[Réglé] Alpha antivirus probleme.

esol · le 28 Sep 2009 17:24

Bonjour j'ai tout comme un grand nombre d'internautes le probleme de la désinstallation d'alpha antivirus.

Ne sachant pas ce que le log de hijackthis veut dire je ne sais pas quoi supprimer.

Je copie le log ici :

J'espere que ce sera suffisant.

Je me tiens a votre disposition pour toute demande d'information complementaire.

Merci

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:47:07, on 25/09/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18813)
Boot mode: Normal

Running processes:
C:Windowssystem32Dwm.exe
C:WindowsExplorer.EXE
C:Windowssystem32 askeng.exe
C:Windowssystem32 askeng.exe
C:Program FilesAlphaAVAlpha Antivirus.exe
C:Program FilesCheckPointAForceFieldForceField.exe
C:Program FilesWindows DefenderMSASCui.exe
C:Program FilesAcerEmpowering TechnologySysMonitor.exe
C:Program FilesAcerEmpowering TechnologyFramework.Launcher.exe
C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDSLoader.exe
C:WindowsRtHDVCpl.exe
C:Program FilesMozilla Firefoxfirefox.exe
C:WindowsSystem32
undll32.exe
C:Program FilesNewTech InfosystemsNTI Backup Now 5BkupTray.exe
C:Program FilesGoogleGoogle Desktop SearchGoogleDesktop.exe
C:WindowsWindowsMobilewmdSync.exe
C:Program FilesAVGAVG8avgtray.exe
C:Program FilesCommon FilesRealUpdate_OB
ealsched.exe
C:Program FilesJavajre6injusched.exe
C:Program FilesiTunesiTunesHelper.exe
C:Program Filesone LabsoneAlarmzlclient.exe
C:Program FilesWindows LiveMessengermsnmsgr.exe
C:Windowsehomeehtray.exe
C:Windowsehomeehmsas.exe
C:Program FilesGoogleGoogle Desktop SearchGoogleDesktop.exe
C:Program FilesAcerEmpowering TechnologyeDataSecurityx86MsnVane.exe
C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDSdts.exe
C:Windowssystem32SearchFilterHost.exe
C:Program FilesTrend MicroHijackThisHijackThis.exe
C:Windowssystem32DllHost.exe

R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://fr.msn.com/
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://homepage.acer.com/rdr.aspx?b=ACA ... pire_x1700
R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant =
R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch =
R1 - HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyOverride = *.local
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: (no name) - *{ecdee021-0d17-467f-a1ff-c7a115230949} - (no file)
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:Program FilesAVGAVG8ToolbarIEToolbar.dll
R3 - URLSearchHook: (no name) - *{00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:Program FilesAVGAVG8avgssie.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:Program FilesMicrosoftSearch Enhancement PackSearch HelperSEPsearchhelperie.dll
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:Program FilesAcerEmpowering TechnologyeDataSecurityx86ActiveToolBand.dll
O2 - BHO: ZoneAlarm Toolbar Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:Program FilesCheckPointAForceFieldTrustCheckerinTrustCheckerIEPlugin.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:Program FilesCommon FilesMicrosoft SharedWindows LiveWindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:Program FilesAVGAVG8ToolbarIEToolbar.dll
O2 - BHO: (no name) - {A77D3539-581D-450C-9E44-A84C415A6172} - C:WindowsSystem32msnaoladdon.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:Program FilesGoogleGoogle ToolbarGoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:Program FilesGoogleGoogleToolbarNotifier5.0.926.3450swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:Program FilesGoogleGoogle ToolbarComponentfastsearch_219B3E1547538286.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:Program FilesJavajre6injp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:Program FilesWindows LiveToolbarwltcore.dll
O2 - BHO: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:Program Filesfree-downloads.net bfree.dll
O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:Program FilesAskSBarar1.binASKSBAR.DLL
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDStoolbar.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:Program FilesWindows LiveToolbarwltcore.dll
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:Program FilesAskSBarar1.binASKSBAR.DLL
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:Program FilesGoogleGoogle ToolbarGoogleToolbar.dll
O3 - Toolbar: (no name) - {312105C4-2E13-4E10-AF72-F9D79BA077E6} - (no file)
O3 - Toolbar: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:Program Filesfree-downloads.net bfree.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:Program FilesAVGAVG8ToolbarIEToolbar.dll
O3 - Toolbar: ZoneAlarm Toolbar - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:Program FilesCheckPointAForceFieldTrustCheckerinTrustCheckerIEPlugin.dll
O4 - HKLM..Run: [Windows Defender] %ProgramFiles%Windows DefenderMSASCui.exe -hide
O4 - HKLM..Run: [Acer Empowering Technology Monitor] C:Program FilesAcerEmpowering TechnologySysMonitor.exe
O4 - HKLM..Run: [EmpoweringTechnology] C:Program FilesAcerEmpowering TechnologyFramework.Launcher.exe boot
O4 - HKLM..Run: [eDataSecurity Loader] C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDSloader.exe
O4 - HKLM..Run: [PCMMediaSharing] C:Program FilesAcer Arcade LiveAcer HomeMedia ConnectKernelDMSPCMMediaSharing.exe
O4 - HKLM..Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:Windowssystem32NvCpl.dll,NvStartup
O4 - HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:Windowssystem32NvMcTray.dll,NvTaskbarInit
O4 - HKLM..Run: [BkupTray] "C:Program FilesNewTech InfosystemsNTI Backup Now 5BkupTray.exe"
O4 - HKLM..Run: [WarReg_PopUp] C:Program FilesAcerWR_PopUpWarReg_PopUp.exe
O4 - HKLM..Run: [Google Desktop Search] "C:Program FilesGoogleGoogle Desktop SearchGoogleDesktop.exe" /startup
O4 - HKLM..Run: [Setresolution] C:ACERconfig1680x1050.cmd
O4 - HKLM..Run: [Adobe Reader Speed Launcher] "C:Program FilesAdobeReader 8.0ReaderReader_sl.exe"
O4 - HKLM..Run: [Windows Mobile-based device management] %windir%WindowsMobilewmdSync.exe
O4 - HKLM..Run: [AVG8_TRAY] C:PROGRA~1AVGAVG8avgtray.exe
O4 - HKLM..Run: [TkBellExe] "C:Program FilesCommon FilesRealUpdate_OB
ealsched.exe" -osboot
O4 - HKLM..Run: [V0530Pin.dll] RunDLL32.exe V0530Pin.dll,RunDLL32EP 514,/d:0
O4 - HKLM..Run: [SunJavaUpdateSched] "C:Program FilesJavajre6injusched.exe"
O4 - HKLM..Run: [QuickTime Task] "C:Program FilesQuickTimeQTTask.exe" -atboottime
O4 - HKLM..Run: [iTunesHelper] "C:Program FilesiTunesiTunesHelper.exe"
O4 - HKLM..Run: [ZoneAlarm Client] "C:Program Filesone LabsoneAlarmzlclient.exe"
O4 - HKLM..Run: [ISW] "C:Program FilesCheckPointAForceFieldForceField.exe" /icon="hidden"
O4 - HKCU..Run: [msnmsgr] "C:Program FilesWindows LiveMessengermsnmsgr.exe" /background
O4 - HKCU..Run: [ehTray.exe] C:WindowsehomeehTray.exe
O4 - HKCU..Run: [AlcoholAutomount] "C:Program FilesAlcohol SoftAlcohol 52axcmd.exe" /automount
O4 - HKUSS-1-5-19..Run: [Sidebar] %ProgramFiles%Windows SidebarSidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUSS-1-5-19..Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUSS-1-5-20..Run: [Sidebar] %ProgramFiles%Windows SidebarSidebar.exe /detectMem (User 'SERVICE RESEAU')
O4 - Startup: OneNote 2007 - Capture d'écran et lancement.lnk = C:Program FilesMicrosoft OfficeOffice12ONENOTEM.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:PROGRA~1MICROS~2Office12EXCEL.EXE/3000
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:Program FilesWindows LiveWriterWriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:Program FilesWindows LiveWriterWriterBrowserExtension.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:PROGRA~1MICROS~2Office12ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:PROGRA~1MICROS~2Office12ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:PROGRA~1MICROS~2Office12REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:ProgramsPartyGamingPartyPokerRunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:ProgramsPartyGamingPartyPokerRunApp.exe
O13 - Gopher Prefix:
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.co ... nos/gp.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:Program FilesAVGAVG8avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:PROGRA~1COMMON~1SkypeSKYPE4~1.DLL
O20 - AppInit_DLLs: C:PROGRA~1GoogleGOOGLE~1GOEC62~1.DLL,avgrsstx.dll
O23 - Service: Acer HomeMedia Connect Service - CyberLink - C:Program FilesAcer Arcade LiveAcer HomeMedia ConnectKernelDMSCLMSServer.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:Program FilesCommon FilesAppleMobile Device SupportinAppleMobileDeviceService.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:PROGRA~1AVGAVG8avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:PROGRA~1AVGAVG8avgwdsvc.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:Program FilesBonjourmDNSResponder.exe
O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:Program FilesNewTech InfosystemsNTI Backup Now 5ClientAgentsvc.exe
O23 - Service: eDataSecurity Service - Egis Incorporated - C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDSService.exe
O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:Program FilesAcerEmpowering TechnologyServiceETService.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:Program FilesNOSingetPlus_HelperSvc.exe
O23 - Service: Google Desktop Manager 5.7.808.7150 (GoogleDesktopManager-080708-050100) - Google - C:Program FilesGoogleGoogle Desktop SearchGoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:Program FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:Program FilesCommon FilesInstallShieldDriver1150Intel 32IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:Program FilesiPodiniPodService.exe
O23 - Service: ZoneAlarm Toolbar IswSvc (IswSvc) - Check Point Software Technologies - C:Program FilesCheckPointAForceFieldIswSvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:Program FilesCommon FilesLightScribeLSSrvc.exe
O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:Program FilesNewTech InfosystemsNTI Backup Now 5BackupSvc.exe
O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:Program FilesNewTech InfosystemsNTI Backup Now 5SchedulerSvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:Windowssystem32
vvsvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:Program FilesCyberLinkShared FilesRichVideo.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:Program FilesAlcohol SoftAlcohol 52StarWindStarWindServiceAE.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:WindowsSystem32oneLabsvsmon.exe

--
End of file - 13655 bytes

danakil · le 28 Sep 2009 18:48

Salut !

Effectivement AlphaAV pollue ton PC. Cependant cela n'est pas la seule infection visible. Tu as cela également :
--> SD et BT AskSBar.Adw

On va rapidement te débarasser de tout cela !

Fais ceci :
Télécharge ComboFix de sUBs sur ton Bureau et pas ailleurs.

*** Déconnectes toi d'internet et désactives ton antivirus pour que ComboFix puisse s'exécuter normalement ***

> Double clique (ou clic droit ...) sur ComboFix.exe

et suis les instructions.
(Si demandé, sélectionne la langue et l'option 1 puis valide).

> Installe la console de récupération si proposé et continue.

!!! Ne touches à rien tant que le scan n'est pas terminé !!!

> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.
(il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.)

NOTE : Le rapport se trouve également ici : C:ComboFix.txt

esol · le 29 Sep 2009 17:51

Hello ! voila ComboFix a rendu son verdic :

ComboFix 09-09-28.01 - amel 29/09/2009 18:40.1.2 - NTFSx86
Microsoft® Windows Vista™ Edition Familiale Premium 6.0.6001.1.1252.33.1036.18.3070.2139 [GMT 2:00]
Lancé depuis: c:usersamelDesktopComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:$recycle.binS-1-5-21-2706789884-806865376-2586035963-500
c:$recycle.binS-1-5-21-3111458835-3052962557-2577522370-1000
c:usersamelAppDataRoaming.#
c:usersamelAppDataRoamingMicrosoftClip Organizermstore10.mgc
c:usersamelAppDataRoamingMicrosoftClip OrganizerOffic10.MGC
c:windowsSystem32msNAoladdon.dll

.
((((((((((((((((((((((((((((( Fichiers créés du 2009-08-28 au 2009-09-29 ))))))))))))))))))))))))))))))))))))
.

2009-09-29 16:47 . 2009-09-29 16:47 -------- d-----w- c:usersDefaultAppDataLocal emp
2009-09-29 14:08 . 2008-07-29 16:43 16384 ----a-w- C:msimg32.dll
2009-09-28 15:33 . 2009-09-28 15:33 680 ----a-w- c:usersamelAppDataLocald3d9caps.dat
2009-09-25 11:43 . 2009-09-25 11:43 -------- d-----w- c:program filesTrend Micro
2009-09-23 17:09 . 2009-09-23 17:09 -------- d-----w- c:programdataKaspersky SDK
2009-09-23 16:55 . 2009-09-25 11:43 -------- d-----w- c:usersamelAppDataRoamingCheckPoint
2009-09-23 16:55 . 2009-09-23 16:55 -------- d-----w- c:program filesCheckPoint
2009-09-23 16:54 . 2009-08-26 19:09 72584 ----a-w- c:windowszllsputility.exe
2009-09-23 16:51 . 2009-09-23 16:51 -------- d-----w- c:programdataCheckPoint
2009-09-23 16:51 . 2009-09-29 09:53 -------- d-----w- c:windowsInternet Logs
2009-09-23 16:17 . 2009-09-23 16:17 -------- d-----w- c:program filesCommon FilesUninstall
2009-09-23 16:17 . 2009-09-29 14:10 -------- d-----w- c:program filesAlphaAV
2009-09-21 12:47 . 2009-09-21 16:49 -------- d-----w- c:program filesPKR
2009-09-21 08:12 . 2009-09-21 08:12 -------- d-----w- c:program filesUtilitaire de configuration iPhone
2009-09-21 08:11 . 2009-09-21 08:57 -------- d-----w- c:usersamelAppDataRoamingApple Computer
2009-09-21 08:11 . 2009-05-18 12:17 26600 ----a-w- c:windowssystem32driversGEARAspiWDM.sys
2009-09-21 08:11 . 2008-04-17 11:12 107368 ----a-w- c:windowssystem32GEARAspi.dll
2009-09-21 08:10 . 2009-09-21 08:10 -------- d-----w- c:program filesiPod
2009-09-21 08:10 . 2009-09-21 08:11 -------- d-----w- c:programdata{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-09-21 08:10 . 2009-09-21 08:11 -------- d-----w- c:program filesiTunes
2009-09-21 08:10 . 2009-09-21 08:10 -------- d-----w- c:program filesBonjour
2009-09-21 08:10 . 2009-09-21 08:10 -------- d-----w- c:programdataApple Computer
2009-09-21 08:10 . 2009-09-21 08:10 -------- d-----w- c:program filesQuickTime
2009-09-21 08:08 . 2009-09-21 08:10 -------- d-----w- c:program filesCommon FilesApple
2009-09-16 14:18 . 2009-09-16 14:18 -------- d-----w- c:windowsSun
2009-09-16 14:15 . 2009-07-25 03:23 411368 ----a-w- c:windowssystem32deploytk.dll
2009-09-16 14:15 . 2009-09-17 07:46 -------- d-----w- c:program filesJava
2009-09-10 01:13 . 2009-09-10 01:13 -------- d-----w- c:usersamelAppDataRoamingdcunningham.net
2009-09-07 19:59 . 2009-09-08 06:21 -------- d-----w- C: mp
2009-09-06 11:24 . 2009-09-21 08:57 -------- d-----w- c:usersamelAppDataLocalApple Computer
2009-09-06 11:22 . 2009-09-06 11:22 -------- d-----w- c:usersamelAppDataLocalApple
2009-09-06 11:22 . 2009-09-06 11:22 -------- d-----w- c:programdataApple
2009-09-06 11:22 . 2009-09-06 11:22 -------- d-----w- c:program filesApple Software Update
2009-09-02 22:45 . 2009-08-28 12:39 28672 ----a-w- c:windowssystem32Apphlpdm.dll
2009-09-02 22:45 . 2009-08-28 10:15 4240384 ----a-w- c:windowssystem32GameUXLegacyGDFs.dll
2009-09-02 19:46 . 2009-09-02 19:48 -------- d-----w- c:usersamelAppDataRoamingSynthesia
2009-09-01 23:17 . 2009-09-01 23:18 -------- d-----w- c:usersamelAppDataRoamingGNU Solfege
2009-09-01 23:16 . 2009-09-01 23:16 -------- d-----w- c:program filesGNU Solfege

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-29 14:15 . 2008-01-21 08:40 679180 ----a-w- c:windowssystem32perfh00C.dat
2009-09-29 14:15 . 2008-01-21 08:40 128212 ----a-w- c:windowssystem32perfc00C.dat
2009-09-27 22:37 . 2009-03-08 16:52 10 ----a-w- c:windowspopcinfo.dat
2009-09-27 21:54 . 2009-03-05 20:35 -------- d-----w- c:usersamelAppDataRoamingAzureus
2009-09-23 16:56 . 2009-09-23 16:53 419186 ---ha-w- c:windowssystem32driversvsconfig.xml
2009-08-14 17:01 . 2009-09-09 06:47 900168 ----a-w- c:windowssystem32drivers cpip.sys
2009-08-14 17:01 . 2009-09-09 06:47 220232 ----a-w- c:windowssystem32drivers
etio.sys
2009-08-14 17:01 . 2009-09-09 06:47 98376 ----a-w- c:windowssystem32driversFWPKCLNT.SYS
2009-08-14 16:29 . 2009-09-09 06:47 104960 ----a-w- c:windowssystem32
etiohlp.dll
2009-08-14 16:29 . 2009-09-09 06:47 17920 ----a-w- c:windowssystem32
etevent.dll
2009-08-14 16:23 . 2009-09-09 06:47 438272 ----a-w- c:windowssystem32IKEEXT.DLL
2009-08-14 16:22 . 2009-09-09 06:47 595456 ----a-w- c:windowssystem32FWPUCLNT.DLL
2009-08-14 16:21 . 2009-09-09 06:47 328704 ----a-w- c:windowssystem32BFE.DLL
2009-08-14 14:16 . 2009-09-09 06:47 9728 ----a-w- c:windowssystem32TCPSVCS.EXE
2009-08-14 14:16 . 2009-09-09 06:47 17920 ----a-w- c:windowssystem32ROUTE.EXE
2009-08-14 14:16 . 2009-09-09 06:47 11264 ----a-w- c:windowssystem32MRINFO.EXE
2009-08-14 14:16 . 2009-09-09 06:47 27136 ----a-w- c:windowssystem32NETSTAT.EXE
2009-08-14 14:16 . 2009-09-09 06:47 19968 ----a-w- c:windowssystem32ARP.EXE
2009-08-14 14:16 . 2009-09-09 06:47 8704 ----a-w- c:windowssystem32HOSTNAME.EXE
2009-08-14 14:16 . 2009-09-09 06:47 10240 ----a-w- c:windowssystem32finger.exe
2009-07-21 21:52 . 2009-08-27 15:41 915456 ----a-w- c:windowssystem32wininet.dll
2009-07-21 21:47 . 2009-08-27 15:41 109056 ----a-w- c:windowssystem32iesysprep.dll
2009-07-21 21:47 . 2009-08-27 15:41 71680 ----a-w- c:windowssystem32iesetup.dll
2009-07-21 20:13 . 2009-08-27 15:41 133632 ----a-w- c:windowssystem32ieUnatt.exe
2009-07-17 14:35 . 2009-08-27 15:41 71680 ----a-w- c:windowssystem32atl.dll
2009-07-14 13:00 . 2009-08-27 15:41 313344 ----a-w- c:windowssystem32wmpdxm.dll
2009-07-14 12:59 . 2009-08-27 15:41 4096 ----a-w- c:windowssystem32dxmasf.dll
2009-07-14 12:58 . 2009-08-27 15:41 7680 ----a-w- c:windowssystem32spwmp.dll
2009-07-14 10:59 . 2009-08-27 15:40 8147456 ----a-w- c:windowssystem32wmploc.DLL
2009-07-11 19:32 . 2009-09-09 06:47 513024 ----a-w- c:windowssystem32wlansvc.dll
2009-07-11 19:32 . 2009-09-09 06:47 302592 ----a-w- c:windowssystem32wlansec.dll
2009-07-11 19:32 . 2009-09-09 06:47 293376 ----a-w- c:windowssystem32wlanmsm.dll
2009-07-11 19:29 . 2009-09-09 06:47 127488 ----a-w- c:windowssystem32L2SecHC.dll
2009-07-02 07:29 . 2009-07-02 07:29 40960 ----a-w- c:windowssystem32V0530Pin.dll
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerURLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:program filesAVGAVG8ToolbarIEToolbar.dll" [2009-07-24 1090816]

[HKEY_CLASSES_ROOTclsid{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE~Browser Helper Objects{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-07-24 07:55 1090816 ----a-w- c:program filesAVGAVG8ToolbarIEToolbar.dll

[HKEY_LOCAL_MACHINE~Browser Helper Objects{ecdee021-0d17-467f-a1ff-c7a115230949}]
2009-03-10 09:47 2079256 ----a-w- c:program filesfree-downloads.net bfree.dll

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
"{ecdee021-0d17-467f-a1ff-c7a115230949}"= "c:program filesfree-downloads.net bfree.dll" [2009-03-10 2079256]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:program filesAVGAVG8ToolbarIEToolbar.dll" [2009-07-24 1090816]

[HKEY_CLASSES_ROOTclsid{ecdee021-0d17-467f-a1ff-c7a115230949}]

[HKEY_CLASSES_ROOTclsid{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerToolbarWebbrowser]
"{ECDEE021-0D17-467F-A1FF-C7A115230949}"= "c:program filesfree-downloads.net bfree.dll" [2009-03-10 2079256]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:program filesAVGAVG8ToolbarIEToolbar.dll" [2009-07-24 1090816]

[HKEY_CLASSES_ROOTclsid{ecdee021-0d17-467f-a1ff-c7a115230949}]

[HKEY_CLASSES_ROOTclsid{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionexplorershelliconoverlayidentifiersegisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOTCLSID{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2008-07-29 16:52 121392 ----a-w- c:program filesAcerEmpowering TechnologyeDataSecurityx86PSDProtect.dll

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
"msnmsgr"="c:program filesWindows LiveMessengermsnmsgr.exe" [2009-02-06 3885408]
"ehTray.exe"="c:windowsehomeehTray.exe" [2008-01-21 125952]
"AlcoholAutomount"="c:program filesAlcohol SoftAlcohol 52axcmd.exe" [2009-04-24 203928]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
"Windows Defender"="c:program filesWindows DefenderMSASCui.exe" [2008-01-21 1008184]
"Acer Empowering Technology Monitor"="c:program filesAcerEmpowering TechnologySysMonitor.exe" [2008-06-02 319488]
"EmpoweringTechnology"="c:program filesAcerEmpowering TechnologyFramework.Launcher.exe" [2008-06-02 319488]
"eDataSecurity Loader"="c:program filesAcerEmpowering TechnologyeDataSecurityx86eDSloader.exe" [2008-07-29 526896]
"PCMMediaSharing"="c:program filesAcer Arcade LiveAcer HomeMedia ConnectKernelDMSPCMMediaSharing.exe" [2008-05-20 204908]
"NvCplDaemon"="c:windowssystem32NvCpl.dll" [2008-08-01 13535776]
"NvMediaCenter"="c:windowssystem32NvMcTray.dll" [2008-08-01 92704]
"BkupTray"="c:program filesNewTech InfosystemsNTI Backup Now 5BkupTray.exe" [2008-04-25 28672]
"WarReg_PopUp"="c:program filesAcerWR_PopUpWarReg_PopUp.exe" [2008-01-29 303104]
"Google Desktop Search"="c:program filesGoogleGoogle Desktop SearchGoogleDesktop.exe" [2009-02-24 24064]
"Adobe Reader Speed Launcher"="c:program filesAdobeReader 8.0ReaderReader_sl.exe" [2008-10-15 39792]
"Windows Mobile-based device management"="c:windowsWindowsMobilewmdSync.exe" [2008-01-21 215552]
"AVG8_TRAY"="c:progra~1AVGAVG8avgtray.exe" [2009-08-28 2007832]
"TkBellExe"="c:program filesCommon FilesRealUpdate_OB ealsched.exe" [2009-05-27 198160]
"SunJavaUpdateSched"="c:program filesJavajre6injusched.exe" [2009-07-25 149280]
"QuickTime Task"="c:program filesQuickTimeQTTask.exe" [2009-09-04 417792]
"iTunesHelper"="c:program filesiTunesiTunesHelper.exe" [2009-09-08 305440]
"ZoneAlarm Client"="c:program filesone LabsoneAlarmzlclient.exe" [2009-08-26 1011080]
"ISW"="c:program filesCheckPointAForceFieldForceField.exe" [2009-08-26 722288]
"RtHDVCpl"="RtHDVCpl.exe" - c:windowsRtHDVCpl.exe [2008-08-19 6265376]
"V0530Pin.dll"="V0530Pin.dll" - c:windowsSystem32V0530Pin.dll [2009-07-02 40960]

c:usersamelAppDataRoamingMicrosoftWindowsStart MenuProgramsStartup
OneNote 2007 - Capture d',cran et lancement.lnk - c:program filesMicrosoft OfficeOffice12ONENOTEM.EXE [2007-12-7 101440]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionpoliciessystem]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionwindows]
"AppInit_DLLs"=c:progra~1GoogleGOOGLE~1GoogleDesktopNetwork3.dll c:windowsSystem32avgrsstx.dll

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversiondrivers32]
"aux1"=wdmaud.drv

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalWinDefend]
@="Service"

[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity centerMonitoringMcAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001

[HKLM~servicessharedaccessparametersfirewallpolicyDomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM~servicessharedaccessparametersfirewallpolicyFirewallRules]
"{6C113188-4C86-4F1D-B9E5-4B6F7DB49E21}"= c:program filesAcer Arcade LiveAcer Arcade Live Main PageAcer Arcade Live.exe:Acer Arcade Live
"{A50641CA-5AA7-4A51-888B-6C203E15E762}"= c:program filesAcer Arcade LiveAcer DV MagicianAcer DV Magician.exe:Acer DV Magician
"{A89056E4-044A-49A1-B7CE-CC7BA563FF9F}"= c:program filesAcer Arcade LiveAcer SlideShow DVDAcer SlideShow DVD.exe:Acer SlideShow DVD
"{CC4D2A69-7204-4EC1-8578-7ABAC787E2C3}"= c:program filesAcer Arcade LiveAcer VideoMagicianAcer VideoMagician.exe:Acer VideoMagician
"{47CF80F7-56A8-4D2A-BE68-8C5E0B74C67C}"= c:program filesAcer Arcade LiveAcer DVDivineAcer DVDivine.exe:Acer DVDivine
"{8285A795-2B13-4FE1-B4E6-B6A3C950E120}"= c:program filesAcer Arcade LiveAcer HomeMediaAcer HomeMedia.exe:Acer HomeMedia
"{C3A4AE4F-D74F-47AD-84C9-97EA1F74FAB4}"= c:program filesAcer Arcade LiveAcer HomeMedia ConnectAcer HomeMedia Connect.exe:Acer HomeMedia Connect
"{29CF307B-80B1-4E40-92C3-816D764885CA}"= c:program filesAcer Arcade LiveAcer HomeMedia ConnectKernelDMSCLMSServer.EXE:Acer HomeMedia Connect Service
"{3C732F18-A08A-4417-BA46-F51605740844}"= c:program filesAcer Arcade LiveAcer HomeMedia Trial CreatorAcer HomeMedia Trial Creator.exe:Acer HomeMedia Trial Creator
"{6702D5BD-6F5C-4ACC-A8AC-CFECCA739131}"= UDP:c:program filesMicrosoft OfficeOffice12ONENOTE.EXE:Microsoft Office OneNote
"{847A49D5-049E-478D-9665-5D9833D4EACB}"= TCP:c:program filesMicrosoft OfficeOffice12ONENOTE.EXE:Microsoft Office OneNote
"{0D485F33-FA8F-4E31-A582-60865727FA60}"= UDP:c:program filesNewTech InfosystemsNTI Backup Now 5ClientAgentsvc.exe:AgentSvc.exe
"{1ADD3CA7-3C12-4279-B2BC-51702F6D1172}"= UDP:c:program filesNewTech InfosystemsNTI Backup Now 5BackupSvc.exe:BackupSvc.exe
"{377BF364-F8CD-4E01-B6EB-7295EFAD6ED1}"= TCP:c:program filesNewTech InfosystemsNTI Backup Now 5ClientAgentsvc.exe:AgentSvc.exe
"{8C3AC6BC-DB79-458E-9F15-726D6821B6CB}"= TCP:c:program filesNewTech InfosystemsNTI Backup Now 5BackupSvc.exe:BackupSvc.exe
"{04B42A48-3AFD-432E-A320-CE6E4DE2C199}"= UDP:c:program filesNewTech InfosystemsNTI Backup Now 5SchedulerSvc.exe:SchedulerSvc.exe
"{1F6BF221-7ECA-4A8B-935E-984959359FEC}"= TCP:c:program filesNewTech InfosystemsNTI Backup Now 5SchedulerSvc.exe:SchedulerSvc.exe
"{DB5D6415-8E12-42B9-ABAB-A9CDDB150B47}"= c:program filesWindows LiveSyncWindowsLiveSync.exe:Windows Live Sync
"TCP Query User{8A440244-2046-4AE2-A1FB-575AA180766A}c:\program files\emule\emule.exe"= UDP:c:program filesemuleemule.exe:eMule
"UDP Query User{35C5F0C9-8675-4028-9ECF-83488E6CF001}c:\program files\emule\emule.exe"= TCP:c:program filesemuleemule.exe:eMule
"{7C9B2617-B6CB-401C-9059-574E590C1592}"= UDP:990:LocalSubnet:LocalSubnet|IF={09888A06-5C2E-4330-ACD3-ECCDAF5CFA9A}|%SystemRoot%system32svchost.exe|Svc=rapimgr:@%systemroot%WindowsMobilewmdSync.exe,-4001
"TCP Query User{DA479E2B-1C16-4DBB-B89E-B79A82FAFE92}c:\program files\vuze\azureus.exe"= UDP:c:program filesvuzeazureus.exe:Azureus
"UDP Query User{E945A310-F242-4B9C-89E8-57972F7611B9}c:\program files\vuze\azureus.exe"= TCP:c:program filesvuzeazureus.exe:Azureus
"{72D2B48F-BA91-46E4-AFA5-F6370EFDA676}"= c:program filesSkypePhoneSkype.exe:Skype
"{5A34283E-12EB-404D-835F-5C2B6F705083}"= c:program filesAVGAVG8avgemc.exe:avgemc.exe
"{CB4BB80A-7EBB-4396-968C-7F59A1DC072F}"= c:program filesAVGAVG8avgupd.exe:avgupd.exe
"{5AB198D3-E5F9-46BA-A99E-91C304DFFC03}"= c:program filesAVGAVG8avgnsx.exe:avgnsx.exe
"{412056B8-E027-467B-9786-58F5C379FA94}"= UDP:c:program filesBonjourmDNSResponder.exe:Bonjour
"{231BEFF2-8420-4D44-B206-69B3A34DA12D}"= TCP:c:program filesBonjourmDNSResponder.exe:Bonjour
"{02509107-067F-4EE7-BCBB-2C07A6654E5B}"= UDP:c:program filesiTunesiTunes.exe:iTunes
"{5A36E410-1102-48EE-A096-2C824C935490}"= TCP:c:program filesiTunesiTunes.exe:iTunes

[HKLM~servicessharedaccessparametersfirewallpolicyPublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM~servicessharedaccessparametersfirewallpolicyStandardProfile]
"EnableFirewall"= 0 (0x0)

[HKLM~servicessharedaccessparametersfirewallpolicyStandardProfileAuthorizedApplicationsList]
"c:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSfsu.exe"= c:program filesAcerEmpowering TechnologyeDataSecurityx86eDSfsu.exe:*:Enabled:eDSfsu
"c:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\encryption.exe"= c:program filesAcerEmpowering TechnologyeDataSecurityx86encryption.exe:*:Enabled:encryption
"c:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\decryption.exe"= c:program filesAcerEmpowering TechnologyeDataSecurityx86decryption.exe:*:Enabled:decryption
"c:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSMgr.exe"= c:program filesAcerEmpowering TechnologyeDataSecurityx86eDSMgr.exe:*:Enabled:eDSMgr
"c:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStbmngr.exe"= c:program filesAcerEmpowering TechnologyeDataSecurityx86eDStbmngr.exe:*:Enabled:eDStbmngr
"c:\Program Files\Acer\Empowering Technology\eDataSecurity\x64\eDSfsu.exe"= c:program filesAcerEmpowering TechnologyeDataSecurityx64eDSfsu.exe:*:Enabled:eDSfsu
"c:\Program Files\Acer\Empowering Technology\eDataSecurity\x64\encryption.exe"= c:program filesAcerEmpowering TechnologyeDataSecurityx64encryption.exe:*:Enabled:encryption
"c:\Program Files\Acer\Empowering Technology\eDataSecurity\x64\decryption.exe"= c:program filesAcerEmpowering TechnologyeDataSecurityx64decryption.exe:*:Enabled:decryption
"c:\Program Files\Acer\Empowering Technology\eDataSecurity\x64\eDSMgr.exe"= c:program filesAcerEmpowering TechnologyeDataSecurityx64eDSMgr.exe:*:Enabled:eDSMgr
"c:\Program Files\Acer\Empowering Technology\eDataSecurity\x64\eDStbmngr.exe"= c:program filesAcerEmpowering TechnologyeDataSecurityx64eDStbmngr.exe:*:Enabled:eDStbmngr

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:windowsSystem32driversavgldx86.sys [03/05/2009 21:11 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:windowsSystem32driversavgtdix.sys [03/05/2009 21:11 108552]
R2 Acer HomeMedia Connect Service;Acer HomeMedia Connect Service;c:program filesAcer Arcade LiveAcer HomeMedia ConnectKernelDMSCLMSServer.exe [27/10/2008 20:40 269448]
R2 avg8emc;AVG Free8 E-mail Scanner;c:progra~1AVGAVG8avgemc.exe [18/06/2009 11:15 908056]
R2 avg8wd;AVG Free8 WatchDog;c:progra~1AVGAVG8avgwdsvc.exe [03/05/2009 21:11 297752]
R2 BUNAgentSvc;NTI Backup Now 5 Agent Service;c:program filesNewTech InfosystemsNTI Backup Now 5ClientAgentsvc.exe [03/03/2008 13:11 16384]
R2 ETService;Empowering Technology Service;c:program filesAcerEmpowering TechnologyServiceETService.exe [27/10/2008 20:31 24576]
R2 ISWKL;ZoneAlarm Toolbar ISWKL;c:program filesCheckPointAForceFieldISWKL.sys [26/08/2009 18:20 25208]
R2 IswSvc;ZoneAlarm Toolbar IswSvc;c:program filesCheckPointAForceFieldISWSVC.exe [26/08/2009 18:20 435568]
R2 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:program filesNewTech InfosystemsNTI Backup Now 5BackupSvc.exe [25/04/2008 21:36 45056]
R3 netr28;Ralink 802.11n Wireless Driver for Windows Vista;c:windowsSystem32drivers
etr28.sys [28/10/2008 04:44 338432]
S2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:program filesNewTech InfosystemsNTI Backup Now 5SchedulerSvc.exe [25/04/2008 21:36 131072]
S3 fssfltr;FssFltr;c:windowsSystem32driversfssfltr.sys [24/02/2009 16:14 55280]
S3 fsssvc;Windows Live Contrôle parental;c:program filesWindows LiveFamily Safetyfsssvc.exe [06/02/2009 19:08 533360]
S3 GoogleDesktopManager-080708-050100;Google Desktop Manager 5.7.808.7150;c:program filesGoogleGoogle Desktop SearchGoogleDesktop.exe [24/02/2009 15:24 24064]
S3 V0530Dev;Creative Camera VF0530 Driver;c:windowsSystem32driversV0530Vid.sys [15/06/2009 17:01 273920]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionsvchost]
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
.
Contenu du dossier 'Tâches planifiées'

2009-09-29 c:windowsTasksUser_Feed_Synchronization-{6398A2DB-0A51-4AD4-8D97-3819685C1F83}.job
- c:windowssystem32msfeedssync.exe [2009-08-27 20:13]
.
.
------- Examen supplémentaire -------
.
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACA ... pire_x1700
uInternet Settings,ProxyOverride = *.local
IE: E&xporter vers Microsoft Excel - c:progra~1MICROS~2Office12EXCEL.EXE/3000
FF - ProfilePath - c:usersamelAppDataRoamingMozillaFirefoxProfilesdugj61jr.default
FF - prefs.js: browser.startup.homepage - hxxp://fr.start2.mozilla.com/firefox?cl ... r:official
FF - prefs.js: keyword.URL - hxxp://fr.yhs.search.yahoo.com/avg/sear ... -web_fr&p=
FF - component: c:program filesAVGAVG8Firefoxcomponentsavgssff.dll
FF - component: c:program filesAVGAVG8ToolbarFirefoxavg@igearedcomponentsIGeared_tavgp_xputils2.dll
FF - component: c:program filesAVGAVG8ToolbarFirefoxavg@igearedcomponentsIGeared_tavgp_xputils3.dll
FF - component: c:program filesAVGAVG8ToolbarFirefoxavg@igearedcomponentsIGeared_tavgp_xputils35.dll
FF - component: c:program filesAVGAVG8ToolbarFirefoxavg@igearedco ... gtbapi.dll
FF - component: c:program filesCheckPointAForceFieldTrustCheckercomponentsMozillaDownload.dll
FF - component: c:program filesCheckPointAForceFieldTrustCheckercomponentsTrustCheckerMozillaPlugin.dll
FF - component: c:program filesMozilla Firefoxextensions{B13721C7-F507-4982-B2E5-502A71474FED}componentsNPComponent.dll
FF - plugin: c:program filesMicrosoftOffice Live
pOLW.dll
FF - plugin: c:program filesMozilla Firefoxplugins
p-mswmp.dll
FF - plugin: c:program filesMozilla FirefoxpluginsNPAskSBr.dll
FF - plugin: c:program filesWindows LivePhoto GalleryNPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:windowsMicrosoft.NETFrameworkv3.5Windows Presentation FoundationDotNetAssistantExtension

---- PARAMETRES FIREFOX ----
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-29 18:47
Windows 6.0.6001 Service Pack 1 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'lsass.exe'(708)
c:program filesCheckPointAForceFieldPluginsISWSHEX.dll
.
Heure de fin: 2009-09-29 18:49
ComboFix-quarantined-files.txt 2009-09-29 16:49

Avant-CF: 167 372 214 272 octets libres
Après-CF: 167 330 160 640 octets libres

272 --- E O F --- 2009-09-28 20:09

J'espere que cela aide =)

Merci.

danakil · le 30 Sep 2009 02:02

J'espere que cela aide

Cela me permet de constater que ton Vista est en 64 et non en 32 ... La plus part des tools de désinfections n'arrivent toujours pas à s'adapter à cette version de "Microsoft" à cause de l'élément virtuel --> Virtual Store !

On va devoir désinfecter ton PC en manuel ...
Reposte moi STP un rapport HijackThis > Do a system scan and save a logfile afin d'établir le protocole de nettoyage.

esol · le 01 Oct 2009 19:48

hop le rapport arrive avec un peu de retard

désolé.

Alpha anti virus n'apparait plus.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:39:21, on 01/10/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18813)
Boot mode: Normal

Running processes:
C:Program FilesCheckPointAForceFieldForceField.exe
C:Windowssystem32 askeng.exe
C:Windowssystem32Dwm.exe
C:WindowsExplorer.EXE
C:Program FilesWindows DefenderMSASCui.exe
C:Program FilesAcerEmpowering TechnologySysMonitor.exe
C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDSLoader.exe
C:WindowsRtHDVCpl.exe
C:WindowsSystem32 undll32.exe
C:Program FilesNewTech InfosystemsNTI Backup Now 5BkupTray.exe
C:Program FilesGoogleGoogle Desktop SearchGoogleDesktop.exe
C:WindowsWindowsMobilewmdSync.exe
C:Program FilesCommon FilesRealUpdate_OB ealsched.exe
C:Program FilesJavajre6injusched.exe
C:Program FilesiTunesiTunesHelper.exe
C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDSDTS.exe
C:Program FilesWindows LiveMessengermsnmsgr.exe
C:WindowsSystem32mobsync.exe
C:Windowsehomeehtray.exe
C:Program FilesGoogleGoogle Desktop SearchGoogleDesktop.exe
C:Windowsehomeehmsas.exe
C:Program FilesAcerEmpowering TechnologyeDataSecurityx86MsnVane.exe
C:Program FilesWindows LiveContactswlcomm.exe
C:Program FilesAVGAVG8avgtray.exe
C:Program Filesone LabsoneAlarmzlclient.exe
C:Program FilesMozilla Firefoxfirefox.exe
C:Program FilesTrend MicroHijackThisHijackThis.exe

R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://fr.msn.com/
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://homepage.acer.com/rdr.aspx?b=ACA ... pire_x1700
R1 - HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyOverride = *.local
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName =
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:Program FilesAVGAVG8ToolbarIEToolbar.dll
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:Program FilesAVGAVG8avgssie.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:Program FilesMicrosoftSearch Enhancement PackSearch HelperSEPsearchhelperie.dll
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:Program FilesAcerEmpowering TechnologyeDataSecurityx86ActiveToolBand.dll
O2 - BHO: ZoneAlarm Toolbar Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:Program FilesCheckPointAForceFieldTrustCheckerinTrustCheckerIEPlugin.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:Program FilesCommon FilesMicrosoft SharedWindows LiveWindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:Program FilesAVGAVG8ToolbarIEToolbar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:Program FilesGoogleGoogle ToolbarGoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:Program FilesGoogleGoogleToolbarNotifier5.0.926.3450swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:Program FilesGoogleGoogle ToolbarComponentfastsearch_219B3E1547538286.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:Program FilesJavajre6injp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:Program FilesWindows LiveToolbarwltcore.dll
O2 - BHO: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:Program Filesfree-downloads.net bfree.dll
O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:Program FilesAskSBarar1.binASKSBAR.DLL
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDStoolbar.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:Program FilesWindows LiveToolbarwltcore.dll
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:Program FilesAskSBarar1.binASKSBAR.DLL
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:Program FilesGoogleGoogle ToolbarGoogleToolbar.dll
O3 - Toolbar: (no name) - {312105C4-2E13-4E10-AF72-F9D79BA077E6} - (no file)
O3 - Toolbar: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:Program Filesfree-downloads.net bfree.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:Program FilesAVGAVG8ToolbarIEToolbar.dll
O3 - Toolbar: ZoneAlarm Toolbar - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:Program FilesCheckPointAForceFieldTrustCheckerinTrustCheckerIEPlugin.dll
O4 - HKLM..Run: [Windows Defender] %ProgramFiles%Windows DefenderMSASCui.exe -hide
O4 - HKLM..Run: [Acer Empowering Technology Monitor] C:Program FilesAcerEmpowering TechnologySysMonitor.exe
O4 - HKLM..Run: [EmpoweringTechnology] C:Program FilesAcerEmpowering TechnologyFramework.Launcher.exe boot
O4 - HKLM..Run: [eDataSecurity Loader] C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDSloader.exe
O4 - HKLM..Run: [PCMMediaSharing] C:Program FilesAcer Arcade LiveAcer HomeMedia ConnectKernelDMSPCMMediaSharing.exe
O4 - HKLM..Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:Windowssystem32NvCpl.dll,NvStartup
O4 - HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:Windowssystem32NvMcTray.dll,NvTaskbarInit
O4 - HKLM..Run: [BkupTray] "C:Program FilesNewTech InfosystemsNTI Backup Now 5BkupTray.exe"
O4 - HKLM..Run: [WarReg_PopUp] C:Program FilesAcerWR_PopUpWarReg_PopUp.exe
O4 - HKLM..Run: [Google Desktop Search] "C:Program FilesGoogleGoogle Desktop SearchGoogleDesktop.exe" /startup
O4 - HKLM..Run: [Adobe Reader Speed Launcher] "C:Program FilesAdobeReader 8.0ReaderReader_sl.exe"
O4 - HKLM..Run: [Windows Mobile-based device management] %windir%WindowsMobilewmdSync.exe
O4 - HKLM..Run: [AVG8_TRAY] C:PROGRA~1AVGAVG8avgtray.exe
O4 - HKLM..Run: [TkBellExe] "C:Program FilesCommon FilesRealUpdate_OB ealsched.exe" -osboot
O4 - HKLM..Run: [V0530Pin.dll] RunDLL32.exe V0530Pin.dll,RunDLL32EP 514,/d:0
O4 - HKLM..Run: [SunJavaUpdateSched] "C:Program FilesJavajre6injusched.exe"
O4 - HKLM..Run: [QuickTime Task] "C:Program FilesQuickTimeQTTask.exe" -atboottime
O4 - HKLM..Run: [iTunesHelper] "C:Program FilesiTunesiTunesHelper.exe"
O4 - HKLM..Run: [ZoneAlarm Client] "C:Program Filesone LabsoneAlarmzlclient.exe"
O4 - HKLM..Run: [ISW] "C:Program FilesCheckPointAForceFieldForceField.exe" /icon="hidden"
O4 - HKCU..Run: [msnmsgr] "C:Program FilesWindows LiveMessengermsnmsgr.exe" /background
O4 - HKCU..Run: [ehTray.exe] C:WindowsehomeehTray.exe
O4 - HKCU..Run: [AlcoholAutomount] "C:Program FilesAlcohol SoftAlcohol 52axcmd.exe" /automount
O4 - Startup: OneNote 2007 - Capture d'écran et lancement.lnk = C:Program FilesMicrosoft OfficeOffice12ONENOTEM.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:PROGRA~1MICROS~2Office12EXCEL.EXE/3000
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:Program FilesWindows LiveWriterWriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:Program FilesWindows LiveWriterWriterBrowserExtension.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:PROGRA~1MICROS~2Office12ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:PROGRA~1MICROS~2Office12ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:PROGRA~1MICROS~2Office12REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:ProgramsPartyGamingPartyPokerRunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:ProgramsPartyGamingPartyPokerRunApp.exe (file missing)
O9 - Extra button: (no name) - Cmdmapping - (no file) (HKCU)
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.co ... nos/gp.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:Program FilesAVGAVG8avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:PROGRA~1COMMON~1SkypeSKYPE4~1.DLL
O20 - AppInit_DLLs: C:PROGRA~1GoogleGOOGLE~1GoogleDesktopNetwork3.dll C:WindowsSystem32avgrsstx.dll
O23 - Service: Acer HomeMedia Connect Service - CyberLink - C:Program FilesAcer Arcade LiveAcer HomeMedia ConnectKernelDMSCLMSServer.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:Program FilesCommon FilesAppleMobile Device SupportinAppleMobileDeviceService.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:PROGRA~1AVGAVG8avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:PROGRA~1AVGAVG8avgwdsvc.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:Program FilesBonjourmDNSResponder.exe
O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:Program FilesNewTech InfosystemsNTI Backup Now 5ClientAgentsvc.exe
O23 - Service: eDataSecurity Service - Egis Incorporated - C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDSService.exe
O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:Program FilesAcerEmpowering TechnologyServiceETService.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:Program FilesNOSingetPlus_HelperSvc.exe
O23 - Service: Google Desktop Manager 5.7.808.7150 (GoogleDesktopManager-080708-050100) - Google - C:Program FilesGoogleGoogle Desktop SearchGoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:Program FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:Program FilesCommon FilesInstallShieldDriver1150Intel 32IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:Program FilesiPodiniPodService.exe
O23 - Service: ZoneAlarm Toolbar IswSvc (IswSvc) - Check Point Software Technologies - C:Program FilesCheckPointAForceFieldIswSvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:Program FilesCommon FilesLightScribeLSSrvc.exe
O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:Program FilesNewTech InfosystemsNTI Backup Now 5BackupSvc.exe
O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:Program FilesNewTech InfosystemsNTI Backup Now 5SchedulerSvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:Windowssystem32
vvsvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:Program FilesCyberLinkShared FilesRichVideo.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:Program FilesAlcohol SoftAlcohol 52StarWindStarWindServiceAE.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:WindowsSystem32oneLabsvsmon.exe

--
End of file - 12559 bytes

Pac428 · le 01 Oct 2009 23:38

Bonsoir Esol

Alpha anti virus n'apparait plus.

Oui le log est presque propre.
Danakil a fait mieux qu'il ne le pensait

Pour terminer :

Relance HijackThis > Do a system scan only et coche les cases devant ces lignes :

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O3 - Toolbar: (no name) - {312105C4-2E13-4E10-AF72-F9D79BA077E6} - (no file)

O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} -
C:ProgramsPartyGamingPartyPokerRunApp.exe (file missing)

O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} -
C:ProgramsPartyGamingPartyPokerRunApp.exe (file missing)

O9 - Extra button: (no name) - Cmdmapping - (no file) (HKCU)

Clique sur le bouton Fix Checked > Valide par OUI > Referme toutes les fenêtres et redémarre ton PC.

Ensuite désinstalle tous les outils de nettoyage (Hijackthis ...) et c'est bon.

Bon surf prudent et ++

esol · le 02 Oct 2009 23:48

Merci beaucoup pour votre aide à tous les deux!

Plus de trace de Alpha AV.

Cependant un problème perdure. Au moment où le PC a été infecté par Alpha AV l'arrêt de l'ordinateur est devenu très long (plusieurs minutes pour s'éteindre).

Et rien n'a changé malgré les modifications que vous m'avez dit de faire.

Peut-être auriez vous un conseil pour régler ce soucis.

Merci pour tout !

(PS : j'ai désinstallé Hijackthis / combofix)

danakil · le 03 Oct 2009 12:39

Peut-être auriez vous un conseil pour régler ce soucis.

Merci pour tout !

Salut à tous !
Merci Pac428 de ton intervention durant mon absence.

esol
Tes soucis de ralentissement sont dûes à des programmes vérolés encore en place sur ton PC. Comme je t'ai dit plus haut un 64 c'est pas évident à manipuler ...
Donc je compte sur toi pour te manifester rapidement (dans la mesure de tes disponibilités évidemment) pour répondre à mes procédures. Cette réaction de ta part m'évitera de reprendre le sujet depuis le début et de me remémorer l'évolution du sujet.

Il faut maintenant faire sauter deux infections sur ton PC.

Fait ceci dans l'ordre, je te prie :

1/ Télécharge Toolbar-S&D De Angeldark, Sham_Rock & XmichouX sur ton Bureau et pas ailleurs.

Aide en images

> Clic droit sur l'icône ToolBarSD.exe > Exécuter en tant qu'Administrateur ... afin de lancer l'installation.
Si ce problème de clic droit > Exécuter en tant ... perdure > Fait un double clic dessus et poursuis la procédure.
> Une fois installé, un raccourci sera ajouté sur le Bureau. Clic droit dessus > Exécuter en tant qu'Adaministrateur ... pour démarrer l'outil.
> Dans la fenêtre qui s'ouvre, sélectionne pour le choix de la langue "F".
> Valide
> Sélectionne l'option 1 (recherche) et valide

*** Patiente jusqu'à la fin de la recherche.

> Sauvegarde le rapport qui s'ouvre à la fin du scan sur ton bureau.
> Poste le rapport.

2/ Réinstalle HijackThis sur ton Bureau car je vais en avoir besoin par la suite.
Procédure :
Télécharge HJTInstall.exe sur ton Bureau.
> double-clics sur le fichier HJTInstall.exe afin de le lancer.
Il te proposera de l'installer par défaut dans Program Files >> Accepte
> Dans la nouvelle fenêtre sélectionne : Do a system scan and save a logfile
Tu vas obtenir un rapport >> copie le et colle le moi ici en réponse.

3/ J'attends les rapports de Toolbar et HijackThis pour terminer ta désinfection.

esol · le 03 Oct 2009 21:57

salut!
Ca fait plusieurs heures que j'essaie de faire tourner toolbar s&d mais au bout de cinq minutes une fenetre apparait ac "utilitaire (qgrep) de recherche de chaine de caractères à cessé de fonctionner" bla bla "fermer le programme?" si je ferme la fenêtre elle se rouvre cinq min ap que doi-je faire? merci de ton aide....

EDIT : plus en detail; lorsque je telecharge toolbar via le lien de l'aide en image, j'obtiens directement http://toolbarsd.googlepages.com/2.png/2-full;init:.png et non http://toolbarsd.googlepages.com/1.png/1-full;init:.png.

Lorsque je lance Toolbar les deux fenetres (selection de langue / recherche) tout se deroule comme il faut. Jusqu'a ce qu'apparaisse la fenetre de recherche où le programme plante.

danakil · le 04 Oct 2009 08:32

esol
Vérifie que l'UAC de ton PC soit bien désactivé --> regarde ici :
http://www.zebulon.fr/astuces/220-desac ... vista.html
Aprés le redémarrage du PC > relance ToolBarS&D une seule fois > cela fonctionne --> poste le rapport
> cela ne fonctionne pas --> poste moi un rapport HijackThis.

Petit message aux développeurs de Xiti que les modos pourront faire remonter :
Je ne peux utiliser les balises bbcodes actuellement, autres que celles préinstallées.
Je ne peux également vérifier un lien suite à un Aperçu sans perdre le post en cours.
Je fais passer ce message ici, car avec les changements en cours sur la plateforme celles-ci m'empêchent d'accèder à la MP directement sans passer par un PodCasts.

esol · le 04 Oct 2009 11:45

HI!
Le problème avec toolbar sd a persisté malgré la désactivation de l'uac, du coup je te poste le rapport d'hjt seulement
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:40:24, on 04/10/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18813)
Boot mode: Normal

Running processes:
C:\Program Files\CheckPoint\ZAForceField\ForceField.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\Windows\WindowsMobile\wmdSync.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\MsnVane.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACA ... pire_x1700
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll
O2 - BHO: ZoneAlarm Toolbar Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfree.dll
O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O3 - Toolbar: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfree.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O3 - Toolbar: ZoneAlarm Toolbar - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll
O3 - Toolbar: (no name) - {312105C4-2E13-4E10-AF72-F9D79BA077E6} - (no file)
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [BkupTray] "C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe"
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Program Files\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdSync.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [ISW] "C:\Program Files\CheckPoint\ZAForceField\ForceField.exe" /icon="hidden"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 52\axcmd.exe" /automount
O4 - Startup: OneNote 2007 - Capture d'écran et lancement.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.co ... nos/gp.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Acer HomeMedia Connect Service - CyberLink - C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Google Desktop Manager 5.7.808.7150 (GoogleDesktopManager-080708-050100) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ZoneAlarm Toolbar IswSvc (IswSvc) - Check Point Software Technologies - C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\Windows\System32\ZoneLabs\vsmon.exe

--
End of file - 11223 bytes
encore une foi merci de ton aide et de ta patience :roll:

danakil · le 04 Oct 2009 15:56

Bon, on va procéder autrement !

Avertissement - Les procédures ci-dessous sont uniquement valables pour ce PC en cours de désinfection

esol fais ceci dans l'ordre :

1/ Télécharge sur ton Bureau ce fichier correctif du Registre
--> net.reg <--

2/ Relance HijackThis > Do a system scan only > et coches les cases devant ces lignes :

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACA ... pire_x1700
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O3 - Toolbar: (no name) - {312105C4-2E13-4E10-AF72-F9D79BA077E6} - (no file)
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

> Sélectionne le bouton Fix Checked > Valide par OUI > Referme toutes les fenêtres.

3/ Doucle-clics sur net.reg ou alors clic droit (fusionner) > Au message d'avertissement
"Voulez vous fusionner ... au Registre" > Valide par OUI

... Redémarre ton PC <-- important.

4/ Effectue un scan complet de ton PC en appliquant les procédures données ici :
tutoriel-malwarebytes-anti-malware-vt-46564.html

5/ Poste moi les rapports :
Mbam
Nouveau HijackThis (Do a system scan and save a logfile).

esol · le 04 Oct 2009 16:24

Mbam :

Malwarebytes' Anti-Malware 1.41
Version de la base de données: 2905
Windows 6.0.6001 Service Pack 1

04/10/2009 18:43:10
mbam-log-2009-10-04 (18-43-10).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 226997
Temps écoulé: 45 minute(s), 38 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 1
Clé(s) du Registre infectée(s): 7
Valeur(s) du Registre infectée(s): 2
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 3

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
C:\Program Files\Windows Live\Messenger\msimg32.dll (Adware.MyWebSearch) -> Delete on reboot.

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{cf54be1c-9359-4395-8533-1657cf209cfe} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{d518921a-4a03-425e-9873-b9a71756821e} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\Environment\avapp (Rogue.PersonalAntiVirus) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Environment\avuninst (Rogue.PersonalAntiVirus) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Program Files\Windows Live\Messenger\msimg32.dll (Adware.MyWebSearch) -> Delete on reboot.
C:\32788R22FWJFW\Combo-Fix.sys (Worm.Agent) -> Quarantined and deleted successfully.
C:\Program Files\Windows Live\Messenger\riched20.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Hijackthis :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:56:28, on 04/10/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18813)
Boot mode: Normal

Running processes:
C:\Program Files\CheckPoint\ZAForceField\ForceField.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Windows\WindowsMobile\wmdSync.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\MsnVane.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\System32\mobsync.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll
O2 - BHO: ZoneAlarm Toolbar Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfree.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O3 - Toolbar: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfree.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O3 - Toolbar: ZoneAlarm Toolbar - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll
O3 - Toolbar: (no name) - {312105C4-2E13-4E10-AF72-F9D79BA077E6} - (no file)
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [BkupTray] "C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe"
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Program Files\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdSync.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [ISW] "C:\Program Files\CheckPoint\ZAForceField\ForceField.exe" /icon="hidden"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 52\axcmd.exe" /automount
O4 - Startup: OneNote 2007 - Capture d'écran et lancement.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.co ... nos/gp.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Acer HomeMedia Connect Service - CyberLink - C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Google Desktop Manager 5.7.808.7150 (GoogleDesktopManager-080708-050100) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ZoneAlarm Toolbar IswSvc (IswSvc) - Check Point Software Technologies - C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\Windows\System32\ZoneLabs\vsmon.exe

--
End of file - 10367 bytes

Voila les rapports demandés !

Merci pour votre aide.

danakil · le 04 Oct 2009 22:02

OK c'est nickel !
Ton PC est désinfecté.
Concernant les lenteurs de celui-ci, cela donne quoi actuellement?

esol · le 04 Oct 2009 22:41

Ça marche nikel!!!!
merci infiniment a toi et a Pac 428 de m'avoir aider
vous êtes trop fort

bisous et vu mon niveau en informatique a très bientôt! loool

[Réglé] Alpha antivirus probleme.

[Réglé] Alpha antivirus probleme.

Re: Alpha antivirus probleme.

Re: Alpha antivirus probleme.

Re: Alpha antivirus probleme.

Re: Alpha antivirus probleme.

Re: Alpha antivirus probleme.

Re: Alpha antivirus probleme.

Re: Alpha antivirus probleme.

Sujets similaires

Qui est en ligne