03/2008|18:33] C:\Program Files\Windows NT
[02/11/2006|14:40] C:\Program Files\Windows Photo Gallery
[20/03/2008|01:22] C:\Program Files\Windows Sidebar
[13/04/2008|00:23] C:\Program Files\WinRAR
[11/06/2008|14:47] C:\Program Files\Wolfenstein - Enemy Territory
[19/03/2008|18:37] C:\Program Files\Yahoo!

------[ Listing des dossiers dans C:\Program Files\Common Files ]------

[31/05/2008|21:58] C:\Program Files\Common Files\Adobe
[17/04/2008|11:29] C:\Program Files\Common Files\Adobe AIR
[28/04/2008|12:34] C:\Program Files\Common Files\Corel
[06/05/2007|23:14] C:\Program Files\Common Files\DESIGNER
[06/05/2007|23:23] C:\Program Files\Common Files\InstallShield
[22/04/2008|10:12] C:\Program Files\Common Files\Java
[06/05/2007|23:11] C:\Program Files\Common Files\LightScribe
[20/03/2008|00:08] C:\Program Files\Common Files\microsoft shared
[06/05/2007|23:11] C:\Program Files\Common Files\muvee Technologies
[06/05/2007|23:12] C:\Program Files\Common Files\NewTech Infosystems
[09/04/2008|18:45] C:\Program Files\Common Files\PX Storage Engine
[02/11/2006|13:18] C:\Program Files\Common Files\Services
[02/11/2006|13:18] C:\Program Files\Common Files\SpeechEngines
[22/03/2008|22:48] C:\Program Files\Common Files\Steam
[25/05/2008|15:42] C:\Program Files\Common Files\Symantec Shared
[20/03/2008|01:22] C:\Program Files\Common Files\System
[31/05/2008|22:00] C:\Program Files\Common Files\Vbox
[19/03/2008|20:39] C:\Program Files\Common Files\WindowsLiveInstaller
[17/05/2008|11:27] C:\Program Files\Common Files\Wise Installation Wizard

---------------------------[ Process ]--------------------------

... 69

... OK !

----------------------[ Recherche avec S_Lop ]---------------------

Aucun fichier / dossier Lop trouvé !

-----------------[ Recherche de Fichiers / Dossiers Lop ]-----------------

C:\Users\michel\AppData\Roaming\MICROS~1\Windows\Cookies\michel@adin.bigpoint[2].txt
C:\Users\michel\AppData\Roaming\MICROS~1\Windows\Cookies\michel@bigpoint[1].txt
C:\Users\michel\AppData\Roaming\MICROS~1\Windows\Cookies\michel@fr1.seafight.bigpoint[1].txt
C:\Users\michel\AppData\Roaming\MICROS~1\Windows\Cookies\michel@fr1.seafight.bigpoint[1].txt

----------------------[ Verification du Registre ]----------------------

..... OK !

--------------------[ Verification du fichier Hosts ]---------------------

Fichier Hosts PROPRE


----------------[ Recherche de fichiers avec Catchme ]-----------------

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-16 12:30:53
Windows 6.0.6000 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 0

--------------------[ Recherche d'autres infections ]---------------------

=> C:\Users\michel\AppData\Roaming\uTorrent\install_virtualdj_v5+Crack.zip.torrent
=> C:\Users\michel\AppData\Roaming\uTorrent\Virtual.DJ.software(crack).torrent
=> C:\Users\michel\Documents\Downloads\virtual dj\crack
=> C:\Users\michel\Documents\Downloads\virtual dj\crack\virtualdj.exe
=> C:\Users\michel\Documents\Mes fichiers re‡us\michelallende4168305947\Historique\crackddf_933540969025.xml
=> C:\Users\michel\Documents\Mes Historiques de Conversation\mai 2008\crackddf_93@hotmail.fr.html


[F:2210][D:37]-> C:\Users\michel\AppData\Local\Temp
[F:492][D:1]-> C:\Users\michel\AppData\Roaming\MICROS~1\Windows\Cookies
[F:225][D:6]-> C:\Users\michel\AppData\Local\MICROS~1\Windows\TEMPOR~1\content.IE5
[F:23][D:8]-> C:\$Recycle.Bin

[ UAC => 1 ]

--------------------[ Fin du rapport a 12:31:47,86 ]----------------------

Re,

Télécharge ComboFix (de sUBs) sur ton Bureau.

Désactive temporairement toute protection résidente ! (Antivirus, antispywares..)

Double clique sur ComboFix.exe.

Accepte la licence en cliquant sur Oui.

Lorsque l'opération sera terminée, un rapport apparaîtra. Poste ce rapport dans ta prochaine réponse.

Le rapport se trouve ici : %systemdrive%\ComboFix.txt (%systemdrive% étant la partition où est installée Windows; C:\ en général)

Aide : Comment utiliser ComboFix.

Re ,

ComboFix 08-06-15.4 - michel 2008-06-16 13:51:58.1 - NTFSx86
Endroit: C:\Users\michel\Desktop\ComboFix.exe
* Création d'un nouveau point de restauration
.

((((((((((((((((((((((((((((( Fichiers créés 2008-05-16 to 2008-06-16 ))))))))))))))))))))))))))))))))))))
.

Pas de nouveau fichier créé dans cet espace de temps

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-16 10:33 23,352 ----a-w C:\Windows\system32\drivers\PnkBstrK.sys
2008-06-16 10:33 107,832 ----a-w C:\Windows\System32\PnkBstrB.exe
2008-06-16 10:13 --------- d-----w C:\Program Files\BOINC
2008-06-15 19:02 --------- d-----w C:\PROGRA~2\Symantec
2008-06-15 11:10 --------- d-----w C:\Program Files\Trend Micro
2008-06-15 11:01 --------- d-----w C:\PROGRA~2\Google Updater
2008-06-12 19:02 --------- d-----w C:\Program Files\DivX
2008-06-11 12:47 --------- d-----w C:\Program Files\Wolfenstein - Enemy Territory
2008-06-09 21:06 --------- d-----w C:\Program Files\Minimizor
2008-06-09 19:47 --------- d-----w C:\Program Files\Teamspeak2_RC2
2008-06-09 19:46 --------- d-----w C:\Users\michel\AppData\Roaming\teamspeak2
2008-06-07 20:13 2,516 --sha-w C:\Windows\System32\KGyGaAvL.sys
2008-06-07 07:26 --------- d-----w C:\Users\michel\AppData\Roaming\Vso
2008-06-06 19:20 --------- d-----w C:\Users\michel\AppData\Roaming\uTorrent
2008-06-06 19:00 --------- d-----w C:\Program Files\VirtualDJ
2008-05-31 21:16 727 ---ha-w C:\os110921.bin
2008-05-31 20:00 --------- d-----w C:\Program Files\Common Files\Vbox
2008-05-31 19:58 --------- d-----w C:\Program Files\Common Files\Adobe
2008-05-30 23:22 823,296 ----a-w C:\Windows\System32\divx_xx0c.dll
2008-05-30 23:22 823,296 ----a-w C:\Windows\System32\divx_xx07.dll
2008-05-30 23:22 815,104 ----a-w C:\Windows\System32\divx_xx0a.dll
2008-05-30 23:22 802,816 ----a-w C:\Windows\System32\divx_xx11.dll
2008-05-30 23:22 683,520 ----a-w C:\Windows\System32\DivX.dll
2008-05-30 23:22 593,920 ----a-w C:\Windows\System32\dpuGUI11.dll
2008-05-30 23:22 57,344 ----a-w C:\Windows\System32\dpv11.dll
2008-05-30 23:22 53,248 ----a-w C:\Windows\System32\dpuGUI10.dll
2008-05-30 23:22 344,064 ----a-w C:\Windows\System32\dpus11.dll
2008-05-30 23:22 294,912 ----a-w C:\Windows\System32\dpu11.dll
2008-05-30 23:22 294,912 ----a-w C:\Windows\System32\dpu10.dll
2008-05-25 13:42 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-05-24 20:49 --------- d-----w C:\Program Files\Alwil Software
2008-05-24 20:34 --------- d-----w C:\Program Files\Mozilla Firefox(1)
2008-05-24 14:21 --------- d-----w C:\PROGRA~2\TrackMania
2008-05-24 13:25 --------- d-----w C:\Program Files\TmNationsForever
2008-05-22 22:22 524,288 ----a-w C:\Windows\System32\DivXsm.exe
2008-05-22 22:22 3,596,288 ----a-w C:\Windows\System32\qt-dx331.dll
2008-05-22 22:20 200,704 ----a-w C:\Windows\System32\ssldivx.dll
2008-05-22 22:20 1,044,480 ----a-w C:\Windows\System32\libdivx.dll
2008-05-22 22:19 81,920 ----a-w C:\Windows\System32\dpl100.dll
2008-05-22 22:19 196,608 ----a-w C:\Windows\System32\dtu100.dll
2008-05-22 22:19 161,096 ----a-w C:\Windows\System32\DivXCodecVersionChecker.exe
2008-05-22 22:18 12,288 ----a-w C:\Windows\System32\DivXWMPExtType.dll
2008-05-21 16:23 --------- d-----w C:\PROGRA~2\Messenger Plus!
2008-05-21 04:57 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-05-21 04:37 --------- d-----w C:\Program Files\VS Revo Group
2008-05-17 09:38 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-05-17 09:31 --------- d-----w C:\PROGRA~2\Lavasoft
2008-05-17 09:29 --------- d-----w C:\PROGRA~2\Spybot - Search & Destroy
2008-05-17 09:28 --------- d-----w C:\Program Files\Lavasoft
2008-05-17 09:27 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-05-15 23:18 50,768 ----a-w C:\Windows\system32\drivers\aswMonFlt.sys
2008-05-14 18:04 --------- d-----w C:\PROGRA~2\Microsoft Help
2008-05-13 15:18 --------- d-----w C:\Program Files\Norton Security Scan
2008-05-13 11:07 --------- d-----w C:\PROGRA~2\CheckPoint
2008-05-12 21:32 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-12 19:24 --------- d-----w C:\Program Files\Microsoft Works
2008-05-11 08:03 --------- d-----w C:\Users\michel\AppData\Roaming\ItsLabel
2008-05-10 17:58 --------- d-----w C:\Users\michel\AppData\Roaming\dvdcss
2008-05-10 03:30 14,848 ----a-w C:\Windows\System32\wshrm.dll
2008-05-10 01:21 113,664 ----a-w C:\Windows\system32\drivers\rmcast.sys
2008-05-09 13:01 --------- d-----w C:\Program Files\PhotoFiltre Studio
2008-05-02 23:18 --------- d-----w C:\PROGRA~2\WLInstaller
2008-04-29 11:03 --------- d-----w C:\Users\michel\AppData\Roaming\AdobeUM
2008-04-28 10:39 --------- d-----w C:\Users\michel\AppData\Roaming\Corel
2008-04-28 10:37 --------- d-----w C:\PROGRA~2\Corel
2008-04-28 10:34 --------- d-----w C:\Program Files\Common Files\Corel
2008-04-28 10:32 --------- d-----w C:\Program Files\Corel
2008-04-28 10:22 --------- d-----w C:\Users\michel\AppData\Roaming\InstallShield
2008-04-26 08:02 1,327,104 ----a-w C:\Windows\System32\quartz.dll
2008-04-25 04:23 826,368 ----a-w C:\Windows\System32\wininet.dll
2008-04-25 04:23 56,320 ----a-w C:\Windows\System32\iesetup.dll
2008-04-25 04:23 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-04-25 04:22 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
2008-04-23 18:58 66,872 ----a-w C:\Windows\System32\PnkBstrA.exe
2008-04-23 12:47 --------- d-----w C:\Program Files\mnProjects
2008-04-23 06:55 --------- d-----w C:\Program Files\Maxis
2008-04-23 06:09 --------- d-----w C:\Users\michel\AppData\Roaming\LimeWire
2008-04-23 06:05 --------- d-----w C:\PROGRA~2\eMule
2008-04-22 12:50 --------- d-----w C:\Program Files\Google
2008-04-22 08:14 --------- d-----w C:\Program Files\Java
2008-04-22 08:12 --------- d-----w C:\Program Files\Common Files\Java
2008-04-19 15:20 --------- d-----w C:\Program Files\Alex Feinman
2008-04-17 09:29 --------- d-----w C:\Program Files\Common Files\Adobe AIR
2008-04-17 09:29 --------- d-----w C:\Program Files\Adobe Media Player
2008-03-19 23:28 174 --sha-w C:\Program Files\desktop.ini
2008-03-19 22:40 87,040 ----a-w C:\Windows\System32\msoert2.dll
2008-03-19 22:40 39,424 ----a-w C:\Windows\System32\ACCTRES.dll
2008-03-19 22:40 205,824 ----a-w C:\Windows\System32\msoeacct.dll
2008-03-19 22:39 704,000 ----a-w C:\Windows\System32\PhotoScreensaver.scr
2008-03-19 22:39 67,584 ----a-w C:\Windows\System32\wlanhlp.dll
2008-03-19 22:39 542,720 ----a-w C:\Windows\System32\sysmain.dll
2008-03-19 22:39 502,784 ----a-w C:\Windows\System32\wlansvc.dll
2008-03-19 22:39 47,104 ----a-w C:\Windows\System32\wlanapi.dll
2008-03-19 22:39 297,984 ----a-w C:\Windows\System32\wlansec.dll
2008-03-19 22:39 290,816 ----a-w C:\Windows\System32\wlanmsm.dll
2008-03-19 22:39 24,064 ----a-w C:\Windows\System32\wtsapi32.dll
2008-03-19 22:39 2,923,520 ----a-w C:\Windows\explorer.exe
2008-03-19 22:35 194,560 ----a-w C:\Windows\System32\WebClnt.dll
2008-03-19 22:32 49,664 ----a-w C:\Windows\System32\csrsrv.dll
2008-03-19 22:32 376,320 ----a-w C:\Windows\System32\winsrv.dll
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Acer Tour Reminder"="C:\Acer\AcerTour\Reminder.exe" [2007-02-15 18:39 151552]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 12:34 5724184]
"mfcd chic"="C:\ProgramData\RDR GPL GPL.j07hn" [ ]
"LESS CITY AMEN SETUP"="C:\ProgramData\Move mix enc.wc6kf" [ ]
"ares"="C:\Program Files\Ares\Ares.exe" [2008-02-20 16:33 963072]
"Clavier+"="C:\Users\michel\Desktop\Clavier\Clavier.exe" [2007-10-21 23:53 88576]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 14:34 201728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-05-16 01:19 79224]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 13:35 90112]
"Acer Tour Reminder"="C:\Acer\AcerTour\Reminder.exe" [2007-02-15 18:39 151552]

C:\Users\michel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
BOINC Manager.lnk - C:\Program Files\BOINC\boincmgr.exe [2008-03-04 15:00:20 4150016]
OneNote 2007 - Capture d'‚cran et lancement.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2007-08-24 05:45:42 101784]

C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-05-31 21:59:15 110592]
Empowering Technology Launcher.lnk - C:\Acer\Empowering Technology\eAPLauncher.exe [2007-05-06 23:22:26 528384]
Lancement rapide d'Adobe Reader.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 04:44:06 29696]
Outil de mise … jour Google.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2008-04-22 14:48:00 124400]

C:\Users\michel\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\
BOINC Manager.lnk - C:\Program Files\BOINC\boincmgr.exe [2008-03-04 15:00:20 4150016]
OneNote 2007 - Capture d'‚cran et lancement.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2007-08-24 05:45:42 101784]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ValidateAdminCodeSignatures"= 1 (0x1)
"FilterAdministratorToken"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.mkdmp3enc"= C:\Acer\EMPOWE~1\eMode\PCM\Kernel\Burner\MKDMP3Enc.ACM

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)
"DefaultOutboundAction"= 0 (0x0)
"DefaultInboundAction"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{27A992E8-3191-4058-BDC4-1321D34A3BBD}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{825364F4-5206-4106-9837-CCC9FB893293}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{7544676B-122D-44D9-B6F1-22A42CF36183}"= UDP:C:\Acer\Empowering Technology\eMode\PCM\PCMService.exe:CyberLink PowerCinema Resident Program
"{1A18564B-6511-4C7F-B95E-0AD529D9AAFD}"= TCP:C:\Acer\Empowering Technology\eMode\PCM\PCMService.exe:CyberLink PowerCinema Resident Program
"{A1C0EC34-584B-4347-8FD4-AB860E4FCBCC}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{C43D8D7C-9993-44EF-9333-D79A570A61EF}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{0D1FA782-DAD2-44E2-9D28-0A658B41653F}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{B28B84C8-003E-4173-8980-E362034B7379}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{5369CD58-14D2-4522-B790-97E0250DCFD0}C:\\users\\michel\\desktop\\utorrent.exe"= UDP:C:\users\michel\desktop\utorrent.exe:utorrent.exe
"UDP Query User{4EAD8A86-9184-475F-90B1-A87BDA664033}C:\\users\\michel\\desktop\\utorrent.exe"= TCP:C:\users\michel\desktop\utorrent.exe:utorrent.exe
"TCP Query User{142408D0-5447-4A5A-8A1E-CD10C7029600}C:\\program files\\limewire\\limewire.exe"= UDP:C:\program files\limewire\limewire.exe:LimeWire
"UDP Query User{83439281-4B68-416E-B679-27DDCA6E46D6}C:\\program files\\limewire\\limewire.exe"= TCP:C:\program files\limewire\limewire.exe:LimeWire
"TCP Query User{FAEFB7C1-D155-4235-BA8A-4A416B321163}C:\\q3ademo\\quake3.exe"= UDP:C:\q3ademo\quake3.exe:quake3
"UDP Query User{F5018BFD-5318-4F3B-8444-529AB3158867}C:\\q3ademo\\quake3.exe"= TCP:C:\q3ademo\quake3.exe:quake3
"TCP Query User{508D9325-4F17-438C-A021-4730D99F61F5}C:\\program files\\wolfenstein - enemy territory\\et.exe"= UDP:C:\program files\wolfenstein - enemy territory\et.exe:ET
"UDP Query User{06DB2C2A-C69A-4358-9211-43CB7CD7680D}C:\\program files\\wolfenstein - enemy territory\\et.exe"= TCP:C:\program files\wolfenstein - enemy territory\et.exe:ET

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
"DefaultOutboundAction"= 0 (0x0)
"DefaultInboundAction"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)
"DefaultOutboundAction"= 0 (0x0)
"DefaultInboundAction"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"C:\\Acer\\Empowering Technology\\eDataSecurity\\eDSfsu.exe"= C:\Acer\Empowering Technology\eDataSecurity\eDSfsu.exe:*:Enabled:eDSfsu
"C:\\Acer\\Empowering Technology\\eDataSecurity\\encryption.exe"= C:\Acer\Empowering Technology\eDataSecurity\encryption.exe:*:Enabled:encryption
"C:\\Acer\\Empowering Technology\\eDataSecurity\\decryption.exe"= C:\Acer\Empowering Technology\eDataSecurity\decryption.exe:*:Enabled ecryption

R0 AtiPcie;ATI PCI Express (3GIO) Filter;C:\Windows\system32\DRIVERS\AtiPcie.sys [2006-10-30 05:22]
R1 aswSP;avast! Self Protection;C:\Windows\system32\drivers\aswSP.sys [2008-05-16 01:20]
R1 IDSvix86;Symantec Intrusion Prevention Driver;C:\PROGRA~2\Symantec\DEFINI~1\SymcData\idsdefs\20080613.002\IDSvix86.sys [2008-03-12 09:30]
R2 aswFsBlk;aswFsBlk;C:\Windows\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]
R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2008-05-16 01:18]
R2 olMntrService;Olivetti Monitor Service;"C:\Program Files\Olivetti\ANY_WAY\olMntrService.exe" [2007-06-08 16:58]
R3 atikmdag;atikmdag;C:\Windows\system32\DRIVERS\atikmdag.sys [2007-03-14 16:04]
R3 SYMNDISV;SYMNDISV;C:\Windows\system32\Drivers\SYMNDISV.SYS [2006-11-21 06:34]
R3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk60x86.sys [2007-03-23 04:12]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc

*Newly Created Service* - CATCHME
*Newly Created Service* - COMHOST
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-16 13:57:20
Windows 6.0.6000 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...


C:\Users\michel\AppData\Local\Microsoft\Messenger\michelallende@hotmail.fr\SharingMetadata\Working\database_4E28_26DB_2826_C1B7\$db_clean$ 0 bytes

Scan terminé avec succès
Les fichiers cachés: 1

**************************************************************************
.
Temps d'accomplissement: 2008-06-16 14:01:19
ComboFix-quarantined-files.txt 2008-06-16 12:00:58

Le texte du message associé au numéro 0x2379 est introuvable dans le fichier de messages pour Application.
Le texte du message associé au numéro 0x2379 est introuvable dans le fichier de messages pour Application.

220 --- E O F --- 2008-06-14 12:38:03

Poste un nouveau rapport HJT. Où en sont tes problèmes ?

Télécharge MalwareByte's Anti-Malware sur ton Bureau.

Installe-le en double-cliquant sur le fichier Download_mbam-setup.exe.

Une fois l'installation et la mise à jour effectuées :
Redémarre en mode sans échec
/!\ Ne jamais démarrer en mode sans échec via MSCONFIG /!\

Exécute maintenant MalwareByte's Anti-Malware. Si cela n'est pas déjà fait, sélectionne "Exécuter un examen complet".

Afin de lancer la recherche, clic sur"Rechercher".

Une fois le scan terminé, une fenêtre s'ouvre, clic sur OK. Deux possibilités s'offrent à toi :
-- si le programme n'a rien trouvé, appuie sur OK. Un rapport va apparaître, ferme-le.
-- si des infections sont présentes, clic sur "Afficher les résultats" puis sur "Supprimer la sélection". Enregistre le rapport sur ton Bureau afin de le poster dans ta prochaine réponse.

REMARQUE : Si MalwareByte's Anti-Malware a besoin de redémarrer pour terminer la suppression, accepte en cliquant sur Ok.[/#f]

[#FF0000]Aide : Comment utiliser MBAM.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:11:06, on 15/06/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16681)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Ares\Ares.exe
C:\Users\michel\Desktop\Clavier\Clavier.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://fr.fr.acer.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.fr.acer.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ycomp/defaults/su/*http://fr.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [mfcd chic] "C:\ProgramData\RDR GPL GPL.j07hn"
O4 - HKCU\..\Run: [LESS CITY AMEN SETUP] "C:\ProgramData\Move mix enc.wc6kf"
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [Clavier+] C:\Users\michel\Desktop\Clavier\Clavier.exe
O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\michel\AppData\Local\Temp\byXQIAtT.dll,#1
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\michel\AppData\Local\Temp\mLeBSiIC.dll,c
O4 - HKCU\..\Run: [2826c118] rundll32.exe "C:\Users\michel\AppData\Local\Temp\tiyjvbef.dll",b
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [] (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [] (User 'Default user')
O4 - Startup: BOINC Manager.lnk = C:\Program Files\BOINC\boincmgr.exe
O4 - Startup: OneNote 2007 - Capture d'écran et lancement.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Empowering Technology Launcher.lnk = ?
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/fl...
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: ePerformance Service (AcerMemUsageCheckService) - Unknown owner - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Acer\Empowering Technology\eMode\PCM\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Acer\Empowering Technology\eMode\PCM\Kernel\TV\CLSched.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Validation de mot de passe Symantec IS (ISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Olivetti Monitor Service (olMntrService) - Olivetti - C:\Program Files\Olivetti\ANY_WAY\olMntrService.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\Windows\system32\PSIService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared files\RichVideo.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

--
End of file - 10161 bytes


Je crois que je n'ai plus de pub sinon pour redémarrer en mode sans échec le TUTO marche aussi pour vista ?

Tu crois que je m'amuse à aller sur ton profil toute façon je t'ai mis -5

J'ai du rater un post ^^

Sélectionne l’intégralité du cadre ci-dessous :

Copie/colle le dans le Bloc-notes (Démarrer\Tous les programmes\Accessoires\Bloc-notes.)
Enregistre le sous sur ton Bureau sous le nom de Correction.bat
Double-clique dessus. Poste le rapport généré (si présent).


J'attends le rapport MBAM  

Pour le rapport MBAM je n'arrive pas à démarrer en mode sans échec  

Sinon j'ai l'icône correction avec les engrenages mais rien ne s'affiche

Sinon fais-le en mode normal.

Et maintenant certains programme me mettent :

Une référence a été envoyé par le serveur

Fais quand même MBAM ...

Malwarebytes' Anti-Malware 1.17
Version de la base de données: 861

20:58:04 16/06/2008
mbam-log-6-16-2008 (20-58-04).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 181399
Temps écoulé: 20 minute(s), 43 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

Ok, pas de progrès ?

Non je crois que c'est bon y'a plus de pub

En tout cas je te remercie beaucoup michou et j'espère que tu m'aidera encore une autre fois        

Sinon si tu peux m'aider

http://www.infos-du-net.com/forum/268740-10-narrateur-v...

Merci de tout mon coeur en tout cas

Mais cela me met toujours


Une référence a été envoyé par le serveur

Et certains programme ont acquis l'image pour les protections admin

Voici une screen





Ça fait deux  

Comme Wolfenstein qui n'avait pas l'icône

Ce n'est pas dû à une infection je pense.
ça ne le fait qu'avec wolfenstein ?

Fais une analyse antivirus en ligne sur Kaspersky avec Internet Explorer.

Autorise les Active x.

Clique sur Démarrer Online Scanner.

Sélectionne le poste de travail comme analyse. Enregistres sous le rapport en format .txt.

Colle son rapport ici.

Poste un nouveau rapport Hijackthis.

Aide : Comment faire un scan en ligne avec Kaspersky .

A l'aide je me fais attaquez par 30 pubs de rue du commerce qui n'arrêtent pas de venir car je crois que c'est à cause de mon antivirus je n'en ai plus

Re,

Poste un nouveau rapport HijackThis ..

C'est ce que j'allais faire ^^

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:11:06, on 15/06/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16681)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Ares\Ares.exe
C:\Users\michel\Desktop\Clavier\Clavier.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://fr.fr.acer.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.fr.acer.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ycomp/defaults/su/*http://fr.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [mfcd chic] "C:\ProgramData\RDR GPL GPL.j07hn"
O4 - HKCU\..\Run: [LESS CITY AMEN SETUP] "C:\ProgramData\Move mix enc.wc6kf"
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [Clavier+] C:\Users\michel\Desktop\Clavier\Clavier.exe
O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\michel\AppData\Local\Temp\byXQIAtT.dll,#1
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\michel\AppData\Local\Temp\mLeBSiIC.dll,c
O4 - HKCU\..\Run: [2826c118] rundll32.exe "C:\Users\michel\AppData\Local\Temp\tiyjvbef.dll",b
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [] (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [] (User 'Default user')
O4 - Startup: BOINC Manager.lnk = C:\Program Files\BOINC\boincmgr.exe
O4 - Startup: OneNote 2007 - Capture d'écran et lancement.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Empowering Technology Launcher.lnk = ?
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/fl...
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: ePerformance Service (AcerMemUsageCheckService) - Unknown owner - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Acer\Empowering Technology\eMode\PCM\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Acer\Empowering Technology\eMode\PCM\Kernel\TV\CLSched.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Validation de mot de passe Symantec IS (ISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Olivetti Monitor Service (olMntrService) - Olivetti - C:\Program Files\Olivetti\ANY_WAY\olMntrService.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\Windows\system32\PSIService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared files\RichVideo.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

--
End of file - 10161 bytes

Sinon je suis en train d'analyser mon système avec Avast et MBAM

Et ici une screen de ce qui se passe sur HijackThis

C'est rien ça .. Faut que tu lances Hijackthis en tant qu'admin par le clique droit.


Relance HijackThis (clique droit -> lancer en tant qu'adminstrateur sous Vista), do a system scan only, coche ces lignes (si toujours présentes) :

Ferme toutes les applications en cours (particulièrement ton navigateur Internet).
Puis Fix Checked !

Connais tu ceci -> Clavier\Clavier.exe

************

Désinstalle via Ajout/Suppression de Programmes (si présents) :

Symantec

Norton

LiveUpdate..

Télécharge et exécute : http://service1.symantec.com/SUPPORT/INTER/tsgeninfoint...

Désinstalle via Ajout/Suppression de Programmes (si présents) :

Avast!

Télécharge et exécute : http://www.avast.com/eng/avast-uninstall-utility.html

Télécharge Ccleaner sur ton Bureau.

Clique sur "download the latest version"

Installe-le en laissant seulement les options suivantes cochées :
- Ajouter un raccourci sur le Bureau
- Contrôler automatiquement les mises à jour de CCleaner

Lance le Nettoyage

Clique sur Chercher des erreurs et sauvegarde si tu le souhaites.

Aide : Comment utiliser CCleaner.

***************

Télécharge AntiVir sur ton Bureau.

Double clique sur l'exécutable téléchargé pour lancer l'installation.

A la fin de l'installation, clique sur Finish.

Ouvre Antivir, assure-toi qu%u2019il soit bien à jour !

Dans l'onglet Local Protection, choisis Scanner.

Active la recherche de rootkits via le + de rootkit search, puis dans manual selection, coche tout (tes partitions de disque dur).

Clique sur la loupe du milieu pour lancer le scan en tant qu'Administrateur.

Poste moi le rapport généré : Pour cela, clique sur l'onglet Overview, puis choisis Reports, tu trouveras son rapport..

Note : Pour une éradication des menaces plus efficace, lance le scan en mode sans échec.

Pourquoi changer ? Avast vs Antivir.

Aide : Comment installer et utiliser AntiVir.

Si j'essaye cela me met

Une référence a été envoyé par le serveur

Pour clavier oui je connais c'est un logiciel pour répeter un texte avec un raccourci clavier

Si tu essaies quoi ?

Essaie le en mode sans échec avec prise en charge réseau.

ok mais comment faire hier j'ai réussi parce que le PC s'est éteint tout seul

Essaie de faire les étapes que j'ai mise en démarrant ton ordinateur en mode sans échec.

- Plusieurs pressions de F8 ou F5 (ça dépend des ordis), après le bip du bios (s'il y a), donc au démarrage, et tu choisis mode sans échec avec prise en charge réseau.

Mais je suis sur Vista et F5 et F8 ne marche pas

Ça ne change rien que tu sois sous Vista.

Redémarrer en mode sans échec

Pour Norton Security Scan et Live Update Notice cela me met :

L'admin système a configuré la politique de votre système pour interdire cette installation normal ? Répond vite car ils me demandent de redémarrer le PC

Et pour Norton Remove Tool cela me met

Une référence a été envoyé par le serveur

 

Chiant ce problème ^^

Essaie de redémarrer en mode sans échec ..

C'est fait et tout fonctionne je n'ai plus qu'a faire les MAJ pour Antivir mais sinon comment corriger le problème de

Une référence a été envoyé par le serveur

Sinon Antivir analyse au moment où j'écris

Avira AntiVir Personal
Report file date: mardi 17 juin 2008 16:32

Scanning for 1339860 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows Vista
Windows version: (plain) [6.0.6000]
Boot mode: Normally booted
Username: michel
Computer name: PC-DE-MICHEL

Version information:
BUILD.DAT : 8.1.00.295 16479 Bytes 09/04/2008 16:24:00
AVSCAN.EXE : 8.1.2.12 311553 Bytes 18/03/2008 09:02:56
AVSCAN.DLL : 8.1.1.0 53505 Bytes 07/02/2008 08:43:37
LUKE.DLL : 8.1.2.9 151809 Bytes 28/02/2008 08:41:23
LUKERES.DLL : 8.1.2.1 12033 Bytes 21/02/2008 08:28:40
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 10:33:34
ANTIVIR1.VDF : 7.0.3.2 5447168 Bytes 07/03/2008 13:08:58
ANTIVIR2.VDF : 7.0.4.195 2546176 Bytes 14/06/2008 14:29:25
ANTIVIR3.VDF : 7.0.4.209 110080 Bytes 17/06/2008 14:29:25
Engineversion : 8.1.0.55
AEVDF.DLL : 8.1.0.5 102772 Bytes 25/02/2008 09:58:21
AESCRIPT.DLL : 8.1.0.40 266618 Bytes 17/06/2008 14:29:31
AESCN.DLL : 8.1.0.21 119156 Bytes 17/06/2008 14:29:31
AERDL.DLL : 8.1.0.20 418165 Bytes 17/06/2008 14:29:30
AEPACK.DLL : 8.1.1.5 364918 Bytes 17/06/2008 14:29:30
AEOFFICE.DLL : 8.1.0.18 192890 Bytes 17/06/2008 14:29:29
AEHEUR.DLL : 8.1.0.30 1253750 Bytes 17/06/2008 14:29:29
AEHELP.DLL : 8.1.0.15 115063 Bytes 17/06/2008 14:29:27
AEGEN.DLL : 8.1.0.28 307572 Bytes 17/06/2008 14:29:27
AEEMU.DLL : 8.1.0.6 430451 Bytes 17/06/2008 14:29:26
AECORE.DLL : 8.1.0.31 168310 Bytes 17/06/2008 14:29:26
AVWINLL.DLL : 1.0.0.7 14593 Bytes 23/01/2008 17:07:53
AVPREF.DLL : 8.0.0.1 25857 Bytes 18/02/2008 10:37:50
AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:26:47
AVREG.DLL : 8.0.0.0 30977 Bytes 23/01/2008 17:07:49
AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:23
AVEVTLOG.DLL : 8.0.0.11 114945 Bytes 28/02/2008 08:31:31
SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02
SMTPLIB.DLL : 1.2.0.19 28929 Bytes 23/01/2008 17:08:39
NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:10
RCIMAGE.DLL : 8.0.0.35 2371841 Bytes 10/03/2008 14:37:25
RCTEXT.DLL : 8.0.32.0 86273 Bytes 06/03/2008 12:02:11

Configuration settings for the scan:
Jobname..........................: Manual Selection
Configuration file...............: C:\ProgramData\Avira\AntiVir PersonalEdition Classic\PROFILES\folder.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:, D:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: mardi 17 juin 2008 16:32

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'dllhost.exe' - '1' Module(s) have been scanned
Scan process 'dllhost.exe' - '1' Module(s) have been scanned
Scan process 'SearchFilterHost.exe' - '1' Module(s) have been scanned
Scan process 'SearchProtocolHost.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'usnsvc.exe' - '1' Module(s) have been scanned
Scan process 'firefox.exe' - '1' Module(s) have been scanned
Scan process 'MpCmdRun.exe' - '1' Module(s) have been scanned
Scan process 'eRAgent.exe' - '1' Module(s) have been scanned
Scan process 'WmiPrvSE.exe' - '1' Module(s) have been scanned
Scan process 'Acer.Empowering.Framework.Supervisor.ex' - '1' Module(s) have been scanned
Scan process 'unsecapp.exe' - '1' Module(s) have been scanned
Scan process 'GoogleUpdater.exe' - '1' Module(s) have been scanned
Scan process 'Clavier.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'taskeng.exe' - '1' Module(s) have been scanned
Scan process 'CLSched.exe' - '1' Module(s) have been scanned
Scan process 'eRecoveryService.exe' - '1' Module(s) have been scanned
Scan process 'SearchIndexer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'RichVideo.exe' - '1' Module(s) have been scanned
Scan process 'PSIService.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'PnkBstrA.exe' - '1' Module(s) have been scanned
Scan process 'olMntrService.exe' - '1' Module(s) have been scanned
Scan process 'LSSrvc.exe' - '1' Module(s) have been scanned
Scan process 'GoogleUpdaterService.exe' - '1' Module(s) have been scanned
Scan process 'eDSService.exe' - '1' Module(s) have been scanned
Scan process 'CLCapSvc.exe' - '1' Module(s) have been scanned
Scan process 'MemCheck.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'taskeng.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'dwm.exe' - '1' Module(s) have been scanned
Scan process 'aawservice.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'Ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'SLsvc.exe' - '1' Module(s) have been scanned
Scan process 'audiodg.exe' - '0' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'Ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'lsm.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'wininit.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
60 processes with 60 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!
Master boot sector HD1
[INFO] No virus was found!
[WARNING] Le périphérique n'est pas prêt.
[INFO] Please restart the search with Administrator rights
Master boot sector HD2
[INFO] No virus was found!
[WARNING] Le périphérique n'est pas prêt.
[INFO] Please restart the search with Administrator rights
Master boot sector HD3
[INFO] No virus was found!
[WARNING] Le périphérique n'est pas prêt.
[INFO] Please restart the search with Administrator rights
Master boot sector HD4
[INFO] No virus was found!
[WARNING] Le périphérique n'est pas prêt.
[INFO] Please restart the search with Administrator rights
Master boot sector HD5
[INFO] No virus was found!
[WARNING] Le périphérique n'est pas prêt.
[INFO] Please restart the search with Administrator rights

Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Boot sector 'D:\'
[INFO] No virus was found!

Starting to scan the registry.
The registry was scanned ( '10' files ).


Starting the file scan:

Begin scan in 'C:\' <ACER>
C:\hiberfil.sys
[WARNING] The file could not be opened!
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\Windows\System32\drivers\sptd.sys
[WARNING] The file could not be opened!
Begin scan in 'D:\' <DATA>


End of the scan: mardi 17 juin 2008 17:09
Used time: 36:42 min

The scan has been done completely.

17068 Scanning directories
269338 Files were scanned
0 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
0 files were moved to quarantine
0 files were renamed
3 Files cannot be scanned
269338 Files not concerned
1832 Archives were scanned
8 Warnings
0 Notes

Poste un nouveau rapport HJT;

Re ,

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:24:17, on 17/06/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16681)
Boot mode: Safe mode with network support

Running processes:
C:\Windows\Explorer.EXE
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Mozilla Firefox\firefox.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Clavier+] C:\Users\michel\Desktop\Clavier\Clavier.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe (User 'Default user')
O4 - Global Startup: Empowering Technology Launcher.lnk = ?
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://webscanner.kaspersky.fr/kavwebscan_unicode.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/fl...
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: ePerformance Service (AcerMemUsageCheckService) - Unknown owner - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Acer\Empowering Technology\eMode\PCM\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Acer\Empowering Technology\eMode\PCM\Kernel\TV\CLSched.exe
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Olivetti Monitor Service (olMntrService) - Olivetti - C:\Program Files\Olivetti\ANY_WAY\olMntrService.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\Windows\system32\PSIService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared files\RichVideo.exe

--
End of file - 6376 bytes

Je n'ai franchement pas d'idée pour ton problème.
Ton rapport est clean.

Peux-tu essayer une réparation Windows ?

Comment faire car avec Une référence a été envoyé par le serveur je ne peux rien faire  

Avec le cd Windows, si tu l'as ...
Ou sinon, tu sauvegardes tes données importantes, et tu fais une réparation au boot si vraiment ça ne marche pas ..
C'est dommage mais bon !

Le problème c'est que c'est quand tu 'a aidé le truc a commencé à venir il n'y avait pas ça avant  

Mais merci

Tu utilises Microsoft SoftGrid?

J'ai trouvé ça aussi, essaie pour voir :

Je suis arrivé jusqu'à système mais je n'ai pas trouvé DWORD

Après système j'ai UIPI --> Clipboard -->Exceptions formats

J'ai testé chez moi, clique sur la clef system, à droite, tu dois voir la valeur ValidateAdminCodeSignatures; si elle est à un , mets la à 0, si ça résout ton problème, ne change rien, sinon remets à 1.