Se connecter / S'enregistrer
Votre question

Virus/Trojan ieav.exe impossible à éliminer

Tags :
  • Acer
  • Sécurité
Dernière réponse : dans Sécurité et virus
14 Juin 2008 17:14:39

Bonjour!
Je suis nouveau sur le forum. Je ne suis pas sur qu'il faille poster là, n'hésitez pas à m'indiquer si je me trompe.
J'ai le virus/trojan dénomé "ieav.ex". qui ouvre une fenetre "system error" trop souvent avec mon navigateur internet et même lorsque j'ouvre des dossiers sur mon disque...
Aprés une recherche sur le forum qui donne des solutions, j'ai suivi à la lettre toute la procédure indiqué (mode sans echec, malwayre bytes...) mais le problème persite....je ne sais plus quoi faire :sweat:  ...aidez moi please!
Je poste le rapport hijackthis si besoin...
merci d'avance et bravo pour le forum qui aide beaucoup!

bryce

*********************************
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:11:56, on 2008/06/14
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Acer\Empowering Technology\eAudio\eAudio.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSLoader.exe
C:\Program Files\Launch Manager\LManager.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Windows\system32\taskeng.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Users\Bryce\AppData\Local\Temp\RtkBtMnt.exe
C:\Acer\Empowering Technology\ENET\ENMTRAY.EXE
C:\Acer\Empowering Technology\EPOWER\EPOWER_DMC.EXE
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Program Files\Apoint2K\Apntex.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\Bryce\Downloads\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://fr.fr.acer.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.fr.acer.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ycomp/defaults/su/*http://fr.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Windows\system32\ActiveToolBand.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Sigma plugin - {B095AF15-2FB6-4239-95AD-D1E27ECC11C7} - C:\Windows\tasant32.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [eAudio] "C:\Acer\Empowering Technology\eAudio\eAudio.exe"
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [PLFSetL] C:\Windows\PLFSetL.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [PlayMovie] "C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Global Startup: Empowering Technology Launcher.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (no file)
O13 - Gopher Prefix:
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Plugin Control) - http://appldnld.apple.com.edgesuite.net/content.info.ap...
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/VistaMSNPUpld...
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: eNetHook.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ALaunch Service (ALaunchService) - Unknown owner - C:\Acer\ALaunch\ALaunchSvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 9121 bytes

Autres pages sur : virus trojan ieav exe impossible eliminer

15 Juin 2008 13:03:18

Bonjour,

Zippe ce fichier -> C:\Windows\tasant32.dll
et envoie le ici : http://siri.urz.free.fr/upload/

Supprime ensuite le zip.

Télécharge ComboFix (de sUBs) sur ton Bureau.

  • Désactive temporairement toute protection résidente ! (Antivirus, antispywares..)
  • Double clique sur ComboFix.exe.
  • Accepte la licence en cliquant sur Oui.
  • Lorsque l'opération sera terminée, un rapport apparaîtra. Poste ce rapport dans ta prochaine réponse.

    Le rapport se trouve ici : %systemdrive%\ComboFix.txt (%systemdrive% étant la partition où est installée Windows; C:\ en général)

    Aide : Comment utiliser ComboFix.
    15 Juin 2008 14:53:58

    Bonjour,
    j'ai procédé aux manip et voila le rapport combofix

    Par contre j'ai pas compris le coup du fichier zippé, c'ets quoi le but de le zipper et de l'envoyer?

    merci!


    ComboFix 08-06-12.2 - Bryce 2008-06-15 14:44:32.1 - NTFSx86
    Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.1976 [GMT 2:00]
    Endroit: C:\Users\Bryce\Desktop\ComboFix.exe
    * Création d'un nouveau point de restauration
    .

    (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\DRV\Tuner\Yuan\Resources\_desktop.ini
    C:\smp.bat
    C:\Windows\Fonts\CALIBRIB.TTF
    C:\Windows\system32\ACER.exe
    C:\Windows\system32\x64
    C:\Windows\system32\x64\csnp2uvc.dll
    C:\Windows\system32\x64\rsnpvc64.dll
    C:\Windows\system32\x64\sncduvc.sys
    C:\Windows\system32\x64\snp2uvc.sys
    C:\Windows\system32\x64\vsnpvc64.dll

    .
    ((((((((((((((((((((((((((((( Fichiers créés 2008-05-15 to 2008-06-15 ))))))))))))))))))))))))))))))))))))
    .

    2008-06-14 17:38 . 2008-06-14 17:38 281,088 --a------ C:\Windows\popost8x.dll
    2008-06-14 16:32 . 2008-06-14 16:32 <REP> d-------- C:\_OTMoveIt
    2008-06-14 15:50 . 2008-06-14 15:50 <REP> d-------- C:\Users\Bryce\AppData\Roaming\Malwarebytes
    2008-06-14 15:50 . 2008-06-14 15:50 <REP> d-------- C:\Users\Bryce\AppData\Roaming\Download Manager
    2008-06-14 15:50 . 2008-06-14 15:50 <REP> d-------- C:\Users\All Users\Malwarebytes
    2008-06-14 15:50 . 2008-06-14 15:50 <REP> d-------- C:\ProgramData\Malwarebytes
    2008-06-14 15:50 . 2008-06-14 15:50 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-06-14 15:50 . 2008-06-10 19:02 34,296 --a------ C:\Windows\System32\drivers\mbamcatchme.sys
    2008-06-14 15:50 . 2008-06-10 19:02 15,864 --a------ C:\Windows\System32\drivers\mbam.sys
    2008-06-14 14:32 . 2008-06-14 14:35 <REP> d-------- C:\Users\All Users\Lavasoft
    2008-06-14 14:32 . 2008-06-14 14:35 <REP> d-------- C:\ProgramData\Lavasoft
    2008-06-14 14:32 . 2008-06-14 14:32 <REP> d-------- C:\Program Files\Lavasoft
    2008-06-14 14:31 . 2008-06-14 14:31 <REP> d-------- C:\Program Files\Common Files\Wise Installation Wizard
    2008-06-14 13:01 . 2008-06-14 15:48 <REP> d-------- C:\Users\All Users\Spybot - Search & Destroy
    2008-06-14 13:01 . 2008-06-14 15:48 <REP> d-------- C:\ProgramData\Spybot - Search & Destroy
    2008-06-14 13:01 . 2008-06-14 15:53 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
    2008-06-14 05:10 . 2008-06-14 05:11 341,089,041 --a------ C:\Windows\MEMORY.DMP
    2008-06-14 04:19 . 2008-06-14 04:19 281,088 --a------ C:\Windows\tasant32.dll
    2008-06-13 17:24 . 2008-06-14 14:15 <REP> d-------- C:\Users\Bryce\AppData\Roaming\uTorrent
    2008-06-13 17:24 . 2008-06-13 17:24 <REP> d-------- C:\Program Files\uTorrent
    2008-06-11 22:50 . 2008-06-11 22:50 0 --ah----- C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
    2008-06-11 18:43 . 2008-06-11 18:43 <REP> d-------- C:\Program Files\DScaler5
    2008-06-11 17:16 . 2008-04-25 04:12 1,383,424 --a------ C:\Windows\System32\mshtml.tlb
    2008-06-11 17:16 . 2008-04-26 10:08 1,314,816 --a------ C:\Windows\System32\quartz.dll
    2008-06-11 17:16 . 2008-04-25 06:35 826,880 --a------ C:\Windows\System32\wininet.dll
    2008-06-11 17:16 . 2008-05-10 03:33 113,664 --a------ C:\Windows\System32\drivers\rmcast.sys
    2008-06-01 22:08 . 2008-06-01 22:08 268 --ah----- C:\sqmdata13.sqm
    2008-06-01 22:08 . 2008-06-01 22:08 244 --ah----- C:\sqmnoopt13.sqm
    2008-05-26 22:55 . 2001-12-15 12:10 294,912 --a------ C:\Windows\System32\Euphoria.scr
    2008-05-18 19:43 . 2008-05-18 19:43 244 --ah----- C:\sqmnoopt12.sqm
    2008-05-18 19:43 . 2008-05-18 19:43 232 --ah----- C:\sqmdata12.sqm
    2008-05-16 11:58 . 2008-05-16 11:58 12,632 --a------ C:\Windows\System32\lsdelete.exe

    .
    (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-06-15 12:39 --------- d-----w C:\Users\Bryce\AppData\Roaming\TeraCopy
    2008-06-14 12:03 --------- d-----w C:\Program Files\Total Video Converter
    2008-06-14 02:08 --------- d-----w C:\Program Files\Common Files\Adobe
    2008-06-13 18:55 --------- d-----w C:\Users\Bryce\AppData\Roaming\Skype
    2008-06-11 17:23 --------- d-----w C:\Program Files\Common Files\AVSMedia
    2008-06-11 17:23 --------- d-----w C:\Program Files\AVSMedia
    2008-05-19 19:48 --------- d-----w C:\ProgramData\Messenger Plus!
    2008-05-08 11:16 --------- d-----w C:\Users\Bryce\AppData\Roaming\Samsung
    2008-05-08 10:55 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-05-08 10:42 --------- d-----w C:\Program Files\Samsung
    2008-05-04 17:25 --------- d-----w C:\ProgramData\Microsoft Help
    2008-05-04 16:01 0 ---ha-w C:\Windows\system32\drivers\Msft_Kernel_ggsemc_01005.Wdf
    2008-05-04 15:43 20,520 ----a-w C:\Windows\system32\drivers\ggsemc.sys
    2008-05-04 15:43 13,352 ----a-w C:\Windows\system32\drivers\ggflt.sys
    2008-05-04 15:37 --------- d-----w C:\ProgramData\Sony Ericsson
    2008-05-04 15:31 --------- d-----w C:\Program Files\Sony Ericsson
    2008-05-04 09:28 --------- d-----w C:\Users\Bryce\AppData\Roaming\MyPhoneExplorer
    2008-05-04 09:24 --------- d-----w C:\ProgramData\BVRP Software
    2008-05-04 09:08 --------- d-----w C:\Users\Bryce\AppData\Roaming\InstallShield
    2008-05-04 08:47 --------- d-----w C:\Program Files\MyPhoneExplorer
    2008-04-29 09:20 15,648 ----a-w C:\Windows\system32\drivers\NSDriver.sys
    2008-04-29 09:19 15,648 ----a-w C:\Windows\system32\drivers\Awrtrd.sys
    2008-04-29 09:19 12,960 ----a-w C:\Windows\system32\drivers\Awrtpd.sys
    2008-04-19 13:56 --------- d-----w C:\ProgramData\CyberLink
    2008-03-28 17:41 7,680 ----a-w C:\Windows\System32\ff_vfw.dll
    2008-03-22 17:01 174 --sha-w C:\Program Files\desktop.ini
    2008-03-22 16:43 82,432 ----a-w C:\Windows\System32\axaltocm.dll
    2008-03-22 16:43 101,888 ----a-w C:\Windows\System32\ifxcardm.dll
    2008-03-22 12:20 27,335 ----a-w C:\Users\Bryce\AppData\Roaming\nvModes.dat
    2008-02-07 22:59 0 ----a-w C:\Users\Bryce\AppData\Roaming\wklnhst.dat
    .

    ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B095AF15-2FB6-4239-95AD-D1E27ECC11C7}]
    2008-06-14 17:38 281088 --a------ C:\Windows\popost8x.dll

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-19 09:33 1233920]
    "Acer Tour Reminder"="C:\Acer\AcerTour\Reminder.exe" [2007-05-22 15:49 151552]
    "MessengerPlus3"="C:\Program Files\MessengerPlus! 3\MsgPlus.exe" [2008-02-07 21:22 190024]
    "msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 13:54 5674352]
    "ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-19 09:33 125952]
    "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 09:33 202240]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "RtHDVCpl"="RtHDVCpl.exe" [2007-07-06 05:06 4669440 C:\Windows\RtHDVCpl.exe]
    "eAudio"="C:\Acer\Empowering Technology\eAudio\eAudio.exe" [2007-06-11 14:54 1286144]
    "eDataSecurity Loader"="C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-04-25 16:33 457216]
    "PLFSetL"="C:\Windows\PLFSetL.exe" [2007-07-05 13:35 94208]
    "LManager"="C:\PROGRA~1\LAUNCH~1\LManager.exe" [2007-06-27 11:15 752136]
    "IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-03-21 14:00 174872]
    "Apoint"="C:\Program Files\Apoint2K\Apoint.exe" [2007-06-06 10:06 159744]
    "WarReg_PopUp"="C:\Acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 22:48 57344]
    "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 15:00 79224]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
    "NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-08-23 17:45 86016]
    "NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-08-23 17:45 8478720]
    "NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-08-23 17:45 81920]
    "PlayMovie"="C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe" [2007-05-24 14:38 206952]

    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
    Empowering Technology Launcher.lnk - C:\Acer\Empowering Technology\eAPLauncher.exe [2007-08-10 09:29:07 535336]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableLUA"= 0 (0x0)
    "EnableUIADesktopToggle"= 0 (0x0)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=eNetHook.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "VIDC.YV12"= yv12vfw.dll
    "msacm.ac3filter"= ac3filter.acm

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
    @="Driver"

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acer Tour Reminder]
    --a------ 2007-05-22 15:49 151552 C:\Acer\AcerTour\Reminder.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
    --a------ 2007-03-08 04:38 40048 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
    --a------ 2008-03-25 20:44 171448 C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
    "{1ACDC690-E812-4BF4-8277-CADB310BB196}"= C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Acer Arcade Deluxe.exe:Acer Arcade Deluxe
    "{975C10A6-89E7-450F-8386-9F6BEC5992B5}"= C:\Program Files\Acer Arcade Deluxe\VideoMagician\VideoMagician.exe:VideoMagician
    "{4B2A96AC-90BB-469D-96F2-1E462E2F2103}"= C:\Program Files\Acer Arcade Deluxe\HomeMedia\HomeMedia.exe:HomeMedia
    "{CB0A5015-2744-4511-8C92-B47FF3948EAF}"= C:\Program Files\Acer Arcade Deluxe\DV Wizard\DV Wizard.exe:D V Wizard
    "{993B9FC0-4484-4523-BA7F-98D2CE026F2D}"= C:\Program Files\Acer Arcade Deluxe\DVDivine\DVDivine.exe:D VDivine
    "{9445A959-1EE9-4683-8957-940F6208DE92}"= C:\Program Files\Acer Arcade Deluxe\Play Movie\PlayMovie.exe:p lay Movie
    "{18B30A2E-8612-4F72-BDD1-AA55F7472320}"= C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe:p lay Movie Resident Program
    "{AD58D690-60C1-42D3-B9FD-5E6B51EFEF5E}"= C:\Program Files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
    "{BBEC2972-46E4-4AD7-BD47-3157BC26B12D}"= UDP:C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Acer Arcade Deluxe.exe:Acer Arcade Deluxe
    "{3C7B806F-35D0-4EE0-9B0C-56E4DDADB64E}"= TCP:C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Acer Arcade Deluxe.exe:Acer Arcade Deluxe
    "{D01461FF-1ECC-4087-8643-C3F8AD5BE3A6}"= UDP:C:\Program Files\MSN Messenger\msnmsgr.exe:msnmsgr
    "{3397514D-9FE3-4549-8CC4-1B6EAF82A275}"= TCP:C:\Program Files\MSN Messenger\msnmsgr.exe:msnmsgr
    "{625FA906-0308-452B-A549-7E3A3323A3E8}"= UDP:C:\Program Files\MessengerPlus! 3\MsgPlus.exe:MsgPlus
    "{51E15A9B-86A4-4C7C-962F-5B21ECC1E436}"= TCP:C:\Program Files\MessengerPlus! 3\MsgPlus.exe:MsgPlus
    "{AE8BB6B7-CD7F-4271-BE23-9023489C4941}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
    "TCP Query User{918F8E9D-453E-43EB-9D09-DF199D75AB37}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
    "UDP Query User{5C14865D-7ABD-4802-8692-51630281AA61}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
    "TCP Query User{811E6CE7-EAB5-4262-B71D-2748AD1D52D9}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
    "UDP Query User{1E181835-1C85-4D6C-A537-516A7A379541}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
    "{C4EBDD2D-0610-4A2A-B0D9-1E964EBA9CEF}"= C:\Program Files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
    "TCP Query User{B350ED28-FA3F-4AB1-9F97-20221C29B29E}C:\\program files\\sony ericsson\\update service\\update service.exe"= UDP:C:\program files\sony ericsson\update service\update service.exe:Update Service
    "UDP Query User{BEBB7287-F211-4EEA-AFD5-189926A275A3}C:\\program files\\sony ericsson\\update service\\update service.exe"= TCP:C:\program files\sony ericsson\update service\update service.exe:Update Service
    "{A8614FC2-8997-4543-A596-61E11FCE7155}"= Disabled:UDP:C:\Program Files\Skype\Phone\Skype.exe:Skype
    "{D0FCC0C9-E67B-4A9F-A347-407587C0738D}"= Disabled:TCP:C:\Program Files\Skype\Phone\Skype.exe:Skype
    "{DD11FF4F-BE81-4F0D-9302-07FDF03FEF80}"= UDP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent
    "{7C349767-10E0-479D-80AF-6DAD62A29516}"= TCP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent
    "{D2D29549-159E-4C11-A312-89F0D0343147}"= UDP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent
    "{6D3EBC9D-7C39-4923-BA1A-095CDE834FE2}"= TCP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent
    "{08928B5E-1D45-433E-BA41-1E6D1579651E}"= Disabled:UDP:C:\Program Files\Skype\Phone\Skype.exe:Skype
    "{1D6E9F6B-30EC-4FB8-9062-610CF9818E97}"= Disabled:TCP:C:\Program Files\Skype\Phone\Skype.exe:Skype

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
    "EnableFirewall"= 0 (0x0)

    R1 LUMDriver;LUMDriver;C:\Windows\system32\drivers\LUMDriver.sys [2003-07-11 16:22]
    R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};C:\Program Files\Acer Arcade Deluxe\Play Movie\000.fcl [2006-11-02 17:51]
    R2 ALaunchService;ALaunch Service;C:\Acer\ALaunch\ALaunchSvc.exe [2007-01-26 14:24]
    R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2007-12-04 16:52]
    R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;C:\Windows\system32\DRIVERS\b57nd60x.sys [2007-06-05 10:57]
    R3 enecir;ENE CIR Receiver;C:\Windows\system32\DRIVERS\enecir.sys [2007-03-07 10:26]
    R3 MODRC;Ultima Infrared Receiver;C:\Windows\system32\DRIVERS\modrc.sys [2007-02-06 13:10]
    S3 ggflt;SEMC USB Flash Driver Filter;C:\Windows\system32\DRIVERS\ggflt.sys [2008-05-04 17:43]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
    \shell\Auto\command - AdobeR.exe e
    \shell\AutoRun\command - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AdobeR.exe e

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
    \shell\Auto\command - AdobeR.exe e
    \shell\AutoRun\command - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AdobeR.exe e

    *Newly Created Service* - CATCHME
    .
    Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
    "2008-03-16 18:50:56 C:\Windows\Tasks\SesamTVMC.job"
    .
    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-06-15 14:46:40
    Windows 6.0.6001 Service Pack 1 NTFS

    Balayage processus cachés ...

    Balayage caché autostart entries ...

    Balayage des fichiers cachés ...

    Scan terminé avec succès
    Les fichiers cachés: 0

    **************************************************************************
    .
    Temps d'accomplissement: 2008-06-15 14:47:32
    ComboFix-quarantined-files.txt 2008-06-15 12:47:29

    Pre-Run: 45,532,442,624 octets libres
    Post-Run: 45,637,582,848 octets libres

    206 --- E O F --- 2008-06-14 18:09:15

    Contenus similaires
    15 Juin 2008 15:40:43

    Re,

    On l'envoie à un développeur pour qu'il examine le fichier.

    Télécharge Flash Disinfector (de sUBs) sur ton Bureau.

  • Connecte tous les périphériques externes ( DD , USB , ..... )
  • Double clique sur Flash Disinfector et laisse toi guider.

    **********

    Sélectionne l'intégralité du cadre ci-dessous :

    Collect::
    C:\Windows\popost8x.dll
    C:\Windows\tasant32.dll

    Folder::
    C:\_OTMoveIt

    Registry::
    [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B095AF15-2FB6-4239-95AD-D1E27ECC11C7}]
    [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
    [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]


    Cela va relancer Combofix. Après redémarrage, poste le contenu du rapport ComboFix.txt.
    S'il n'y a pas de rédémarrage, poste quand même le rapport.

  • Copie/colle le dans le Bloc Notes (Démarrer\Tous les programmes\Accessoires\Bloc notes.)
  • Enregistre le sous sur ton bureau sous le nom de CFScript.txt
  • Glisse maintenant le fichier CFScript.txt dans ComboFix.exe comme ci-dessous :

  • Cela va relancer Combofix. Poste le contenu du rapport ComboFix.txt après redémarrage s'il y en a un.
    15 Juin 2008 16:01:38

    Re
    Merci pour l'aide...Voila le rapport combofix.


    ComboFix 08-06-12.2 - Bryce 2008-06-15 15:52:42.2 - NTFSx86
    Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.1911 [GMT 2:00]
    Endroit: C:\Users\Bryce\Desktop\ComboFix.exe
    Command switches used :: C:\Users\Bryce\Desktop\CFScript.txt
    * Création d'un nouveau point de restauration
    .

    (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\_OTMoveIt
    C:\_OTMoveIt\MovedFiles\06142008_163207.log
    C:\_OTMoveIt\MovedFiles\06142008_163207.res
    C:\Windows\popost8x.dll
    C:\Windows\tasant32.dll

    .
    ((((((((((((((((((((((((((((( Fichiers créés 2008-05-15 to 2008-06-15 ))))))))))))))))))))))))))))))))))))
    .

    2008-06-14 15:50 . 2008-06-14 15:50 <REP> d-------- C:\Users\Bryce\AppData\Roaming\Malwarebytes
    2008-06-14 15:50 . 2008-06-14 15:50 <REP> d-------- C:\Users\Bryce\AppData\Roaming\Download Manager
    2008-06-14 15:50 . 2008-06-14 15:50 <REP> d-------- C:\Users\All Users\Malwarebytes
    2008-06-14 15:50 . 2008-06-14 15:50 <REP> d-------- C:\ProgramData\Malwarebytes
    2008-06-14 15:50 . 2008-06-14 15:50 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-06-14 15:50 . 2008-06-10 19:02 34,296 --a------ C:\Windows\System32\drivers\mbamcatchme.sys
    2008-06-14 15:50 . 2008-06-10 19:02 15,864 --a------ C:\Windows\System32\drivers\mbam.sys
    2008-06-14 14:32 . 2008-06-14 14:35 <REP> d-------- C:\Users\All Users\Lavasoft
    2008-06-14 14:32 . 2008-06-14 14:35 <REP> d-------- C:\ProgramData\Lavasoft
    2008-06-14 14:32 . 2008-06-14 14:32 <REP> d-------- C:\Program Files\Lavasoft
    2008-06-14 14:31 . 2008-06-14 14:31 <REP> d-------- C:\Program Files\Common Files\Wise Installation Wizard
    2008-06-14 13:01 . 2008-06-14 15:48 <REP> d-------- C:\Users\All Users\Spybot - Search & Destroy
    2008-06-14 13:01 . 2008-06-14 15:48 <REP> d-------- C:\ProgramData\Spybot - Search & Destroy
    2008-06-14 13:01 . 2008-06-14 15:53 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
    2008-06-14 05:10 . 2008-06-14 05:11 341,089,041 --a------ C:\Windows\MEMORY.DMP
    2008-06-13 17:24 . 2008-06-14 14:15 <REP> d-------- C:\Users\Bryce\AppData\Roaming\uTorrent
    2008-06-13 17:24 . 2008-06-13 17:24 <REP> d-------- C:\Program Files\uTorrent
    2008-06-11 22:50 . 2008-06-11 22:50 0 --ah----- C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
    2008-06-11 18:43 . 2008-06-11 18:43 <REP> d-------- C:\Program Files\DScaler5
    2008-06-11 17:16 . 2008-04-25 04:12 1,383,424 --a------ C:\Windows\System32\mshtml.tlb
    2008-06-11 17:16 . 2008-04-26 10:08 1,314,816 --a------ C:\Windows\System32\quartz.dll
    2008-06-11 17:16 . 2008-04-25 06:35 826,880 --a------ C:\Windows\System32\wininet.dll
    2008-06-11 17:16 . 2008-05-10 03:33 113,664 --a------ C:\Windows\System32\drivers\rmcast.sys
    2008-06-01 22:08 . 2008-06-01 22:08 268 --ah----- C:\sqmdata13.sqm
    2008-06-01 22:08 . 2008-06-01 22:08 244 --ah----- C:\sqmnoopt13.sqm
    2008-05-26 22:55 . 2001-12-15 12:10 294,912 --a------ C:\Windows\System32\Euphoria.scr
    2008-05-18 19:43 . 2008-05-18 19:43 244 --ah----- C:\sqmnoopt12.sqm
    2008-05-18 19:43 . 2008-05-18 19:43 232 --ah----- C:\sqmdata12.sqm
    2008-05-16 11:58 . 2008-05-16 11:58 12,632 --a------ C:\Windows\System32\lsdelete.exe

    .
    (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-06-15 13:42 --------- d-----w C:\Users\Bryce\AppData\Roaming\TeraCopy
    2008-06-14 12:03 --------- d-----w C:\Program Files\Total Video Converter
    2008-06-14 02:08 --------- d-----w C:\Program Files\Common Files\Adobe
    2008-06-13 18:55 --------- d-----w C:\Users\Bryce\AppData\Roaming\Skype
    2008-06-11 17:23 --------- d-----w C:\Program Files\Common Files\AVSMedia
    2008-06-11 17:23 --------- d-----w C:\Program Files\AVSMedia
    2008-05-19 19:48 --------- d-----w C:\ProgramData\Messenger Plus!
    2008-05-08 11:16 --------- d-----w C:\Users\Bryce\AppData\Roaming\Samsung
    2008-05-08 10:55 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-05-08 10:42 --------- d-----w C:\Program Files\Samsung
    2008-05-04 17:25 --------- d-----w C:\ProgramData\Microsoft Help
    2008-05-04 16:01 0 ---ha-w C:\Windows\system32\drivers\Msft_Kernel_ggsemc_01005.Wdf
    2008-05-04 15:43 20,520 ----a-w C:\Windows\system32\drivers\ggsemc.sys
    2008-05-04 15:43 13,352 ----a-w C:\Windows\system32\drivers\ggflt.sys
    2008-05-04 15:37 --------- d-----w C:\ProgramData\Sony Ericsson
    2008-05-04 15:31 --------- d-----w C:\Program Files\Sony Ericsson
    2008-05-04 09:28 --------- d-----w C:\Users\Bryce\AppData\Roaming\MyPhoneExplorer
    2008-05-04 09:24 --------- d-----w C:\ProgramData\BVRP Software
    2008-05-04 09:08 --------- d-----w C:\Users\Bryce\AppData\Roaming\InstallShield
    2008-05-04 08:47 --------- d-----w C:\Program Files\MyPhoneExplorer
    2008-04-29 09:20 15,648 ----a-w C:\Windows\system32\drivers\NSDriver.sys
    2008-04-29 09:19 15,648 ----a-w C:\Windows\system32\drivers\Awrtrd.sys
    2008-04-29 09:19 12,960 ----a-w C:\Windows\system32\drivers\Awrtpd.sys
    2008-04-19 13:56 --------- d-----w C:\ProgramData\CyberLink
    2008-03-28 17:41 7,680 ----a-w C:\Windows\System32\ff_vfw.dll
    2008-03-22 17:01 174 --sha-w C:\Program Files\desktop.ini
    2008-03-22 16:43 82,432 ----a-w C:\Windows\System32\axaltocm.dll
    2008-03-22 16:43 101,888 ----a-w C:\Windows\System32\ifxcardm.dll
    2008-03-22 12:20 27,335 ----a-w C:\Users\Bryce\AppData\Roaming\nvModes.dat
    2008-02-07 22:59 0 ----a-w C:\Users\Bryce\AppData\Roaming\wklnhst.dat
    .

    ((((((((((((((((((((((((((((( snapshot@2008-06-15_14.47.11,41 )))))))))))))))))))))))))))))))))))))))))
    .
    - 2008-06-11 20:48:36 102,094 ----a-w C:\Windows\System32\perfc009.dat
    + 2008-06-15 13:44:42 102,094 ----a-w C:\Windows\System32\perfc009.dat
    - 2008-06-11 20:48:36 124,434 ----a-w C:\Windows\System32\perfc00C.dat
    + 2008-06-15 13:44:42 124,434 ----a-w C:\Windows\System32\perfc00C.dat
    - 2008-06-11 20:48:36 590,082 ----a-w C:\Windows\System32\perfh009.dat
    + 2008-06-15 13:44:42 590,082 ----a-w C:\Windows\System32\perfh009.dat
    - 2008-06-11 20:48:36 672,334 ----a-w C:\Windows\System32\perfh00C.dat
    + 2008-06-15 13:44:42 672,334 ----a-w C:\Windows\System32\perfh00C.dat
    .
    ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-19 09:33 1233920]
    "Acer Tour Reminder"="C:\Acer\AcerTour\Reminder.exe" [2007-05-22 15:49 151552]
    "MessengerPlus3"="C:\Program Files\MessengerPlus! 3\MsgPlus.exe" [2008-02-07 21:22 190024]
    "msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 13:54 5674352]
    "ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-19 09:33 125952]
    "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 09:33 202240]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "RtHDVCpl"="RtHDVCpl.exe" [2007-07-06 05:06 4669440 C:\Windows\RtHDVCpl.exe]
    "eAudio"="C:\Acer\Empowering Technology\eAudio\eAudio.exe" [2007-06-11 14:54 1286144]
    "eDataSecurity Loader"="C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-04-25 16:33 457216]
    "PLFSetL"="C:\Windows\PLFSetL.exe" [2007-07-05 13:35 94208]
    "LManager"="C:\PROGRA~1\LAUNCH~1\LManager.exe" [2007-06-27 11:15 752136]
    "IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-03-21 14:00 174872]
    "Apoint"="C:\Program Files\Apoint2K\Apoint.exe" [2007-06-06 10:06 159744]
    "WarReg_PopUp"="C:\Acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 22:48 57344]
    "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 15:00 79224]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
    "NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-08-23 17:45 86016]
    "NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-08-23 17:45 8478720]
    "NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-08-23 17:45 81920]
    "PlayMovie"="C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe" [2007-05-24 14:38 206952]

    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
    Empowering Technology Launcher.lnk - C:\Acer\Empowering Technology\eAPLauncher.exe [2007-08-10 09:29:07 535336]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableLUA"= 0 (0x0)
    "EnableUIADesktopToggle"= 0 (0x0)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=eNetHook.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "VIDC.YV12"= yv12vfw.dll
    "msacm.ac3filter"= ac3filter.acm

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
    @="Driver"

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acer Tour Reminder]
    --a------ 2007-05-22 15:49 151552 C:\Acer\AcerTour\Reminder.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
    --a------ 2007-03-08 04:38 40048 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
    --a------ 2008-03-25 20:44 171448 C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
    "{1ACDC690-E812-4BF4-8277-CADB310BB196}"= C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Acer Arcade Deluxe.exe:Acer Arcade Deluxe
    "{975C10A6-89E7-450F-8386-9F6BEC5992B5}"= C:\Program Files\Acer Arcade Deluxe\VideoMagician\VideoMagician.exe:VideoMagician
    "{4B2A96AC-90BB-469D-96F2-1E462E2F2103}"= C:\Program Files\Acer Arcade Deluxe\HomeMedia\HomeMedia.exe:HomeMedia
    "{CB0A5015-2744-4511-8C92-B47FF3948EAF}"= C:\Program Files\Acer Arcade Deluxe\DV Wizard\DV Wizard.exe:D V Wizard
    "{993B9FC0-4484-4523-BA7F-98D2CE026F2D}"= C:\Program Files\Acer Arcade Deluxe\DVDivine\DVDivine.exe:D VDivine
    "{9445A959-1EE9-4683-8957-940F6208DE92}"= C:\Program Files\Acer Arcade Deluxe\Play Movie\PlayMovie.exe:p lay Movie
    "{18B30A2E-8612-4F72-BDD1-AA55F7472320}"= C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe:p lay Movie Resident Program
    "{AD58D690-60C1-42D3-B9FD-5E6B51EFEF5E}"= C:\Program Files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
    "{BBEC2972-46E4-4AD7-BD47-3157BC26B12D}"= UDP:C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Acer Arcade Deluxe.exe:Acer Arcade Deluxe
    "{3C7B806F-35D0-4EE0-9B0C-56E4DDADB64E}"= TCP:C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Acer Arcade Deluxe.exe:Acer Arcade Deluxe
    "{D01461FF-1ECC-4087-8643-C3F8AD5BE3A6}"= UDP:C:\Program Files\MSN Messenger\msnmsgr.exe:msnmsgr
    "{3397514D-9FE3-4549-8CC4-1B6EAF82A275}"= TCP:C:\Program Files\MSN Messenger\msnmsgr.exe:msnmsgr
    "{625FA906-0308-452B-A549-7E3A3323A3E8}"= UDP:C:\Program Files\MessengerPlus! 3\MsgPlus.exe:MsgPlus
    "{51E15A9B-86A4-4C7C-962F-5B21ECC1E436}"= TCP:C:\Program Files\MessengerPlus! 3\MsgPlus.exe:MsgPlus
    "{AE8BB6B7-CD7F-4271-BE23-9023489C4941}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
    "TCP Query User{918F8E9D-453E-43EB-9D09-DF199D75AB37}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
    "UDP Query User{5C14865D-7ABD-4802-8692-51630281AA61}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
    "TCP Query User{811E6CE7-EAB5-4262-B71D-2748AD1D52D9}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
    "UDP Query User{1E181835-1C85-4D6C-A537-516A7A379541}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
    "{C4EBDD2D-0610-4A2A-B0D9-1E964EBA9CEF}"= C:\Program Files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
    "TCP Query User{B350ED28-FA3F-4AB1-9F97-20221C29B29E}C:\\program files\\sony ericsson\\update service\\update service.exe"= UDP:C:\program files\sony ericsson\update service\update service.exe:Update Service
    "UDP Query User{BEBB7287-F211-4EEA-AFD5-189926A275A3}C:\\program files\\sony ericsson\\update service\\update service.exe"= TCP:C:\program files\sony ericsson\update service\update service.exe:Update Service
    "{A8614FC2-8997-4543-A596-61E11FCE7155}"= Disabled:UDP:C:\Program Files\Skype\Phone\Skype.exe:Skype
    "{D0FCC0C9-E67B-4A9F-A347-407587C0738D}"= Disabled:TCP:C:\Program Files\Skype\Phone\Skype.exe:Skype
    "{DD11FF4F-BE81-4F0D-9302-07FDF03FEF80}"= UDP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent
    "{7C349767-10E0-479D-80AF-6DAD62A29516}"= TCP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent
    "{D2D29549-159E-4C11-A312-89F0D0343147}"= UDP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent
    "{6D3EBC9D-7C39-4923-BA1A-095CDE834FE2}"= TCP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent
    "{08928B5E-1D45-433E-BA41-1E6D1579651E}"= Disabled:UDP:C:\Program Files\Skype\Phone\Skype.exe:Skype
    "{1D6E9F6B-30EC-4FB8-9062-610CF9818E97}"= Disabled:TCP:C:\Program Files\Skype\Phone\Skype.exe:Skype

    R1 LUMDriver;LUMDriver;C:\Windows\system32\drivers\LUMDriver.sys [2003-07-11 16:22]
    R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};C:\Program Files\Acer Arcade Deluxe\Play Movie\000.fcl [2006-11-02 17:51]
    R2 ALaunchService;ALaunch Service;C:\Acer\ALaunch\ALaunchSvc.exe [2007-01-26 14:24]
    R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2007-12-04 16:52]
    R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;C:\Windows\system32\DRIVERS\b57nd60x.sys [2007-06-05 10:57]
    R3 enecir;ENE CIR Receiver;C:\Windows\system32\DRIVERS\enecir.sys [2007-03-07 10:26]
    R3 MODRC;Ultima Infrared Receiver;C:\Windows\system32\DRIVERS\modrc.sys [2007-02-06 13:10]
    S3 ggflt;SEMC USB Flash Driver Filter;C:\Windows\system32\DRIVERS\ggflt.sys [2008-05-04 17:43]

    *Newly Created Service* - CATCHME
    .
    Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
    "2008-03-16 18:50:56 C:\Windows\Tasks\SesamTVMC.job"
    .
    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-06-15 15:55:46
    Windows 6.0.6001 Service Pack 1 NTFS

    Balayage processus cachés ...

    Balayage caché autostart entries ...

    Balayage des fichiers cachés ...

    Scan terminé avec succès
    Les fichiers cachés: 0

    **************************************************************************
    .
    Temps d'accomplissement: 2008-06-15 15:57:04
    ComboFix-quarantined-files.txt 2008-06-15 13:56:57
    ComboFix2.txt 2008-06-15 12:47:33

    Pre-Run: 47,260,868,608 octets libres
    Post-Run: 47,260,180,480 octets libres

    201 --- E O F --- 2008-06-14 18:09:15


    15 Juin 2008 16:36:31

    Où en sont les soucis ?
    poste un nouveau rapport HJT.
    15 Juin 2008 16:41:27

    Re
    Et bien tout semble fonctionnait normalement....plus de message "system error" et internet a retrouver sa vitesse de croisière normale...le virus semble donc etre éliminer....Merci pour tout...vous etes fabuleux!!
    Je poste le dernier rapport HJT...
    merci encore!


    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 16:39:14, on 2008/06/15
    Platform: Windows Vista SP1 (WinNT 6.00.1905)
    MSIE: Internet Explorer v7.00 (7.00.6001.18000)
    Boot mode: Normal

    Running processes:
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\RtHDVCpl.exe
    C:\Acer\Empowering Technology\eAudio\eAudio.exe
    C:\Acer\Empowering Technology\eDataSecurity\eDSLoader.exe
    C:\Program Files\Launch Manager\LManager.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
    C:\Program Files\Apoint2K\Apoint.exe
    C:\Program Files\Alwil Software\Avast4\ashDisp.exe
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Windows\ehome\ehtray.exe
    C:\Program Files\Windows Media Player\wmpnscfg.exe
    C:\Program Files\Apoint2K\ApMsgFwd.exe
    C:\Windows\ehome\ehmsas.exe
    C:\Program Files\Apoint2K\Apntex.exe
    C:\Acer\Empowering Technology\ENET\ENMTRAY.EXE
    C:\Acer\Empowering Technology\EPOWER\EPOWER_DMC.EXE
    C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\conime.exe
    C:\Windows\Explorer.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Windows\System32\mobsync.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Users\Bryce\Downloads\HiJackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.fr.acer.yahoo.com
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ycomp/defaults/su/*http://fr.yahoo.com
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
    O1 - Hosts: ::1 localhost
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Windows\system32\ActiveToolBand.dll
    O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
    O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
    O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
    O4 - HKLM\..\Run: [eAudio] "C:\Acer\Empowering Technology\eAudio\eAudio.exe"
    O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
    O4 - HKLM\..\Run: [PLFSetL] C:\Windows\PLFSetL.exe
    O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
    O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
    O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
    O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [PlayMovie] "C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe"
    O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    O4 - HKCU\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
    O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
    O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
    O4 - Global Startup: Empowering Technology Launcher.lnk = ?
    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (no file)
    O13 - Gopher Prefix:
    O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Plugin Control) - http://appldnld.apple.com.edgesuite.net/content.info.ap...
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/VistaMSNPUpld...
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O20 - AppInit_DLLs: eNetHook.dll
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: ALaunch Service (ALaunchService) - Unknown owner - C:\Acer\ALaunch\ALaunchSvc.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
    O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
    O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
    O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe
    O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
    O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
    O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
    O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

    --
    End of file - 8436 bytes
    15 Juin 2008 16:44:53

    Oups..désolé pour les fautes d'orthographe...je viens de relire mon mess!
    15 Juin 2008 16:45:01

    Okay,

    Télécharge Clean (de Malekal) sur ton Bureau.

  • Dézippe le sur ton Bureau. Double-clic sur le dossier Clean qui vient d'apparaître.
  • Double-clic sur Clean.cmd. (L’extension cmd peut ne pas apparaître) Cela va ouvrir une fenêtre noire.
  • Un menu va apparaître, choisis l'option 1 puis entrée. Ensuite appuies sur une touche comme il te sera demandé.
  • Poste le rapport qui se trouve ici : C:\rapport_clean.txt

    Si tu obtiens un fichier C:\upload_moi.zip, merci de faire ceci.

    Aide : Comment utiliser Clean.

    ********

    Désinstalle via Ajout/Suppression de Programmes (si présents) :
  • Avast!

    Télécharge et exécute : http://www.avast.com/eng/avast-uninstall-utility.html

    Télécharge Ccleaner sur ton Bureau.

  • Clique sur "download the latest version"
  • Installe-le en laissant seulement les options suivantes cochées :
    - Ajouter un raccourci sur le Bureau
    - Contrôler automatiquement les mises à jour de CCleaner
  • Lance le Nettoyage
  • Clique sur Chercher des erreurs et sauvegarde si tu le souhaites.

    Aide : Comment utiliser CCleaner.

    ***************

    Télécharge AntiVir sur ton Bureau.

  • Double clique sur l'exécutable téléchargé pour lancer l'installation.
  • A la fin de l'installation, clique sur Finish.
  • Ouvre Antivir, assure-toi qu’il soit bien à jour !
  • Dans l'onglet Local Protection, choisis Scanner.
  • Active la recherche de rootkits via le + de rootkit search, puis dans manual selection, coche tout (tes partitions de disque dur).
  • Clique sur la loupe du milieu pour lancer le scan en tant qu'Administrateur.
  • Poste moi le rapport généré : Pour cela, clique sur l'onglet Overview, puis choisis Reports, tu trouveras son rapport..

    Note : Pour une éradication des menaces plus efficace, lance le scan en mode sans échec.

    Pourquoi changer ? Avast vs Antivir.

    Aide : Comment installer et utiliser AntiVir.
    15 Juin 2008 17:27:51

    Re!
    Voici le rapport Clean, celui de antivir arrive quand j'aurai finis de la télécharger et l'installer!

    2008/06/15 a 16:48:58,52

    *** Recherche C:
    C:\autorun.inf FOUND

    *** Recherche C:\Windows\

    *** Recherche C:\Windows\system32
    C:\Windows\system32\wininit.exe FOUND
    C:\Windows\system32\wininit.exe FOUND

    *** Recherche C:\Program Files
    *** End of the report !
    15 Juin 2008 18:50:25

    Re!
    Voila le rapport antivir qui a détecté des virus/trojan, dois je les supprimer?




    Avira AntiVir Personal
    Report file date: dimanche 15 juin 2008 18:09

    Scanning for 1331584 virus strains and unwanted programs.

    Licensed to: Avira AntiVir PersonalEdition Classic
    Serial number: 0000149996-ADJIE-0001
    Platform: Windows Vista
    Windows version: (Service Pack 1) [6.0.6001]
    Boot mode: Save mode
    Username: Bryce
    Computer name: BRYCE

    Version information:
    BUILD.DAT : 8.1.00.295 16479 Bytes 2008/04/09 16:24:00
    AVSCAN.EXE : 8.1.2.12 311553 Bytes 2008/03/18 09:02:56
    AVSCAN.DLL : 8.1.1.0 53505 Bytes 2008/02/07 08:43:37
    LUKE.DLL : 8.1.2.9 151809 Bytes 2008/02/28 08:41:23
    LUKERES.DLL : 8.1.2.1 12033 Bytes 2008/02/21 08:28:40
    ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 2007/07/18 10:33:34
    ANTIVIR1.VDF : 7.0.3.2 5447168 Bytes 2008/03/07 13:08:58
    ANTIVIR2.VDF : 7.0.4.195 2546176 Bytes 2008/06/14 16:02:25
    ANTIVIR3.VDF : 7.0.4.196 2048 Bytes 2008/06/14 16:02:26
    Engineversion : 8.1.0.55
    AEVDF.DLL : 8.1.0.5 102772 Bytes 2008/02/25 09:58:21
    AESCRIPT.DLL : 8.1.0.40 266618 Bytes 2008/06/15 16:04:16
    AESCN.DLL : 8.1.0.21 119156 Bytes 2008/06/15 16:04:11
    AERDL.DLL : 8.1.0.20 418165 Bytes 2008/06/15 16:04:08
    AEPACK.DLL : 8.1.1.5 364918 Bytes 2008/06/15 16:03:57
    AEOFFICE.DLL : 8.1.0.18 192890 Bytes 2008/06/15 16:03:41
    AEHEUR.DLL : 8.1.0.30 1253750 Bytes 2008/06/15 16:03:34
    AEHELP.DLL : 8.1.0.15 115063 Bytes 2008/06/15 16:02:56
    AEGEN.DLL : 8.1.0.28 307572 Bytes 2008/06/15 16:02:54
    AEEMU.DLL : 8.1.0.6 430451 Bytes 2008/06/15 16:02:42
    AECORE.DLL : 8.1.0.31 168310 Bytes 2008/06/15 16:02:30
    AVWINLL.DLL : 1.0.0.7 14593 Bytes 2008/01/23 17:07:53
    AVPREF.DLL : 8.0.0.1 25857 Bytes 2008/02/18 10:37:50
    AVREP.DLL : 7.0.0.1 155688 Bytes 2007/04/16 13:26:47
    AVREG.DLL : 8.0.0.0 30977 Bytes 2008/01/23 17:07:49
    AVARKT.DLL : 1.0.0.23 307457 Bytes 2008/02/12 08:29:23
    AVEVTLOG.DLL : 8.0.0.11 114945 Bytes 2008/02/28 08:31:31
    SQLITE3.DLL : 3.3.17.1 339968 Bytes 2008/01/22 17:28:02
    SMTPLIB.DLL : 1.2.0.19 28929 Bytes 2008/01/23 17:08:39
    NETNT.DLL : 8.0.0.1 7937 Bytes 2008/01/25 12:05:10
    RCIMAGE.DLL : 8.0.0.35 2371841 Bytes 2008/03/10 14:37:25
    RCTEXT.DLL : 8.0.32.0 86273 Bytes 2008/03/06 12:02:11

    Configuration settings for the scan:
    Jobname..........................: Local Drives
    Configuration file...............: c:\program files\avira\antivir personaledition classic\alldrives.avp
    Logging..........................: low
    Primary action...................: interactive
    Secondary action.................: ignore
    Scan master boot sector..........: on
    Scan boot sector.................: on
    Boot sectors.....................: C:, D:, E:,
    Scan memory......................: on
    Process scan.....................: on
    Scan registry....................: on
    Search for rootkits..............: off
    Scan all files...................: Intelligent file selection
    Scan archives....................: on
    Recursion depth..................: 20
    Smart extensions.................: on
    Macro heuristic..................: on
    File heuristic...................: medium

    Start of the scan: dimanche 15 juin 2008 18:09

    The scan of running processes will be started
    Scan process 'avscan.exe' - '1' Module(s) have been scanned
    Scan process 'WmiPrvSE.exe' - '1' Module(s) have been scanned
    Scan process 'unsecapp.exe' - '1' Module(s) have been scanned
    Scan process 'avcenter.exe' - '1' Module(s) have been scanned
    Scan process 'svchost.exe' - '1' Module(s) have been scanned
    Scan process 'explorer.exe' - '1' Module(s) have been scanned
    Scan process 'aawservice.exe' - '1' Module(s) have been scanned
    Scan process 'svchost.exe' - '1' Module(s) have been scanned
    Scan process 'svchost.exe' - '1' Module(s) have been scanned
    Scan process 'svchost.exe' - '1' Module(s) have been scanned
    Scan process 'svchost.exe' - '1' Module(s) have been scanned
    Scan process 'svchost.exe' - '1' Module(s) have been scanned
    Scan process 'lsm.exe' - '1' Module(s) have been scanned
    Scan process 'lsass.exe' - '1' Module(s) have been scanned
    Scan process 'services.exe' - '1' Module(s) have been scanned
    Scan process 'winlogon.exe' - '1' Module(s) have been scanned
    Scan process 'wininit.exe' - '1' Module(s) have been scanned
    Scan process 'csrss.exe' - '1' Module(s) have been scanned
    Scan process 'csrss.exe' - '1' Module(s) have been scanned
    Scan process 'smss.exe' - '1' Module(s) have been scanned
    20 processes with 20 modules were scanned

    Starting master boot sector scan:
    Master boot sector HD0
    [INFO] No virus was found!

    Start scanning boot sectors:
    Boot sector 'C:\'
    [INFO] No virus was found!
    Boot sector 'D:\'
    [INFO] No virus was found!

    Starting to scan the registry.
    The registry was scanned ( '21' files ).


    Starting the file scan:

    Begin scan in 'C:\' <ACER>
    C:\pagefile.sys
    [WARNING] The file could not be opened!
    C:\upload_moi_BRYCE.tar.gz
    [0] Archive type: GZ
    --> upload_moi.tar
    [1] Archive type: TAR (tape archiver)
    --> qoobox/Quarantine/C/Windows/popost8x.dll.vir
    [DETECTION] Is the Trojan horse TR/Trash.Gen
    --> qoobox/Quarantine/C/Windows/tasant32.dll.vir
    [DETECTION] Is the Trojan horse TR/Trash.Gen
    [NOTE] The file was moved to '48c13f2c.qua'!
    C:\QooBox\Quarantine\C\Windows\popost8x.dll.vir
    [DETECTION] Is the Trojan horse TR/Trash.Gen
    [NOTE] The file was moved to '48c541ea.qua'!
    C:\QooBox\Quarantine\C\Windows\tasant32.dll.vir
    [DETECTION] Is the Trojan horse TR/Trash.Gen
    [NOTE] The file was moved to '48c841dc.qua'!
    C:\Users\Bryce\Pictures\Divers\about.Brontok.A.html
    [DETECTION] Contains detection pattern of the worm WORM/Bro.1
    [NOTE] The file was moved to '48c44315.qua'!
    Begin scan in 'D:\' <DATA>
    Begin scan in 'E:\'
    Search path E:\ could not be opened!
    Le périphérique n'est pas prêt.



    End of the scan: dimanche 15 juin 2008 18:43
    Used time: 34:10 min

    The scan has been done completely.

    17666 Scanning directories
    395389 Files were scanned
    5 viruses and/or unwanted programs were found
    0 Files were classified as suspicious:
    0 files were deleted
    0 files were repaired
    4 files were moved to quarantine
    0 files were renamed
    1 Files cannot be scanned
    395384 Files not concerned
    2243 Archives were scanned
    1 Warnings
    4 Notes

    15 Juin 2008 19:54:45

    Re,

    Poste un nouveau rapport HJT :) 
    15 Juin 2008 19:58:17

    Yep!
    Voila le rapport HJT....

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 19:57:20, on 2008/06/15
    Platform: Windows Vista SP1 (WinNT 6.00.1905)
    MSIE: Internet Explorer v7.00 (7.00.6001.18000)
    Boot mode: Normal

    Running processes:
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Windows\system32\taskeng.exe
    C:\Windows\RtHDVCpl.exe
    C:\Acer\Empowering Technology\eAudio\eAudio.exe
    C:\Acer\Empowering Technology\eDataSecurity\eDSLoader.exe
    C:\Program Files\Launch Manager\LManager.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
    C:\Program Files\Apoint2K\Apoint.exe
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\Users\Bryce\AppData\Local\Temp\RtkBtMnt.exe
    C:\Windows\System32\rundll32.exe
    C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Windows\ehome\ehtray.exe
    C:\Program Files\Windows Media Player\wmpnscfg.exe
    C:\Program Files\Apoint2K\ApMsgFwd.exe
    C:\Windows\System32\rundll32.exe
    C:\Program Files\Apoint2K\Apntex.exe
    C:\Windows\ehome\ehmsas.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Acer\Empowering Technology\ENET\ENMTRAY.EXE
    C:\Acer\Empowering Technology\EPOWER\EPOWER_DMC.EXE
    C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
    C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Windows\system32\wbem\unsecapp.exe
    C:\Program Files\uTorrent\uTorrent.exe
    C:\program files\avira\antivir personaledition classic\avcenter.exe
    C:\Users\Bryce\Documents\Install\HiJackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.fr.acer.yahoo.com
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ycomp/defaults/su/*http://fr.yahoo.com
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O1 - Hosts: ::1 localhost
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Windows\system32\ActiveToolBand.dll
    O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
    O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
    O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
    O4 - HKLM\..\Run: [eAudio] "C:\Acer\Empowering Technology\eAudio\eAudio.exe"
    O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
    O4 - HKLM\..\Run: [PLFSetL] C:\Windows\PLFSetL.exe
    O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
    O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
    O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
    O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [PlayMovie] "C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe"
    O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
    O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    O4 - HKCU\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
    O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
    O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
    O4 - Global Startup: Empowering Technology Launcher.lnk = ?
    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (no file)
    O13 - Gopher Prefix:
    O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Plugin Control) - http://appldnld.apple.com.edgesuite.net/content.info.ap...
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/VistaMSNPUpld...
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: ALaunch Service (ALaunchService) - Unknown owner - C:\Acer\ALaunch\ALaunchSvc.exe
    O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
    O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
    O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
    O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
    O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe
    O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
    O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
    O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
    O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

    --
    End of file - 9009 bytes
    15 Juin 2008 20:09:26

    Re,

    Relance HijackThis (clique droit -> lancer en tant qu'adminstrateur sous Vista), do a system scan only, coche ces lignes (si toujours présentes) :
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.fr.acer.yahoo.com
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/y [...]
    O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
    O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe

    Ferme toutes les applications en cours (particulièrement ton navigateur Internet).
    Puis Fix Checked !

    ************

    Sélectionne l’intégralité du cadre ci-dessous :
    @echo off & cls
    sc config CLTNetCnService start= disabled
    sc delete CLTNetCnService
    exit

    Copie/colle le dans le Bloc-notes (Démarrer\Tous les programmes\Accessoires\Bloc-notes.)
    Enregistre le sous sur ton Bureau sous le nom de Correction.bat
    Double-clique dessus. Poste le rapport généré (si présent).

    ************

    Télécharge ToolsCleaner2 (de A.Rothstein)

  • Installe le sur ton Bureau.
  • Clique sur Recherche pour lancer le scan.
  • Clique sur Supprimer pour nettoyer les outils utilisés.
  • Clique sur Quitter.
  • Poste ce rapport ~>C:\TCleaner.txt<~

  • Garde Ccleaner, Avg (ou MBAM) et AntiVir si nous les avons installés..
  • Désactive-réactive la restauration système.
  • Rapporte ton infection sur Malware Complaints >Tuto<
  • Ton(tes) infection(s) : Smitfraud.
  • Si tu ne la trouves pas dans la liste, poste dans Autres infections,

  • Mets ton ordi correctement à jour >ici<
  • Si ce n'est pas fait, assure-toi que les Mises à jour Automatiques Windows soient activées !

    Puis regarde ces dossiers :

    - Sécurité/Prévention
    - Conséquences de la multi-protection
    - Toolbars : Inutilité et ralentissements

    Bonne journée/soirée :) 
    Tom's guide dans le monde
    • Allemagne
    • Italie
    • Irlande
    • Royaume Uni
    • Etats Unis
    Suivre Tom's Guide
    Inscrivez-vous à la Newsletter
    • ajouter à twitter
    • ajouter à facebook
    • ajouter un flux RSS