Quel ligne supprimé sur Hijack ?

H3bus · le 21 Mai 2010 16:13

Bonjour à tous,

J'aurai besoin d'un coup de main svp

J'ai fait le Malwarebytes qui n'a rien trouver.

*Voici le rapport Hijack :

Code: Tout sélectionner: ComboFix 09-09-25.01 - Mouzaoui 26/09/2009 15:07.1.2 - NTFSx86 Microsoft® Windows Vista™ Édition Familiale Basique 6.0.6001.1.1252.33.1036.18.3070.1855 [GMT 2:00] Lancé depuis: c:\users\Mouzaoui\Documents\Fichier setup\ComboFix.exe SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} * Un antivirus résident est actif . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . c:\$recycle.bin\S-1-5-21-207698152-2804168146-3376597036-500 c:\$recycle.bin\S-1-5-21-2760852498-2543259003-1422614318-1000 . ((((((((((((((((((((((((((((( Fichiers créés du 2009-08-26 au 2009-09-26 )))))))))))))))))))))))))))))))))))) . 2009-09-26 13:14 . 2009-09-26 13:14 -------- d-----w- c:\users\Default\AppData\Local\temp 2009-09-25 18:56 . 2009-09-25 18:56 -------- d-----w- c:\windows\system32\plesn.chm 2009-09-25 18:53 . 2009-09-25 18:53 -------- d-----w- c:\users\Mouzaoui\AppData\Local\Microsoft Help 2009-09-25 17:58 . 2009-09-25 17:58 -------- d-----w- c:\users\Mouzaoui\AppData\Roaming\Malwarebytes 2009-09-25 17:58 . 2009-09-10 12:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-09-25 17:58 . 2009-09-25 17:58 -------- d-----w- c:\programdata\Malwarebytes 2009-09-25 17:58 . 2009-09-10 12:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-09-25 17:58 . 2009-09-25 17:58 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-09-25 16:51 . 2009-09-25 16:52 -------- d-----w- c:\program files\trend micro 2009-09-25 16:51 . 2009-09-25 16:52 -------- d-----w- C:\rsit 2009-09-25 14:25 . 2009-09-25 14:25 -------- d-----w- c:\program files\Common Files\Uninstall 2009-09-24 11:33 . 2009-09-24 11:37 -------- d-----w- C:\DVDVideoSoft 2009-09-24 11:32 . 2009-09-24 11:41 -------- d-----w- c:\program files\Common Files\DVDVideoSoft 2009-09-24 11:32 . 2009-09-24 11:41 -------- d-----w- c:\program files\DVDVideoSoft 2009-09-24 10:22 . 2009-09-24 17:24 -------- d-----w- c:\users\Mouzaoui\AppData\Roaming\dvdcss 2009-09-24 10:22 . 2009-09-26 12:49 -------- d-----w- c:\users\Mouzaoui\AppData\Roaming\vlc 2009-09-24 10:21 . 2009-09-24 10:21 -------- d-----w- c:\program files\VideoLAN 2009-09-23 22:56 . 2009-06-22 10:22 2048 ----a-w- c:\windows\system32\tzres.dll 2009-09-23 22:32 . 2009-09-23 22:32 -------- d-----w- c:\users\Default\AppData\Local\Microsoft Help 2009-09-23 22:19 . 2008-06-20 01:14 97800 ----a-w- c:\windows\system32\infocardapi.dll 2009-09-23 22:19 . 2008-06-20 01:14 105016 ----a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll 2009-09-23 22:19 . 2008-06-20 01:14 43544 ----a-w- c:\windows\system32\PresentationHostProxy.dll 2009-09-23 22:19 . 2008-06-20 01:14 11264 ----a-w- c:\windows\system32\icardres.dll 2009-09-23 22:19 . 2008-06-20 01:14 622080 ----a-w- c:\windows\system32\icardagt.exe 2009-09-23 22:19 . 2008-06-20 01:14 781344 ----a-w- c:\windows\system32\PresentationNative_v0300.dll 2009-09-23 22:19 . 2008-06-20 01:14 326160 ----a-w- c:\windows\system32\PresentationHost.exe 2009-09-23 22:15 . 2008-07-27 18:03 96760 ----a-w- c:\windows\system32\dfshim.dll 2009-09-23 22:15 . 2008-07-27 18:03 282112 ----a-w- c:\windows\system32\mscoree.dll 2009-09-23 22:15 . 2008-07-27 18:03 41984 ----a-w- c:\windows\system32\netfxperf.dll 2009-09-23 22:15 . 2008-07-27 18:03 158720 ----a-w- c:\windows\system32\mscorier.dll 2009-09-23 22:14 . 2008-07-27 18:03 83968 ----a-w- c:\windows\system32\mscories.dll 2009-09-23 22:14 . 2009-09-23 22:14 -------- d-----w- c:\program files\MSXML 4.0 2009-09-23 17:51 . 2009-09-23 17:52 -------- d-----w- c:\users\Mouzaoui\AppData\Local\Adobe 2009-09-23 14:45 . 2009-04-21 11:55 2033152 ----a-w- c:\windows\system32\win32k.sys 2009-09-23 14:45 . 2008-06-26 01:45 12240896 ----a-w- c:\windows\system32\NlsLexicons0007.dll 2009-09-23 14:45 . 2008-06-26 01:45 2644480 ----a-w- c:\windows\system32\NlsLexicons0009.dll 2009-09-23 14:45 . 2008-06-26 03:29 801280 ----a-w- c:\windows\system32\NaturalLanguage6.dll 2009-09-23 14:43 . 2009-08-28 12:39 28672 ----a-w- c:\windows\system32\Apphlpdm.dll 2009-09-23 14:43 . 2009-08-28 10:15 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll 2009-09-23 14:41 . 2009-09-23 14:41 -------- d-----w- c:\program files\Windows Live SkyDrive 2009-09-23 14:41 . 2009-09-23 14:41 -------- d-----w- c:\program files\Windows Live 2009-09-23 14:41 . 2009-03-17 03:38 13824 ----a-w- c:\windows\system32\apilogen.dll 2009-09-23 14:41 . 2009-03-17 03:38 24064 ----a-w- c:\windows\system32\amxread.dll 2009-09-23 14:41 . 2008-06-23 01:59 996352 ----a-w- c:\windows\system32\WMNetMgr.dll 2009-09-23 14:41 . 2008-06-23 01:58 94720 ----a-w- c:\windows\system32\logagent.exe 2009-09-23 13:40 . 2008-06-26 03:29 303616 ----a-w- c:\windows\system32\wmpeffects.dll 2009-09-23 13:39 . 2009-07-14 12:58 7680 ----a-w- c:\windows\system32\spwmp.dll 2009-09-23 13:39 . 2009-07-14 12:59 4096 ----a-w- c:\windows\system32\dxmasf.dll 2009-09-23 13:39 . 2009-07-14 10:59 8147456 ----a-w- c:\windows\system32\wmploc.DLL 2009-09-23 13:39 . 2009-04-23 12:43 784896 ----a-w- c:\windows\system32\rpcrt4.dll 2009-09-23 13:39 . 2008-04-26 08:08 1314816 ----a-w- c:\windows\system32\quartz.dll 2009-09-23 13:39 . 2008-12-16 02:42 288768 ----a-w- c:\windows\system32\drivers\srv.sys 2009-09-23 13:39 . 2008-06-19 03:31 361984 ----a-w- c:\windows\system32\IPSECSVC.DLL 2009-09-23 13:39 . 2008-06-26 03:29 565248 ----a-w- c:\windows\system32\emdmgmt.dll 2009-09-23 13:39 . 2008-08-02 03:26 36864 ----a-w- c:\windows\system32\cdd.dll 2009-09-23 13:39 . 2008-08-02 01:01 625152 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys 2009-09-23 13:39 . 2008-06-26 03:29 45056 ----a-w- c:\windows\system32\dataclen.dll 2009-09-23 13:39 . 2008-05-20 02:07 148480 ----a-w- c:\windows\system32\drivers\nwifi.sys 2009-09-23 13:31 . 2008-09-10 03:40 1334272 ----a-w- c:\windows\system32\msxml6.dll 2009-09-23 13:26 . 2008-10-16 21:09 43544 ----a-w- c:\windows\system32\wups2.dll 2009-09-23 13:26 . 2008-10-16 21:13 1809944 ----a-w- c:\windows\system32\wuaueng.dll 2009-09-23 13:26 . 2008-10-16 21:09 51224 ----a-w- c:\windows\system32\wuauclt.exe 2009-09-23 13:26 . 2008-10-16 20:56 1524736 ----a-w- c:\windows\system32\wucltux.dll 2009-09-23 13:26 . 2008-10-16 21:12 561688 ----a-w- c:\windows\system32\wuapi.dll 2009-09-23 13:26 . 2008-10-16 21:08 34328 ----a-w- c:\windows\system32\wups.dll 2009-09-23 13:26 . 2008-10-16 20:55 83456 ----a-w- c:\windows\system32\wudriver.dll 2009-09-23 13:26 . 2008-10-16 12:08 162064 ----a-w- c:\windows\system32\wuwebv.dll 2009-09-23 13:26 . 2008-10-16 11:56 31232 ----a-w- c:\windows\system32\wuapp.exe 2009-09-23 13:19 . 2009-09-23 13:19 -------- d-----w- c:\users\Mouzaoui\AppData\Roaming\eSobi 2009-09-23 13:16 . 2009-09-24 18:50 -------- d-----w- c:\users\Mouzaoui\AppData\Local\Google 2009-09-23 13:15 . 2009-09-25 20:38 -------- d-----w- c:\programdata\Partner 2009-09-23 13:15 . 2009-09-24 09:13 -------- d-----w- c:\program files\Google 2009-09-23 13:15 . 2009-09-25 20:42 71280 ----a-w- c:\users\Mouzaoui\AppData\Local\GDIPFONTCACHEV1.DAT 2009-09-23 13:15 . 2009-09-23 13:16 -------- d-----w- C:\ACERSW 2009-09-23 13:10 . 2009-09-23 13:10 -------- d-sh--we c:\users\Default\Voisinage réseau 2009-09-23 13:10 . 2009-09-23 13:10 -------- d-sh--we c:\users\Default\Voisinage d'impression 2009-09-23 13:10 . 2009-09-23 13:10 -------- d-sh--we c:\users\Default\Modèles 2009-09-23 13:10 . 2009-09-23 13:10 -------- d-sh--we c:\users\Default\Mes documents 2009-09-23 13:10 . 2009-09-23 13:10 -------- d-sh--we c:\users\Default\Menu Démarrer 2009-09-23 13:10 . 2009-09-23 13:10 -------- d-sh--we c:\users\Default\AppData\Local\Historique 2009-09-23 13:10 . 2009-09-23 13:10 -------- d-sh--we c:\programdata\Modèles 2009-09-23 13:10 . 2009-09-23 13:10 -------- d-sh--we c:\programdata\Menu Démarrer 2009-09-23 13:10 . 2009-09-23 13:10 -------- d-sh--we c:\programdata\Favoris 2009-09-23 13:10 . 2009-09-23 13:10 -------- d-sh--we c:\programdata\Bureau 2009-09-23 13:10 . 2009-09-23 13:10 -------- d-sh--we c:\program files\Fichiers communs . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2009-09-26 12:11 . 2009-09-26 12:11 -------- d-----w- c:\users\Mouzaoui\AppData\Roaming\DeepBurner 2009-09-26 12:10 . 2009-09-26 12:10 -------- d-----w- c:\program files\Astonsoft 2009-09-26 11:51 . 2009-09-26 11:50 -------- d-----w- c:\users\Mouzaoui\AppData\Roaming\CyberLink 2009-09-26 11:50 . 2009-09-26 11:50 -------- d-----w- c:\programdata\CyberLink 2009-09-26 11:11 . 2008-01-21 07:23 669328 ----a-w- c:\windows\system32\perfh00C.dat 2009-09-26 11:11 . 2008-01-21 07:23 123350 ----a-w- c:\windows\system32\perfc00C.dat 2009-09-26 11:04 . 2008-05-12 17:34 -------- d-----w- c:\programdata\Microsoft Help 2009-09-25 20:42 . 2008-05-12 17:06 -------- d-----w- c:\programdata\NVIDIA 2009-09-25 18:51 . 2008-05-12 17:36 -------- d-----w- c:\program files\Microsoft Works 2009-09-25 09:49 . 2008-05-12 17:18 -------- d-----w- c:\program files\McAfee 2009-09-24 16:40 . 2008-05-12 17:18 -------- d-----w- c:\programdata\McAfee 2009-09-24 16:37 . 2008-05-12 17:22 -------- d-----w- c:\program files\Common Files\Adobe 2009-09-24 16:35 . 2008-05-12 17:20 -------- d-----w- c:\programdata\SiteAdvisor 2009-09-24 09:15 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail 2009-07-26 14:44 . 2009-07-26 14:44 48448 ----a-w- c:\windows\system32\sirenacm.dll 2009-07-18 16:06 . 2009-09-23 14:44 827904 ----a-w- c:\windows\system32\wininet.dll 2009-07-18 16:01 . 2009-09-23 14:44 78336 ----a-w- c:\windows\system32\ieencode.dll 2009-07-18 09:46 . 2009-09-23 14:44 26624 ----a-w- c:\windows\system32\ieUnatt.exe 2009-07-17 14:35 . 2009-09-23 14:40 71680 ----a-w- c:\windows\system32\atl.dll 2009-07-16 10:32 . 2008-05-12 17:19 130424 ----a-w- c:\windows\system32\drivers\Mpfp.sys 2009-07-14 13:00 . 2009-09-23 13:40 313344 ----a-w- c:\windows\system32\wmpdxm.dll 2009-07-11 19:32 . 2009-09-23 13:40 302592 ----a-w- c:\windows\system32\wlansec.dll 2009-07-11 19:32 . 2009-09-23 13:40 293376 ----a-w- c:\windows\system32\wlanmsm.dll 2009-07-11 19:32 . 2009-09-23 13:40 513024 ----a-w- c:\windows\system32\wlansvc.dll 2009-07-11 19:29 . 2009-09-23 13:40 127488 ----a-w- c:\windows\system32\L2SecHC.dll 2009-07-08 11:44 . 2008-05-12 17:19 79816 ----a-w- c:\windows\system32\drivers\mfeavfk.sys 2009-07-08 11:44 . 2008-05-12 17:19 40552 ----a-w- c:\windows\system32\drivers\mfesmfk.sys 2009-07-08 11:44 . 2008-05-12 17:19 35272 ----a-w- c:\windows\system32\drivers\mfebopk.sys 2009-07-08 11:44 . 2008-05-12 17:19 214024 ----a-w- c:\windows\system32\drivers\mfehidk.sys 2009-07-08 11:43 . 2008-05-12 17:19 34248 ----a-w- c:\windows\system32\drivers\mferkdk.sys . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP] @="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}" [HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}] 2008-03-04 21:38 121392 ----a-w- c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-09-23 68856] "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856] "WindowsWelcomeCenter"="oobefldr.dll" - c:\windows\System32\oobefldr.dll [2008-01-21 2153472] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184] "Acer Empowering Technology Monitor"="c:\program files\Acer\Empowering Technology\SysMonitor.exe" [2008-04-25 319488] "EmpoweringTechnology"="c:\program files\Acer\Empowering Technology\Framework.Launcher.exe" [2008-04-25 319488] "mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-07-09 645328] "eDataSecurity Loader"="c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe" [2008-03-04 526896] "RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2007-01-08 68640] "LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2007-01-08 52256] "BkupTray"="c:\program files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe" [2008-04-25 28672] "WarReg_PopUp"="c:\program files\Acer\WR_PopUp\WarReg_PopUp.exe" [2008-01-29 303104] "Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2009-09-23 24064] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-14 39792] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-03-27 13687328] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-03-27 92704] "Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080] "RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2008-03-26 5369856] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "mixer2"=wdmaud.drv [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] SetupExecute REG_MULTI_SZ \0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend] @="Service" [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{773E2FD2-EB80-4473-BFAE-606F107B2017}"= Profile=Private|Profile=Public|c:\program files\Common Files\Mcafee\MNA\McNaSvc.exe:McAfee Network Agent "{A3381893-2AA0-4938-A355-21044CC1FD38}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{726EBDFD-BD05-4FBD-8217-24BE7CD31641}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{A2833FA7-F393-4028-90D9-94D8954EB299}"= c:\program files\Cyberlink\PowerDirector\PDR.EXE:CyberLink PowerDirector "{95A5B6F1-AB4A-4C0F-B316-3D358944C376}"= c:\program files\CyberLink\PowerDVD\PowerDVD.EXE:CyberLink PowerDVD "{514999C6-0ACD-41F3-9C36-59FF44C1BAE0}"= c:\program files\Acer Arcade Live\Acer DVDivine\Acer DVDivine.exe:Acer DVDivine "{5CFAD744-915B-4F15-8DEA-B7244EC4EBD8}"= UDP:c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe:AgentSvc.exe "{8275CD3F-1453-4C44-A1F3-8C90FF18ED20}"= UDP:c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe:BackupSvc.exe "{D6ADAA43-FB47-4EE8-B085-ECF97F8CB172}"= TCP:c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe:AgentSvc.exe "{AA097394-2D5A-4B89-A22C-D684290F69B8}"= TCP:c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe:BackupSvc.exe "{9773C304-2055-4323-B6F9-58F8A64358B0}"= UDP:c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe:SchedulerSvc.exe "{E6598C06-23F9-45A7-AA87-F69F70F6DE5D}"= TCP:c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe:SchedulerSvc.exe R2 BUNAgentSvc;NTI Backup Now 5 Agent Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe [03/03/2008 13:11 16384] R2 ETService;Empowering Technology Service;c:\program files\Acer\Empowering Technology\Service\ETService.exe [12/05/2008 19:16 24576] R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [24/09/2009 18:35 210216] R2 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [25/04/2008 21:36 45056] R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\System32\drivers\nvhda32v.sys [12/05/2008 12:42 43552] S2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [25/04/2008 21:36 131072] S3 GoogleDesktopManager-080708-050100;Google Desktop Manager 5.7.808.7150;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [23/09/2009 15:15 24064] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc . Contenu du dossier 'Tâches planifiées' 2008-05-12 c:\windows\Tasks\McDefragTask.job - c:\progra~1\mcafee\mqc\QcConsol.exe [2009-09-24 19:26] 2008-05-12 c:\windows\Tasks\McQcTask.job - c:\progra~1\mcafee\mqc\QcConsol.exe [2009-09-24 19:26] . . ------- Examen supplémentaire ------- . uStart Page = hxxp://www.google.fr/ mStart Page = hxxp://fr.fr.acer.yahoo.com IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 LSP: %SYSTEMROOT%\system32\nvLsp.dll . - - - - ORPHELINS SUPPRIMES - - - - WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file) HKLM-Run-eRecoveryService - (no file) ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-09-26 15:14 Windows 6.0.6001 Service Pack 1 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** . --------------------- CLES DE REGISTRE BLOQUEES --------------------- [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation] "Enabled"=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10c.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}] @Denied: (A 2) (Everyone) @="IFlashBroker3" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . --------------------- DLLs chargées dans les processus actifs --------------------- - - - - - - - > 'Explorer.exe'(8680) c:\windows\system32\NVSVC.DLL c:\program files\McAfee\SiteAdvisor\saHook.dll c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll c:\program files\Acer\Empowering Technology\eDataSecurity\x86\sysenv.dll . Heure de fin: 2009-09-26 15:16 ComboFix-quarantined-files.txt 2009-09-26 13:16 Avant-CF: 116 585 029 632 octets libres Après-CF: 116 302 016 512 octets libres 259 --- E O F --- 2009-09-26 11:04

NEO HYUGA · le 21 Mai 2010 16:26

salut,

ca ressemble pas trop a un rapport hijack, enfin le site ne reconnait pas le log, il mouline dans le vide.

essayes de nous en poster un, un peu plus propre, inseré dans les balises comme c est indiqué en haut de page sur fond rouge

H3bus · le 21 Mai 2010 17:12

En effet, c'est un rapport Combofix...

bernard53 · le 21 Mai 2010 19:39

Bonjour a tous

Rapport Combofix OK mais attention on ne lance pas ce genre d'outils comme cela. :oops:

Par contre pourquoi mettre ce rapport sans plus d'explication s.t.p

dz.malek · le 24 Mai 2010 11:12

Désolé

Voila le vrai rapport

Code: Tout sélectionner: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:10:39, on 24/05/2010 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v7.00 (7.00.6001.18444) Boot mode: Normal Running processes: C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\taskeng.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Windows\RtHDVCpl.exe C:\Program Files\Acer\Empowering Technology\SysMonitor.exe C:\Program Files\Acer\Empowering Technology\Framework.Launcher.exe C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe C:\Program Files\Cyberlink\PowerDVD\PDVDServ.exe C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe C:\Windows\System32\rundll32.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Program Files\SFR\9Giga Synchro\9Giga_Synchro.exe C:\Program Files\Ares\Ares.exe C:\Program Files\DAEMON Tools Lite\daemon.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\OpenOffice.org 3\program\soffice.exe C:\Program Files\OpenOffice.org 3\program\soffice.bin C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe C:\Program Files\Windows Live\Contacts\wlcomm.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtblfs.exe C:\Users\Mouzaoui\Desktop\solution.exe C:\Windows\system32\wuauclt.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = ${URL_SEARCHPAGE} R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource=10&ctid=CT2102473 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&l=040c&s=1&o=vb32&d=1006&m=aspire_x3200 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = ${URL_SEARCHPAGE} R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.myheritage.com R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: (no name) - {91C18ED5-5E1C-4AE5-A148-A861DE8C8E16} - (no file) R3 - URLSearchHook: ToolbarURLSearchHook Class - {CA3EB689-8F09-4026-AA10-B9534C691CE0} - C:\Program Files\Blingee Plus\tbhelper.dll R3 - URLSearchHook: UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll R3 - URLSearchHook: MHURLSearchHook Class - {1C4AB6A5-595F-4e86-B15F-F93CCE2BBD48} - C:\Program Files\Celebrity Toolbar\tbhelper.dll O1 - Hosts: ::1 localhost O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: MHTBPos00 - {0C37B053-FD68-456a-82E1-D788EE342E6F} - C:\Program Files\Celebrity Toolbar\tbcore3.dll O2 - BHO: Aide à la navigation SFR - {0F6E720A-1A6B-40E1-A294-1D4D19F156C8} - C:\Program Files\SFR\Kit\SFRNavErrorHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\ievkbd.dll O2 - BHO: BrowserHelper Class - {8A9D74F9-560B-4FE7-ABEB-3B2E638E5CD6} - C:\Program Files\SGPSA\SearchAssistant.dll (file missing) O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll O2 - BHO: (no name) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - (no file) O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll O2 - BHO: MyHeritage New Tab - {D62EC836-BF1E-4CAC-81BE-FB9179835D8E} - C:\Program Files\Celebrity Toolbar\mhxpcomi.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll O2 - BHO: BlingeeTb - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files\Blingee Plus\blingeetb.dll O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll O3 - Toolbar: Blingee Toolbar - {D1121FE0-0145-44C9-AA35-72071AC20A9B} - C:\Program Files\Blingee Plus\blingeetb.dll O3 - Toolbar: Nero Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll O3 - Toolbar: Celebrity Toolbar - {FD2FD708-1F6F-4B68-B141-C5778F0C19BB} - C:\Program Files\Celebrity Toolbar\tbcore3.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\Program Files\Acer\Empowering Technology\SysMonitor.exe O4 - HKLM\..\Run: [EmpoweringTechnology] C:\Program Files\Acer\Empowering Technology\Framework.Launcher.exe boot O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" O4 - HKLM\..\Run: [BkupTray] "C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe" O4 - HKLM\..\Run: [WarReg_PopUp] C:\Program Files\Acer\WR_PopUp\WarReg_PopUp.exe O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe" /hide O4 - HKLM\..\Run: [FBSSA] C:\Program Files\SGPSA\ie3sh.exe O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [9Giga Synchro] "C:\Program Files\SFR\9Giga Synchro\9Giga_Synchro.exe" /delayed O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - Startup: OpenOffice.org 3.2.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Clavier &virtuel - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: Analyse des &liens - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab O16 - DPF: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} (CamfrogWEB Advanced Unicode Control) - http://activex.camfrogweb.com/advanced/2.0.2.20/cfweb_activex.camfrogweb.com-advanced-2.0.2.20_instmodule.exe O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab O18 - Protocol: mhtb - {669A2A3A-F19C-452D-800D-1240299756C1} - C:\Program Files\Celebrity Toolbar\mhxpcomi.dll O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - (no file) O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\bin32\nSvcAppFlt.exe O23 - Service: Google Desktop Manager 5.9.911.3589 (GoogleDesktopManager-110309-193829) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: Service Google Update (gupdate1ca46d38810d68c) (gupdate1ca46d38810d68c) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - C:\Program Files\bin32\nSvcIp.exe O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared files\RichVideo.exe -- End of file - 13787 bytes

EDIT Skynet : Balises [code] ajoutées.

Skynet · le 24 Mai 2010 11:16

Bonjour,

vous avez une consigne en haut du forum pour les rapports, de même lorsque vous postez c'est encore indiqué bien évidence.

Merci de la respecter.

Bonne continuation.

dz.malek · le 24 Mai 2010 11:26

Skynet a écrit:Bonjour,

vous avez une consigne en haut du forum pour les rapports, de même lorsque vous postez c'est encore indiqué bien évidence.

Merci de la respecter.

Bonne continuation.

bernard53 · le 24 Mai 2010 12:34

Bonjour

fait ceci dz.malek

Relance HijackThis >puis : Do a system scan only > coche ces lignes: ensuite valides sur Fix checked

R3 - URLSearchHook: (no name) - {91C18ED5-5E1C-4AE5-A148-A861DE8C8E16} - (no file)
R3 - URLSearchHook: ToolbarURLSearchHook Class - {CA3EB689-8F09-4026-AA10-B9534C691CE0} - C:\Program Files\Blingee Plus\tbhelper.dll
R3 - URLSearchHook: UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll
R3 - URLSearchHook: MHURLSearchHook Class - {1C4AB6A5-595F-4e86-B15F-F93CCE2BBD48} - C:\Program Files\Celebrity Toolbar\tbhelper.dll
O2 - BHO: MHTBPos00 - {0C37B053-FD68-456a-82E1-D788EE342E6F} - C:\Program Files\Celebrity Toolbar\tbcore3.dll
O2 - BHO: BrowserHelper Class - {8A9D74F9-560B-4FE7-ABEB-3B2E638E5CD6} - C:\Program Files\SGPSA\SearchAssistant.dll (file missing)
O2 - BHO: (no name) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - (no file)
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: MyHeritage New Tab - {D62EC836-BF1E-4CAC-81BE-FB9179835D8E} - C:\Program Files\Celebrity Toolbar\mhxpcomi.dll
O2 - BHO: BlingeeTb - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files\Blingee Plus\blingeetb.dll
O3 - Toolbar: Blingee Toolbar - {D1121FE0-0145-44C9-AA35-72071AC20A9B} - C:\Program Files\Blingee Plus\blingeetb.dll
O3 - Toolbar: Nero Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O3 - Toolbar: Celebrity Toolbar - {FD2FD708-1F6F-4B68-B141-C5778F0C19BB} - C:\Program Files\Celebrity Toolbar\tbcore3.dll
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\Program Files\Acer\Empowering Technology\SysMonitor.exe
O4 - HKLM\..\Run: [EmpoweringTechnology] C:\Program Files\Acer\Empowering Technology\Framework.Launcher.exe boot
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Program Files\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [FBSSA] C:\Program Files\SGPSA\ie3sh.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [9Giga Synchro] "C:\Program Files\SFR\9Giga Synchro\9Giga_Synchro.exe" /delayed
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - Startup: OpenOffice.org 3.2.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O18 - Protocol: mhtb - {669A2A3A-F19C-452D-800D-1240299756C1} - C:\Program Files\Celebrity Toolbar\mhxpcomi.dll

Ensuite::

** Télécharge ToolBar-S&D (D'Angeldark, Sham_Rock & XmichouX) sur ton bureau.

Double-clique sur l'icône

afin de lancer l’installation.

Une fois installé, un raccourci

sera ajouté sur le Bureau. Double-clique dessus pour démarrer l’outil.

dans la fenêtre qui s'ouvre, pour le langue tape "F" >> Appuis un fois sur la touche "entrer"

dans la fenêtre qui s'ouvre fais le choix N°2 (Suppression) >> Appuis une fois sur la touche "entrer"

Patiente jusqu'à la fin de la recherche >> Sauvegarde le rapport qui s'ouvre à la fin du scan sur ton bureau et poste le dans ta prochaine réponse stp...

** Poste le rapport généré : (C:\TB.txt)

Puis::

Télécharge >>OTM<< (de Old_Timer) sur ton Bureau.

>> Pour VISTA : Clic-droit et choisis "Exécuter en tant qu'administrateur".

>> AVAST reconnait ce logiciel comme un intrus, donc le désactiver le temps des manipulations.

Double-clique sur OTM pour le lancer.

Copie la liste qui se trouve en citation ci-dessous:

Code: Tout sélectionner: :Reg [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks] "{00000000-6E41-4FD3-8538-502F5495E5FC}"=- [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8A9D74F9-560B-4FE7-ABEB-3B2E638E5CD6}] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8A9D74F9-560B-4FE7-ABEB-3B2E638E5CD6}] [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}] [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}] [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}] [-HKEY_CLASSES_ROOT\CLSID\{D1121FE0-0145-44C9-AA35-72071AC20A9B}] [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D1121FE0-0145-44C9-AA35-72071AC20A9B}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{D1121FE0-0145-44C9-AA35-72071AC20A9B}"=- [-HKEY_CLASSES_ROOT\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}] [-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{D4027C7F-154A-4066-A1AD-4243D8127440}"=- [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "FBSSA"=- :Files c:\program files\sgpsa c:\program files\blingee plus :Commands [emptytemp] [Reboot]

et colle-la dans le cadre de gauche de OTM sous ceci:

Clique sur

pour lancer la suppression.
attendre la fin du travail de l'outil puis fermer OTM

Le résultat apparaitra dans le cadre Results.
Clique sur Exit pour fermer.
Poste le rapport situé dans C:\_OTM\MovedFiles\06092009_130526.log "Exemple"

NB: Il te sera peut-être demandé de redémarrer le pc pour achever la suppression.
si c'est le cas accepte par Oui/Yes.

dz.malek · le 24 Mai 2010 13:52

J'ai bien effacer les lignes, mais quand je lance la 2eme étape ( ToolbarSD) au bout d'un moment sa bloque et une fenetre me disant l'utilitaire QGREP a cessé de fonctionner viens :-?

bernard53 · le 24 Mai 2010 16:46

Ne fais pas ToolbarSD dans ce cas et passe a la suite s.t.p

dz.malek · le 24 Mai 2010 22:13

Il m'est arrivé la meme chose avec la suite programme ne répond plus

bernard53 · le 25 Mai 2010 11:52

dz.malek a écrit:Il m'est arrivé la meme chose avec la suite programme ne répond plus

Tu les as bien lancer. "clique-droit puis exécuter en tant qu'administrateur!"

dz.malek · le 25 Mai 2010 20:42

Oui exactement :-?

bernard53 · le 25 Mai 2010 20:47

redémarres le pc et retentes le lancement soit OTM soit ToolBar-S&D s.t.p

dz.malek · le 25 Mai 2010 20:54

Deja fait

Quel ligne supprimé sur Hijack ?

Quel ligne supprimé sur Hijack ?

Re: Quel ligne supprimé sur Hijack ?

Re: Quel ligne supprimé sur Hijack ?

Re: Quel ligne supprimé sur Hijack ?

Re: Quel ligne supprimé sur Hijack ?

Re:

Re: Quel ligne supprimé sur Hijack ?

Re: Quel ligne supprimé sur Hijack ?

Re: Quel ligne supprimé sur Hijack ?

Re: Quel ligne supprimé sur Hijack ?

Re: Quel ligne supprimé sur Hijack ?

Re: Quel ligne supprimé sur Hijack ?

Re: Quel ligne supprimé sur Hijack ?

Re: Quel ligne supprimé sur Hijack ?

Sujets similaires

Qui est en ligne