Ad served by Qualityads [Résolu] • page 5

[jeffoulain]

Salut,

Le rapport OTL nouveau est arrivé

Code: Tout sélectionner

OTL logfile created on: 25/02/2011 08:47:04 - Run 4
OTL by OldTimer - Version 3.2.20.6     Folder = C:\Users\Jeff\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19019)
Locale: 0000040C | Country: France | Language: FRA | Date Format: dd/MM/yyyy
 
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 52,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 75,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 141,04 Gb Total Space | 43,33 Gb Free Space | 30,72% Space Free | Partition Type: NTFS
 
Computer Name: LOSSANTOS | User Name: Jeff | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
[color=#E56717]========== Processes (SafeList) ==========[/color]
 
PRC - C:\Users\Jeff\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe (Google Inc.)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - c:\Program Files\Windows Defender\MpCmdRun.exe (Microsoft Corporation)
PRC - C:\Program Files\ATK Hotkey\HControl.exe (ATK0100)
PRC - C:\Program Files\ATK Hotkey\ASLDRSrv.exe ()
PRC - C:\Program Files\ATK Hotkey\ATKOSD.exe ()
PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Program Files\Common Files\aol\acs\AOLacsd.exe (AOL LLC)
 
 
[color=#E56717]========== Modules (SafeList) ==========[/color]
 
MOD - C:\Users\Jeff\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Program Files\Alwil Software\Avast5\snxhk.dll (AVAST Software)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll (Microsoft Corporation)
 
 
[color=#E56717]========== Win32 Services (SafeList) ==========[/color]
 
SRV - (Planificateur LiveUpdate automatique) --  File not found
SRV - (avast! Antivirus) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (ASLDRService) -- C:\Program Files\ATK Hotkey\ASLDRSrv.exe ()
SRV - (AOL ACS) -- C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe (AOL LLC)
SRV - (IDriverT) -- C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe (Macrovision Corporation)
 
 
[color=#E56717]========== Driver Services (SafeList) ==========[/color]
 
DRV - (aswSP) -- C:\Windows\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswTdi) -- C:\Windows\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswRdr) -- C:\Windows\System32\drivers\aswRdr.sys (AVAST Software)
DRV - (aswMonFlt) -- C:\Windows\System32\drivers\aswMonFlt.sys (AVAST Software)
DRV - (aswFsBlk) -- C:\Windows\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (ZTEusbnmea) -- C:\Windows\System32\drivers\ZTEusbnmea.sys (ZTE Incorporated)
DRV - (massfilter) -- C:\Windows\System32\drivers\massfilter.sys (ZTE Incorporated)
DRV - (ZTEusbvoice) -- C:\Windows\System32\drivers\ZTEusbvoice.sys (ZTE Incorporated)
DRV - (ZTEusbser6k) -- C:\Windows\System32\drivers\ZTEusbser6k.sys (ZTE Incorporated)
DRV - (ZTEusbmdm6k) -- C:\Windows\System32\drivers\ZTEusbmdm6k.sys (ZTE Incorporated)
DRV - (ZTEusbnet) -- C:\Windows\System32\drivers\ZTEusbnet.sys (ZTE Corporation)
DRV - (hwdatacard) -- C:\Windows\System32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)
DRV - (Btcsrusb) -- C:\Windows\System32\drivers\btcusb.sys (IVT Corporation.)
DRV - (BlueletSCOAudio) -- C:\Windows\System32\drivers\BlueletSCOAudio.sys (IVT Corporation.)
DRV - (BT) -- C:\Windows\System32\drivers\btnetdrv.sys (IVT Corporation.)
DRV - (BTHidMgr) -- C:\Windows\System32\Drivers\BTHidMgr.sys (IVT Corporation.)
DRV - (BTHidEnum) -- C:\Windows\System32\Drivers\vbtenum.sys (IVT Corporation.)
DRV - (VcommMgr) -- C:\Windows\System32\drivers\VCommMgr.sys (IVT Corporation.)
DRV - (VComm) -- C:\Windows\System32\drivers\VComm.sys (IVT Corporation.)
DRV - (BlueletAudio) -- C:\Windows\System32\drivers\blueletaudio.sys (IVT Corporation.)
DRV - (R300) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (MTsensor) -- C:\Windows\System32\drivers\ATKACPI.sys (ATK0100)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (PCAMp50) -- C:\Windows\System32\drivers\PCAMp50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (PCASp50) -- C:\Windows\System32\drivers\PCASp50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (Cam5603D) -- C:\Windows\System32\drivers\BisonCam.sys (Bison Electronics. Inc. )
DRV - (SynTP) -- C:\Windows\System32\drivers\SynTP.sys (Synaptics, Inc.)
DRV - (RTL8023xp) -- C:\Windows\System32\drivers\Rtnicxp.sys (Realtek Semiconductor Corporation                           )
DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (SiSRaid2) -- C:\Windows\system32\drivers\sisraid2.sys (Silicon Integrated Systems Corp.)
DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Logic Corporation)
DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (wanatw) WAN Miniport (ATW) -- C:\Windows\System32\drivers\wanatw4.sys (America Online, Inc.)
DRV - (AtiPcie) ATI PCI Express (3GIO) -- C:\Windows\system32\DRIVERS\AtiPcie.sys (ATI Technologies Inc.)
 
 
[color=#E56717]========== Standard Registry (SafeList) ==========[/color]
 
 
[color=#E56717]========== Internet Explorer ==========[/color]
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = fr
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 51 A7 E9 18 8F B8 C9 01  [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
[color=#E56717]========== FireFox ==========[/color]
 
FF - prefs.js..browser.search.defaultenginename: "Durable"
FF - prefs.js..browser.search.defaulturl: "http://www.durable.com/result?cx=partner-pub-7902900401080901%3Azbljezwsgul&cof=FORID%3A10&ie=UTF-8&q="
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://www.google.fr/"
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:1.5.4.20081105
FF - prefs.js..extensions.enabledItems: smartwebprinting@hp.com:4.5
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0015-0000-0017-ABCDEFFEDCBA}:5.0.17
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {268ad77e-cff8-42d7-b479-da60a7b93305}:1.6.9
FF - prefs.js..extensions.enabledItems: {1993c11e-f278-80ce-baf6-a46af8aff2b2}:4.6.7.3
FF - prefs.js..keyword.URL: "http://www.durable.com/result?cx=partner-pub-7902900401080901%3Azbljezwsgul&cof=FORID%3A10&ie=UTF-8&q="
 
 
FF - HKLM\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010/05/30 18:55:18 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/12/15 17:24:54 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/01/05 08:47:49 | 000,000,000 | ---D | M]
 
[2009/01/02 17:41:55 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jeff\AppData\Roaming\mozilla\Extensions
[2011/02/21 18:50:26 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jeff\AppData\Roaming\mozilla\Firefox\Profiles\msb83raq.default\extensions
[2009/09/05 14:09:02 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Jeff\AppData\Roaming\mozilla\Firefox\Profiles\msb83raq.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/01/25 21:24:39 | 000,000,000 | ---D | M] (Groowe Search Toolbar) -- C:\Users\Jeff\AppData\Roaming\mozilla\Firefox\Profiles\msb83raq.default\extensions\{268ad77e-cff8-42d7-b479-da60a7b93305}
[2011/01/09 21:42:50 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Users\Jeff\AppData\Roaming\mozilla\Firefox\Profiles\msb83raq.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2009/05/01 15:19:19 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\Jeff\AppData\Roaming\mozilla\Firefox\Profiles\msb83raq.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2010/11/30 09:01:30 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\Jeff\AppData\Roaming\mozilla\Firefox\Profiles\msb83raq.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010/02/01 09:41:53 | 000,000,000 | ---D | M] (WalterShop) -- C:\Users\Jeff\AppData\Roaming\mozilla\Firefox\Profiles\msb83raq.default\extensions\toolbar@waltershop.com
[2010/02/01 09:54:54 | 000,002,314 | ---- | M] () -- C:\Users\Jeff\AppData\Roaming\Mozilla\Firefox\Profiles\msb83raq.default\searchplugins\durable.xml
[2011/01/30 12:19:44 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011/01/30 12:19:44 | 000,000,000 | ---D | M] (z) -- C:\Program Files\Mozilla Firefox\extensions\{1993c11e-f278-80ce-baf6-a46af8aff2b2}
[2007/05/24 21:49:07 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Program Files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2010/09/17 13:35:19 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010/10/29 11:15:56 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBA}
[2011/01/05 08:47:52 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011/01/23 20:31:11 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2010/05/30 18:55:18 | 000,000,000 | ---D | M] (HP Smart Web Printing) -- C:\PROGRAM FILES\HP\DIGITAL IMAGING\SMART WEB PRINTING\MOZILLAADDON3
[2010/11/12 18:53:06 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2010/12/15 17:24:47 | 000,001,516 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazon-france.xml
[2010/12/15 17:24:47 | 000,001,822 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\cnrtl-tlfi-fr.xml
[2010/12/15 17:24:47 | 000,000,757 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-france.xml
[2010/12/15 17:24:47 | 000,001,426 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-fr.xml
[2010/12/15 17:24:47 | 000,000,956 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-france.xml
 
O1 HOSTS File: ([2011/02/16 09:22:30 | 000,000,098 | ---- | M]) - C:\Windows\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1       localhost
O2 - BHO: (HP Print Enhancer) - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
O2 - BHO: (Aide pour le lien d'Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll (Google Inc.)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Google\Google_BAE\BAE.dll (Packard Bell)
O2 - BHO: (HP Smart BHO Class) - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: UacDisableNotify = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll (Google Inc.)
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Afficher ou masquer l'HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: aol.com ([objects] * is out of zone range -  5)
O15 - HKCU\..Trusted Domains: mappy.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: orange.fr ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: weborama.fr ([orange] http in Trusted sites)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} http://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab (BDSCANONLINE Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-0015-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_17-windows-i586.cab (Java Plug-in 1.5.0_17)
O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\Packard Bell\Wallpaper\Wallpaper Galactic_1900x1440.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\Packard Bell\Wallpaper\Wallpaper Galactic_1900x1440.jpg
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2011/02/04 18:30:43 | 000,000,000 | R--D | M] - C:\Autorun.inf -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
MsConfig - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^OFFICE One Startup v7.lnk - C:\Program Files\OFFICE One v7\OFFICE One Startup v7\oostartupv7.exe - (ISSENDIS)
MsConfig - StartUpReg: [b]AOL Fast Start[/b] - hkey= - key= - C:\Program Files\AOL 9.0 VR\AOL.EXE (AOL)
MsConfig - StartUpReg: [b]HostManager[/b] - hkey= - key= - C:\Program Files\Common Files\aol\1180039809\ee\aolsoftware.exe (America Online, Inc.)
MsConfig - StartUpReg: [b]Picasa Media Detector[/b] - hkey= - key= - C:\Program Files\Picasa2\PicasaMediaDetector.exe (Google Inc.)
MsConfig - StartUpReg: [b]RoxWatchTray[/b] - hkey= - key= - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe (Sonic Solutions)
MsConfig - StartUpReg: [b]toolbar_eula_launcher[/b] - hkey= - key= - C:\Program Files\Packard Bell\GOOGLE_EULA\EULALauncher.exe ( )
MsConfig - State: "startup" - 2
 
SafeBootMin: AppMgmt -  File not found
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: AppMgmt -  File not found
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: WudfPf - Driver
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {166B1BCA-3F9C-11CF-8075-444553540000} - Adobe Shockwave Director 10.1
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Adobe Shockwave Director 10.1
ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {2F6EFCE6-10DF-49F9-9E64-9AE3775B2588} - Microsoft .NET Framework 1.1 Security Update (KB2416447)
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} -
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.8
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C6BAF60B-6E91-453F-BFF9-D3789CFEFCDD} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Macromedia Shockwave Flash
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} -
ActiveX: >{8AA6CB35-67D7-45A2-B1F4-C87EC19E4522} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
 
Drivers32: msacm.ac3acm - C:\Windows\System32\ac3acm.acm (fccHandler)
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lameacm - C:\Windows\System32\lameACM.acm (http://www.mp3dev.org/)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.FFDS - C:\Windows\System32\ff_vfw.dll ()
Drivers32: vidc.i420 - C:\Windows\System32\i420vfw.dll (www.helixcommunity.org)
Drivers32: VIDC.XVID - C:\Windows\System32\xvidvfw.dll ()
Drivers32: VIDC.YV12 - C:\Windows\System32\yv12vfw.dll (www.helixcommunity.org)
 
[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]
 
[2011/02/20 16:20:07 | 000,000,000 | ---D | C] -- C:\Program Files\SEAF
[2011/02/20 16:19:19 | 000,498,868 | ---- | C] (C_XX) -- C:\Users\Jeff\Desktop\SEAF.exe
[2011/02/16 12:41:27 | 000,000,000 | ---D | C] -- C:\Program Files\Ad-Remover
[2011/02/10 17:54:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2011/02/09 19:42:56 | 002,039,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2011/02/09 19:42:50 | 003,602,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe
[2011/02/09 19:42:50 | 003,550,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe
[2011/02/09 19:42:39 | 001,469,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2011/02/09 19:42:39 | 000,611,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll
[2011/02/09 19:42:39 | 000,602,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2011/02/09 19:42:39 | 000,385,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec
[2011/02/09 19:42:38 | 000,387,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll
[2011/02/09 19:42:38 | 000,184,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2011/02/09 19:42:38 | 000,164,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2011/02/09 19:42:38 | 000,133,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2011/02/09 19:42:38 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll
[2011/02/09 19:42:38 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll
[2011/02/09 19:42:38 | 000,055,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll
[2011/02/09 19:42:38 | 000,055,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll
[2011/02/09 19:42:38 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll
[2011/02/09 19:42:38 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2011/02/09 19:42:35 | 001,638,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2011/02/09 19:42:35 | 000,173,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe
[2011/02/09 19:42:35 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe
[2011/02/09 19:42:18 | 000,292,352 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll
[2011/02/09 19:42:17 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\System32\atmlib.dll
[2011/02/09 18:56:35 | 000,000,000 | ---D | C] -- C:\Users\Jeff\Desktop\Impros Bouffon
[2011/02/09 17:16:29 | 000,000,000 | ---D | C] -- C:\Users\Jeff\AppData\Local\temp
[2011/02/09 17:10:37 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2011/02/09 17:08:11 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2011/02/09 16:56:52 | 000,212,480 | ---- | C] (SteelWerX) -- C:\Windows\SWXCACLS.exe
[2011/02/08 23:01:53 | 000,000,000 | ---D | C] -- C:\MISSANDRA
[2011/02/08 22:22:52 | 000,161,792 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2011/02/08 22:22:52 | 000,136,704 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2011/02/08 22:22:52 | 000,031,232 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2011/02/08 22:22:46 | 000,000,000 | ---D | C] -- C:\ComboFix
[2011/02/08 22:16:28 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2011/02/08 22:15:26 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011/02/08 19:05:09 | 000,000,000 | ---D | C] -- C:\Program Files\Feedback Tool
[2011/02/08 17:58:23 | 000,000,000 | ---D | C] -- C:\Windows\BDOSCAN8
[2011/02/07 22:37:17 | 000,000,000 | ---D | C] -- C:\_OTL
[2011/02/07 22:28:14 | 000,602,624 | ---- | C] (OldTimer Tools) -- C:\Users\Jeff\Desktop\OTL.exe
[2011/02/04 18:54:28 | 000,038,848 | ---- | C] (AVAST Software) -- C:\Windows\avastSS.scr
[2011/02/04 18:30:43 | 000,000,000 | R--D | C] -- C:\Autorun.inf
[2011/02/02 20:12:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ZHP
[2011/02/02 20:11:56 | 000,000,000 | ---D | C] -- C:\Program Files\ZHPDiag
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]
 
[2011/02/25 08:50:54 | 000,000,416 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{97D72ACA-7D15-4CDC-82E8-1740C8E0B1C6}.job
[2011/02/25 08:30:00 | 000,000,338 | ---- | M] () -- C:\Windows\tasks\Recovery DVD Creator.job
[2011/02/25 08:30:00 | 000,000,338 | ---- | M] () -- C:\Windows\tasks\Extension de garantie.job
[2011/02/25 08:23:05 | 000,001,050 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/02/25 08:23:01 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/02/25 08:23:01 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/02/25 08:22:50 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/02/25 08:22:46 | 1878,286,336 | -HS- | M] () -- C:\hiberfil.sys
[2011/02/21 19:11:00 | 000,001,054 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/02/20 16:19:20 | 000,498,868 | ---- | M] (C_XX) -- C:\Users\Jeff\Desktop\SEAF.exe
[2011/02/19 00:40:56 | 110,012,736 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2011/02/18 15:11:07 | 000,002,060 | ---- | M] () -- C:\Users\Jeff\.recently-used.xbel
[2011/02/16 12:41:28 | 000,001,639 | ---- | M] () -- C:\Users\Jeff\Desktop\AD-R.lnk
[2011/02/16 09:22:30 | 000,000,098 | ---- | M] () -- C:\Windows\System32\drivers\etc\Hosts
[2011/02/15 20:40:43 | 000,248,320 | ---- | M] () -- C:\Users\Jeff\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/02/13 13:50:20 | 000,055,347 | ---- | M] () -- C:\Users\Jeff\Desktop\Ilford-film-HP5Plus.pdf
[2011/02/10 19:33:51 | 000,000,759 | ---- | M] () -- C:\Users\Public\Desktop\eMule.lnk
[2011/02/10 19:30:15 | 000,018,838 | ---- | M] () -- C:\Users\Jeff\Documents\cc_20110210_193001.reg
[2011/02/10 18:49:59 | 000,661,824 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011/02/09 20:23:51 | 285,714,892 | ---- | M] () -- C:\Users\Jeff\Desktop\Impro 1.wmv
[2011/02/09 16:56:42 | 004,265,880 | R--- | M] () -- C:\Users\Jeff\Desktop\MISSANDRA.exe
[2011/02/09 13:44:37 | 000,105,229 | ---- | M] () -- C:\Users\Jeff\Desktop\rsa.pdf
[2011/02/07 22:28:21 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Users\Jeff\Desktop\OTL.exe
[2011/02/04 18:54:29 | 000,002,577 | ---- | M] () -- C:\Windows\System32\config.nt
[2011/02/04 18:08:54 | 000,003,666 | ---- | M] () -- C:\UsbFix_Upload_Me_LOSSANTOS.zip
[2011/01/30 14:47:45 | 707,015,646 | ---- | M] () -- C:\Users\Jeff\Desktop\Monty Pythons - Erik Le Viking - Monthy Pythons - Vostfr (1989).avi
[2011/01/30 11:52:11 | 182,611,968 | ---- | M] () -- C:\Users\Jeff\Desktop\Monthy Pythons Flying Circus - 24 - s02 e11 - How Not To Be Seen.avi
[2011/01/30 11:06:59 | 011,110,106 | ---- | M] () -- C:\Users\Jeff\Desktop\Test Flitox-Prudence.wmv
[2011/01/29 12:27:52 | 002,882,925 | ---- | M] () -- C:\Users\Jeff\Desktop\Henry Mancini - Theme from Mission Impossible.mp3
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
[color=#E56717]========== Files Created - No Company Name ==========[/color]
 
[2011/02/19 00:40:56 | 110,012,736 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2011/02/18 15:11:07 | 000,002,060 | ---- | C] () -- C:\Users\Jeff\.recently-used.xbel
[2011/02/16 12:41:28 | 000,001,639 | ---- | C] () -- C:\Users\Jeff\Desktop\AD-R.lnk
[2011/02/13 13:50:20 | 000,055,347 | ---- | C] () -- C:\Users\Jeff\Desktop\Ilford-film-HP5Plus.pdf
[2011/02/10 19:30:07 | 000,018,838 | ---- | C] () -- C:\Users\Jeff\Documents\cc_20110210_193001.reg
[2011/02/09 20:10:38 | 285,714,892 | ---- | C] () -- C:\Users\Jeff\Desktop\Impro 1.wmv
[2011/02/09 13:44:37 | 000,105,229 | ---- | C] () -- C:\Users\Jeff\Desktop\rsa.pdf
[2011/02/08 22:22:52 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe
[2011/02/08 22:22:52 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2011/02/08 22:22:52 | 000,089,088 | ---- | C] () -- C:\Windows\MBR.exe
[2011/02/08 22:22:52 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2011/02/08 22:22:52 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2011/02/08 22:14:52 | 004,265,880 | R--- | C] () -- C:\Users\Jeff\Desktop\MISSANDRA.exe
[2011/01/30 11:11:28 | 707,015,646 | ---- | C] () -- C:\Users\Jeff\Desktop\Monty Pythons - Erik Le Viking - Monthy Pythons - Vostfr (1989).avi
[2011/01/30 11:11:05 | 182,611,968 | ---- | C] () -- C:\Users\Jeff\Desktop\Monthy Pythons Flying Circus - 24 - s02 e11 - How Not To Be Seen.avi
[2011/01/30 11:03:23 | 011,110,106 | ---- | C] () -- C:\Users\Jeff\Desktop\Test Flitox-Prudence.wmv
[2011/01/29 12:17:22 | 002,882,925 | ---- | C] () -- C:\Users\Jeff\Desktop\Henry Mancini - Theme from Mission Impossible.mp3
[2010/12/12 20:13:51 | 000,000,038 | ---- | C] () -- C:\Windows\avisplitter.ini
[2010/12/12 20:13:46 | 000,790,528 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2010/12/12 20:13:46 | 000,134,144 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2010/12/12 20:13:45 | 000,108,032 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
[2010/09/17 13:38:43 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010/05/30 18:42:57 | 000,001,730 | ---- | C] () -- C:\ProgramData\hpzinstall.log
[2010/02/01 10:58:55 | 000,165,376 | ---- | C] () -- C:\Windows\System32\unrar.dll
[2009/11/07 09:16:54 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009/09/12 13:38:02 | 000,000,434 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2009/09/12 13:38:02 | 000,000,027 | ---- | C] () -- C:\Windows\BRPP2KA.INI
[2009/01/22 18:26:19 | 000,027,648 | ---- | C] () -- C:\Windows\System32\AVSredirect.dll
[2009/01/05 15:44:10 | 000,000,453 | ---- | C] () -- C:\Windows\bdoscandellang.ini
[2008/05/02 11:13:51 | 000,237,568 | ---- | C] () -- C:\Windows\System32\lame_enc.dll
[2008/03/03 08:49:13 | 000,000,680 | ---- | C] () -- C:\Users\Jeff\AppData\Local\d3d9caps.dat
[2007/09/26 12:20:35 | 000,248,320 | ---- | C] () -- C:\Users\Jeff\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/09/25 09:41:11 | 000,000,092 | ---- | C] () -- C:\Users\Jeff\AppData\Local\fusioncache.dat
[2007/05/25 07:04:18 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2007/05/25 07:04:15 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2007/05/25 07:04:08 | 000,015,190 | ---- | C] () -- C:\Windows\M2000Twn.ini
[2007/05/24 22:20:20 | 000,016,384 | ---- | C] () -- C:\Windows\System32\DsrSleep.dll
[2007/05/24 22:19:07 | 000,162,304 | ---- | C] () -- C:\Windows\System32\ztvunrar36.dll
[2007/05/24 22:19:07 | 000,077,312 | ---- | C] () -- C:\Windows\System32\ztvunace26.dll
[2007/02/13 08:48:38 | 000,000,000 | ---- | C] () -- C:\Windows\System32\px.ini
[2006/11/02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006/11/02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
 
[color=#E56717]========== Custom Scans ==========[/color]
 
 
[color=#A23BEC]< %systemroot%\system32\drivers\*.sys /lockedfiles >[/color]
 
[color=#A23BEC]< %ALLUSERSPROFILE%\Application Data\*. >[/color]
 
[color=#A23BEC]< %ALLUSERSPROFILE%\Application Data\*.exe /s >[/color]
 
[color=#A23BEC]< %APPDATA%\*. >[/color]
[2009/01/16 19:09:47 | 000,000,000 | ---D | M] -- C:\Users\Jeff\AppData\Roaming\Adobe
[2007/09/26 12:36:56 | 000,000,000 | ---D | M] -- C:\Users\Jeff\AppData\Roaming\AOL
[2008/05/20 11:14:25 | 000,000,000 | ---D | M] -- C:\Users\Jeff\AppData\Roaming\Apple Computer
[2007/09/26 12:10:44 | 000,000,000 | ---D | M] -- C:\Users\Jeff\AppData\Roaming\ATI
[2009/09/12 13:42:47 | 000,000,000 | R--D | M] -- C:\Users\Jeff\AppData\Roaming\Brother
[2007/11/25 14:58:28 | 000,000,000 | ---D | M] -- C:\Users\Jeff\AppData\Roaming\Google
[2011/02/19 00:39:53 | 000,000,000 | ---D | M] -- C:\Users\Jeff\AppData\Roaming\gtk-2.0
[2010/06/10 11:11:00 | 000,000,000 | ---D | M] -- C:\Users\Jeff\AppData\Roaming\HP
[2007/09/25 09:40:19 | 000,000,000 | ---D | M] -- C:\Users\Jeff\AppData\Roaming\Identities
[2010/06/28 16:41:36 | 000,000,000 | ---D | M] -- C:\Users\Jeff\AppData\Roaming\InstallShield
[2007/09/26 12:36:55 | 000,000,000 | ---D | M] -- C:\Users\Jeff\AppData\Roaming\Macromedia
[2009/04/05 20:10:58 | 000,000,000 | ---D | M] -- C:\Users\Jeff\AppData\Roaming\Malwarebytes
[2006/11/02 13:37:34 | 000,000,000 | ---D | M] -- C:\Users\Jeff\AppData\Roaming\Media Center Programs
[2011/02/10 19:35:38 | 000,000,000 | ---D | M] -- C:\Users\Jeff\AppData\Roaming\Media Player Classic
[2011/02/08 19:05:17 | 000,000,000 | --SD | M] -- C:\Users\Jeff\AppData\Roaming\Microsoft
[2009/01/02 17:41:55 | 000,000,000 | ---D | M] -- C:\Users\Jeff\AppData\Roaming\Mozilla
[2009/02/01 11:43:05 | 000,000,000 | ---D | M] -- C:\Users\Jeff\AppData\Roaming\NCH Software
[2007/09/25 09:40:51 | 000,000,000 | ---D | M] -- C:\Users\Jeff\AppData\Roaming\OFFICE One v7
[2011/02/21 12:01:29 | 000,000,000 | ---D | M] -- C:\Users\Jeff\AppData\Roaming\OFFICEOne7
[2007/11/25 14:56:21 | 000,000,000 | ---D | M] -- C:\Users\Jeff\AppData\Roaming\Packard Bell
[2008/04/06 12:34:19 | 000,000,000 | ---D | M] -- C:\Users\Jeff\AppData\Roaming\Roxio
[2010/07/28 18:12:36 | 000,000,000 | ---D | M] -- C:\Users\Jeff\AppData\Roaming\SFR
[2010/12/10 15:40:55 | 000,000,000 | ---D | M] -- C:\Users\Jeff\AppData\Roaming\Skype
[2010/12/10 15:28:06 | 000,000,000 | ---D | M] -- C:\Users\Jeff\AppData\Roaming\skypePM
[2007/09/26 12:28:14 | 000,000,000 | ---D | M] -- C:\Users\Jeff\AppData\Roaming\Talkback
[2008/12/04 12:34:11 | 000,000,000 | ---D | M] -- C:\Users\Jeff\AppData\Roaming\U3
[2010/05/25 13:27:33 | 000,000,000 | ---D | M] -- C:\Users\Jeff\AppData\Roaming\Uniblue
[2010/01/16 20:56:19 | 000,000,000 | ---D | M] -- C:\Users\Jeff\AppData\Roaming\uTorrent
[2009/12/08 17:38:43 | 000,000,000 | ---D | M] -- C:\Users\Jeff\AppData\Roaming\Vodafone
 
[color=#A23BEC]< %APPDATA%\*.exe /s >[/color]
[2008/02/13 08:07:36 | 000,393,216 | ---- | M] () -- C:\Users\Jeff\AppData\Roaming\NCH Software\Components\aacenc3\aacenc3.exe
[2007/11/27 08:41:32 | 000,405,504 | ---- | M] () -- C:\Users\Jeff\AppData\Roaming\NCH Software\Components\mp3el2\lame.exe
[2006/08/15 10:15:04 | 000,110,592 | ---- | M] () -- C:\Users\Jeff\AppData\Roaming\U3\temp\cleanup.exe
 
[color=#A23BEC]< %SYSTEMDRIVE%\*.exe >[/color]
 
[color=#A23BEC]< %systemroot%\*. /mp /s >[/color]
 
[color=#A23BEC]< %systemroot%\system32\*.dll /lockedfiles >[/color]
[2010/12/18 07:22:10 | 000,184,320 | ---- | M] (Microsoft Corporation)[b] Unable to obtain MD5[/b] -- C:\Windows\System32\iepeers.dll
[2009/04/11 07:27:47 | 000,241,128 | ---- | M] (Microsoft Corporation)[b] Unable to obtain MD5[/b] -- C:\Windows\System32\rsaenh.dll
[2009/04/11 07:28:23 | 000,228,352 | ---- | M] (Microsoft Corporation)[b] Unable to obtain MD5[/b] -- C:\Windows\System32\SLC.dll
[2010/03/05 15:01:02 | 000,420,352 | ---- | M] (Microsoft Corporation)[b] Unable to obtain MD5[/b] -- C:\Windows\System32\vbscript.dll
[1 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ]
 
[color=#A23BEC]< %systemroot%\Tasks\*.job /lockedfiles >[/color]
 
[color=#E56717]========== Alternate Data Streams ==========[/color]
 
@Alternate Data Stream - 76 bytes -> C:\Users\Jeff\Documents\Updater5:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Jeff\Documents\Mes fichiers reçus:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Jeff\Documents\gegl-0.0:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Jeff\Documents\Bluetooth:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Jeff\Documents\backups:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Jeff\Documents\Administratif:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Jeff\Desktop\Videos:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Jeff\Desktop\TEXTES DIVERS:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Jeff\Desktop\Test Flitox-Prudence.wmv:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Jeff\Desktop\SKETCHS:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Jeff\Desktop\Projet Sonore    La Plage:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Jeff\Desktop\Privé:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Jeff\Desktop\PORT:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Jeff\Desktop\PARTOCHES:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Jeff\Desktop\Nouveau spectacle:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Jeff\Desktop\Nous Discossssss.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Jeff\Desktop\Musiques Lune:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Jeff\Desktop\Monty Pythons - Erik Le Viking - Monthy Pythons - Vostfr (1989).avi:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Jeff\Desktop\Monthy Pythons Flying Circus - 24 - s02 e11 - How Not To Be Seen.avi:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Jeff\Desktop\Mode emploi M305.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Jeff\Desktop\LES FIGURES LIBRES DE JEFF:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Jeff\Desktop\Le Moteur à Explosion.mp3:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Jeff\Desktop\karaoke - Frank Sinatra - New York, New York.mpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Jeff\Desktop\Jeune Public:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Jeff\Desktop\j.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Jeff\Desktop\Instrumentale - Karaoke - LIZA MINELLI - New York, New Yor.mp3:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Jeff\Desktop\Impros Bouffon:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Jeff\Desktop\Impro 1.wmv:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Jeff\Desktop\Henry Mancini - Theme from Mission Impossible.mp3:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Jeff\Desktop\Feu d'artifice lucioles.wav:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Jeff\Desktop\Faith by Me.wav:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Jeff\Desktop\Effets WAV:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Jeff\Desktop\Effets MP3:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Jeff\Desktop\Ecole des femmes:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Jeff\Desktop\CD Qui a croqué 2010:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Jeff\Desktop\Cd Figures LIbres:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Jeff\Desktop\Cam:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Jeff\Desktop\Bande son provisoire:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Jeff\Desktop\AFFICHES:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Jeff\Desktop\06 - Dario Moreno - C'est magnifique.mp3:Roxio EMC Stream
@Alternate Data Stream - 64 bytes -> C:\Users\Jeff\Desktop\karaoke - Frank Sinatra - New York, New York.mpg:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\Jeff\Desktop\Henry Mancini - Theme from Mission Impossible.mp3:TOC.WMV

< End of report >


P.S : ce truc me pourrit vraiment de + en + la navigation, mon accès à ma boite hotmail, par exple, est très compliqué...

[jeffoulain]

Bon, voilà ce que dit MyHosts :

** Rapport MyHosts.txt **

MyHosts V.1.0.0.2 de jeanmimigab

Merci à la team MH, W-T ,C_XX, Laddy et à Batch_man pour leurs aides

Résultat de l'opération:restauration du fichier hosts réussi...

** Fin du rapport **

C'est bon signe??

[danakil]

C'est bon signe??

On va le savoir sous peu!
Je viens de relire l'ensemble des posts et je me suis rendu compte de ceci :
Au début --> RON ads by clickbuster
Maintenant --> Ad served by Qualityads
C'est la même infection mais ayant changée de nom.

Donc on tourne en rond car on tape à côté.

Fais ceci :

1/ Ferme toutes les fenêtres actives sur ton PC.
Relance OTL > Clic droit dessus > "Exécuter en tant qu'Administrateur".
Dans l'interface d'OTL, vérifie que la case "Rapport minimal" soit bien cochée.
Copie et colle le contenu de cette citation dans la fenêtre Personnalisation.

:OTL
O1 - Hosts: ::1 localhost

:Commands
[emptytemp]
[emptyflash]
[reboot]

Clique sur le bouton Correction.
Ne touche plus au PC avant son redémarrage.
A l'ouverture du PC un rapport va s'ouvrir --> OTL.txt ... Si ce n'est le cas tu le retrouveras sous le même nom sur le Bureau ou alors dans son dossier --> C:\OTL
Copie et colle ici en réponse le contenu de ce rapport.

2/ Relance AD-Remover qui est sur ton Bureau (AD-R.exe).
Déconnecte-toi et ferme toutes applications en cours.
http://forum.pcastuces.com/desactiver_l ... -f31s4.htm
Désactive provisoirement et seulement le temps de l'utilisation de AD-Remover, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent gêner fortement la procédure de nettoyage de l'outil.

Double-clique sur l'icône AD-Remover située sur ton Bureau.
(Vista et Seven : clic droit dessus --> Exécuter en tant qu'Administrateur)

Au menu principal, choisis l'option Nettoyer.

Poste le rapport qui apparaît à la fin.
(Le rapport est sauvegardé aussi sous C:\Ad-report(clean).txt )

3/ Utilise SEAF qui est sur ton Bureau pour lancer une recherche.
Coche les cases --> "Afficher les ADS", "Afficher également les dossiers" et "Chercher également dans le registre".
Dans la case des occurences colle cette citation :

Code: Tout sélectionner

RON ads ; clickbuster ; Qualityads


Lance la recherche.
Poste moi le rapport que tu obtiendras.

[jeffoulain]

Rapport OTL après la manoeuvre :

Code: Tout sélectionner

All processes killed
========== OTL ==========
::1 localhost removed from HOSTS file successfully
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Camille
->Temp folder emptied: 0 bytes
 
User: Default
->Temp folder emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
 
User: Jeff
->Temp folder emptied: 6724899 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 70411617 bytes
->Flash cache emptied: 1267 bytes
 
User: Public
->Temp folder emptied: 0 bytes
 
User: ReleaseEngineer.MACROVISION
->Temp folder emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 5036 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 184325 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 74,00 mb
 
 
[EMPTYFLASH]
 
User: All Users
 
User: Camille
 
User: Default
 
User: Default User
 
User: Jeff
->Flash cache emptied: 0 bytes
 
User: Public
 
User: ReleaseEngineer.MACROVISION
 
Total Flash Files Cleaned = 0,00 mb
 
 
OTL by OldTimer - Version 3.2.20.6 log created on 02252011_140149

Files\Folders moved on Reboot...
File move failed. C:\Windows\temp\_avast5_\Webshlock.txt scheduled to be moved on reboot.
C:\Windows\temp\JETC572.tmp moved successfully.
C:\Windows\temp\~ROMFN_00000CE4 moved successfully.

Registry entries deleted on Reboot...


Je continue le reste...

[jeffoulain]

Rapport Ad-remover :

Code: Tout sélectionner

======= RAPPORT D'AD-REMOVER 2.0.0.2,E | UNIQUEMENT XP/VISTA/7 =======

Mis à jour par TeamXscript le 16/02/11
Contact: AdRemover[DOT]contact[AT]gmail[DOT]com
Site web: http://www.teamxscript.org

C:\Program Files\Ad-Remover\main.exe (CLEAN [2]) -> Lancé à 15:23:46 le 25/02/2011, Mode normal

Microsoft® Windows Vista™ Édition Familiale Premium  Service Pack 2 (X86)
Jeff@LOSSANTOS (PACKARD BELL BV EasyNote_MX36)
 
============== ACTION(S) ==============



(!) -- Fichiers temporaires supprimés.




============== SCAN ADDITIONNEL ==============

**** Mozilla Firefox Version [3.6.13 (fr)] ****

HKLM_MozillaPlugins\@viewpoint.com/VMP (x)
Extensions\{1993c11e-f278-80ce-baf6-a46af8aff2b2} (z)
Extensions\{3112ca9c-de6d-4884-a869-9855de68056c} (Google Toolbar for Firefox)
Extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} (Skype extension for Firefox      )
Extensions\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBA} (Java Console)
HKLM_Extensions|smartwebprinting@hp.com - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
HKCU_Extensions|smartwebprinting@hp.com - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

-- C:\Users\Jeff\AppData\Roaming\Mozilla\FireFox\Profiles\msb83raq.default --
Extensions\toolbar@waltershop.com (WalterShop)
Extensions\{268ad77e-cff8-42d7-b479-da60a7b93305} (Groowe Search Toolbar)
Extensions\{3112ca9c-de6d-4884-a869-9855de68056c} (Google Toolbar for Firefox)
Searchplugins\durable.xml (?)
Prefs.js - browser.download.dir, C:\\Users\\Jeff\\Desktop
Prefs.js - browser.download.lastDir, C:\\Users\\Jeff\\Desktop
Prefs.js - browser.search.defaultenginename, Durable
Prefs.js - browser.search.defaulturl, hxxp://www.durable.com/result?cx=partner-pub-7902900401080901%3Azbljezwsgul&cof=FORID%3A10&ie...
Prefs.js - browser.search.selectedEngine, Google
Prefs.js - browser.startup.homepage, hxxp://www.google.fr/
Prefs.js - browser.startup.homepage_override.mstone, rv:1.9.2.13
Prefs.js - keyword.URL, hxxp://www.durable.com/result?cx=partner-pub-7902900401080901%3Azbljezwsgul&cof=FORID%3A10&ie=UTF-8&q=

========================================

**** Internet Explorer Version [8.0.6001.19019] ****

HKCU_Main|Default_Page_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKCU_Main|Default_Search_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU_Main|Search bar - hxxp://go.microsoft.com/fwlink/?linkid=54896
HKCU_Main|Start Page - hxxp://fr.msn.com/
HKLM_Main|Default_Page_URL - hxxp://go.microsoft.com/fwlink/?LinkId=54896
HKLM_Main|Default_Search_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM_Main|Search bar - hxxp://search.msn.com/spbasic.htm
HKLM_Main|Search Page - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM_Main|Start Page - hxxp://fr.msn.com/
HKLM_ElevationPolicy\{4426E0F4-D71B-11DA-8750-001185653D78} - c:\program files\google\googletoolbar1user.exe (x)
HKLM_ElevationPolicy\{70f641fd-9ffc-4d5b-a4dc-962af4ed7999} - C:\Program Files\Internet Explorer\iedw.exe (x)
HKLM_Extensions\{85d1f590-48f4-11d9-9669-0800200c9a66} - "?" (?)
HKLM_Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5} - "Skype add-on for Internet Explorer" (C:\Program Files\Skype\Toolbars\Internet Explorer\icon.ico)
BHO\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - "Skype add-on for Internet Explorer" (C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll)
BHO\{CA6319C0-31B7-401E-A518-A07C3DB8F777} - "CBrowserHelperObject Object" (C:\Program Files\Google\Google_BAE\BAE.dll)

========================================

C:\Program Files\Ad-Remover\Quarantine: 38 Fichier(s)
C:\Program Files\Ad-Remover\Backup: 29 Fichier(s)

C:\Ad-Report-CLEAN[1].txt - 16/02/2011 12:41:39 (4678 Octet(s))
C:\Ad-Report-CLEAN[2].txt - 25/02/2011 15:23:55 (3805 Octet(s))

Fin à: 15:25:03, 25/02/2011
 
============== E.O.F ==============


[jeffoulain]

Pour finir, celui de SEAF :

Code: Tout sélectionner

1. ========================= SEAF 1.0.1.0 - C_XX
2.
3. Commencé à: 16:27:55 le 25/02/2011
4.
5. Valeur(s) recherchée(s):
6. RON ads
7. clickbuster
8. Qualityads
9.
10. Légende: TC => Date de création, TM => Date de modification, DA => Dernier accès
11.
12. (!) --- Affichage des ADS
13. (!) --- Affichage des dossiers
14. (!) --- Recherche registre
15.
16. ====== Fichier(s) ======
17.
18. Aucun fichier trouvé
19.
20.
21. ====== Entrée(s) du registre ======
22.
23. Aucun élément dans le registre trouvé
24.
25. =========================
26.
27. Fin à: 16:35:20 le 25/02/2011
28. 412780 Éléments analysés
29.
30. =========================
31. E.O.F


[danakil]

OK!

Dans l'immédiat évite d'utiliser IE, même pour te connecter à msn.com

J'aurai besoin d'un autre rapport composé de deux parties :

Télécharge RSIT de random/random sur le Bureau.

> Double clique sur RSIT.exe pour le lancer.
(Vista et Seven > Clic droit dessus > Exécuter en tant qu'Adinistrateur).
> Clique sur Continue dans la fenêtre qui apparaîtra.
* RSIT téléchargera HijackThis, s'il n’est pas présent où détecté sur ton PC > Accepte la licence d'installation.
> Poste moi ici en réponse les contenues des deux rapports, log.txt et info.txt (réduit dans la barre des Tâches) à la fin de l’analyse.

Utilise cjoint.com pour poster en lien tes rapports.
- Clique sur Parcourir pour aller chercher le rapport C:\rsit\log.txt
- Clique sur Ouvrir ensuite sur Créer le lien Cjoint
- Fais un copier/coller du lien http qui te sera donné et poste le.
...
> Fais la même chose avec l'autre rapport C:\rsit\info.txt

[jeffoulain]

Voilà, voilà...

http://cjoint.com/?0czrou8NoUJ

http://cjoint.com/?0czrpmNLCIG

P.S : ça va, ça vient, mais Qualityads est toujours là

[danakil]

Relance HijackThis (jeff.exe) > Do a system scan only > Coche cette ligne :

O1 - Hosts: ÿþ

> Clique sur Fix Checked > Valide par OUI > Referme tout et redémarre ton PC.

Au redémarrage ...
Relance HijackThis > Do a system scan and save a logfile > Poste moi le rapport.

[jeffoulain]

C'est fait :

http://cjoint.com/?0czsyWhTnQG

[danakil]

Bon on va faire un peu de nettoyage sur ton PC.
Il y a un tas de tools de désinfection ayant plusieurs noms et différentes versions que cela devient difficile de comprendre ...
(Exemple ComboFix.exe(2011) <=> Missandra.exe(2009/2010), ou encore jeff.exe(2011) <=> sniffle.exe(2009))

Fais ceci :
Télécharge DelFix de Xplode
> Lance-le.
> A l'invite de commandes sélectionne le bouton Suppression
> Patiente le temps du scan jusqu'à l'ouverture du rapport.
> Copie et colle ici en réponse ce rapport.
(Le rapport est sauvegardé ici --> C:\DelFixSearch)

[Del-crosseur]

Bonsoir Dana

Je me permet deux secondes....

@jeffoulain
Après avoir effectuer la manipulation donner par Danakil , pourrais tu te rendre dans Panneau de configuration et faire une impression d'écran de tous les programmes installer stp...

Merci , bonne soirée

[jeffoulain]

Effectivement, ça fait du ménage...

Code: Tout sélectionner

# DelFix v7.4 - Rapport créé le 26/02/2011 à 11:54
# Mis à jour le 09/02/11 à 23h par Xplode
# Système d'exploitation : Windows Vista (TM) Home Premium (32 bits) [version 6.0.6002] Service Pack 2
# Nom d'utilisateur : Jeff - LOSSANTOS (Administrateur)
# Exécuté depuis : C:\Users\Jeff\Desktop\DelFix.exe
# Option [Suppression]


~~~~~~ Dossier(s) ~~~~~~

-> C:\Qoobox\BackEnv ... ACL modifié avec succès.
Supprimé : C:\Qoobox
Supprimé : C:\USBFix
Supprimé : C:\_OTL
Supprimé : C:\RSIT
Supprimé : C:\MyHosts
Supprimé : C:\Combofix
Supprimé : C:\Program Files\Ad-Remover
Supprimé : C:\Program Files\ZHPDiag
Supprimé : C:\Program Files\SEAF
Supprimé : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ZHP

~~~~~~ Fichier(s) ~~~~~~

Supprimé : C:\Users\Jeff\Desktop\MISSANDRA.exe <-- Combofix
Supprimé : C:\ComboFix.txt
Supprimé : C:\UsbFix_Upload_Me_LOSSANTOS.zip
Supprimé : C:\Ad-Report-CLEAN[1].txt
Supprimé : C:\Ad-Report-CLEAN[2].txt
Supprimé : C:\MyHosts.txt
Supprimé : C:\Windows\grep.exe
Supprimé : C:\Windows\PEV.exe
Supprimé : C:\Windows\NIRCMD.exe
Supprimé : C:\Windows\MBR.exe
Supprimé : C:\Windows\sed.exe
Supprimé : C:\Windows\SWREG.exe
Supprimé : C:\Windows\SWSC.exe
Supprimé : C:\Windows\SWXCACLS.exe
Supprimé : C:\Windows\zip.exe
Supprimé : C:\Users\Jeff\Desktop\OTL.exe
Supprimé : C:\Users\Jeff\Desktop\OTL.Txt
Supprimé : C:\Users\Jeff\Desktop\MyHosts.exe
Supprimé : C:\Users\Jeff\Desktop\RSIT.exe
Supprimé : C:\Users\Jeff\Desktop\SEAF.exe
Supprimé : C:\Users\Jeff\Desktop\AD-R.lnk
Supprimé : C:\Users\Jeff\Desktop\hijackthis.log

~~~~~~ Registre ~~~~~~

Clé Supprimée : HKCU\SOFTWARE\Ad-Remover
Clé Supprimée : HKCU\SOFTWARE\USBFix
Clé Supprimée : HKLM\Software\swearware
Clé Supprimée : HKLM\Software\OldTimer Tools
Clé Supprimée : HKLM\Software\Classes\.cfxxe
Clé Supprimée : HKLM\Software\Classes\cfxxefile
Clé Supprimée : HKLM\Software\TrendMicro\Hijackthis
Clé Supprimée : HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Ad-Remover
Clé Supprimée : HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Hijackthis
Clé Supprimée : HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\SEAF
Clé Supprimée : HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\USBFix
Clé Supprimée : HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\ZHPDiag_is1
Clé Supprimée : HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\HijackThis.exe
Clé Supprimée : HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\combofix.exe

~~~~~~ Autre ~~~~~~

-> BitDefender Online Scanner ... Désinstallé avec succès
-> Prefetch vidé

########## EOF - "C:\DelFixSuppr.txt" - [2744 octets] ##########

[jeffoulain]

Salut Del-crosseur,

J'ai fait ça, j'espère que c'est ce que tu voulais...



Uploaded with ImageShack.us

++
Jeff

[danakil]

Re,

Maintenant voyons cette identification "Hosts".

• Télécharge HijackThis sur ton Bureau.
• Double cliques sur l'icône présente sur le Bureau pour le lancer.
Si tu es sous Vista ou Seven, clic droit dessus et "Exécuter en tant qu'Administrateur
• Sélectionne le bouton "Do a system scan and save a logfile
A la fin du scan copie et colle ici en réponse le contenu du rapport crée.