Alpha Antivirus : Comment s'en debarasser ?

[dz.malek]

Bonjour tout le monde,
j'aurai besoin d'un coup de main.


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:08:38, on 25/09/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18294)
Boot mode: Normal

Running processes:
C:Windowssystem32Dwm.exe
c:PROGRA~1mcafee.comagentmcagent.exe
C:Windowssystem32 askeng.exe
C:WindowsExplorer.EXE
C:Program FilesWindows DefenderMSASCui.exe
C:WindowsRtHDVCpl.exe
C:Program FilesAcerEmpowering TechnologySysMonitor.exe
C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDSLoader.exe
C:Program FilesCyberlinkPowerDVDPDVDServ.exe
C:Program FilesNewTech InfosystemsNTI Backup Now 5BkupTray.exe
C:Program FilesGoogleGoogle Desktop SearchGoogleDesktop.exe
C:Program FilesWindows LiveMessengermsnmsgr.exe
C:Program FilesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe
C:Program FilesGoogleGoogle Desktop SearchGoogleDesktop.exe
C:Program FilesGoogleGoogle Desktop SearchGoogleDesktop.exe
c:PROGRA~1mcafeeVIRUSS~1mcvsshld.exe
C:Windowssystem32wuauclt.exe
C:Program FilesInternet Explorerieuser.exe
C:Program FilesAcerEmpowering TechnologyNotificationCenterFramework.NotificationCenter.exe
C:WindowsSystem32mobsync.exe
C:Program FilesWindows LiveContactswlcomm.exe
C:Program FilesInternet Exploreriexplore.exe
C:Program FilesGoogleGoogle ToolbarGoogleToolbarUser_32.exe
C:Program FilesVideoLANVLCvlc.exe
C:Windowssystem32MacromedFlashFlashUtil10c.exe
C:UsersMouzaouiDesktopsolution.exe

R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACA ... pire_x3200
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.google.fr/
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACA ... pire_x3200
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://fr.fr.acer.yahoo.com
R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant =
R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch =
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll
O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:PROGRA~1mcafeemskmskapbho.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:PROGRA~1mcafeeVIRUSS~1scriptsn.dll
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:Program FilesAcerEmpowering TechnologyeDataSecurityx86ActiveToolBand.dll
O2 - BHO: Partner BHO Class - {83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4} - C:ProgramDataPartnerpartner.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:Program FilesCommon FilesMicrosoft SharedWindows LiveWindowsLiveLogin.dll
O2 - BHO: (no name) - {A77D3539-581D-450C-9E44-A84C415A6172} - C:WindowsSystem32msnaoladdon.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:Program FilesGoogleGoogle ToolbarGoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:Program FilesGoogleGoogleToolbarNotifier5.2.4204.1700swg.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:PROGRA~1mcafeeSITEAD~1mcieplg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:Program FilesGoogleGoogle ToolbarComponentfastsearch_B7C5AC242193BB3E.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDStoolbar.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:Program FilesGoogleGoogle ToolbarGoogleToolbar_32.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:PROGRA~1mcafeeSITEAD~1mcieplg.dll
O4 - HKLM..Run: [Windows Defender] %ProgramFiles%Windows DefenderMSASCui.exe -hide
O4 - HKLM..Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM..Run: [Acer Empowering Technology Monitor] C:Program FilesAcerEmpowering TechnologySysMonitor.exe
O4 - HKLM..Run: [EmpoweringTechnology] C:Program FilesAcerEmpowering TechnologyFramework.Launcher.exe boot
O4 - HKLM..Run: [mcagent_exe] "C:Program FilesMcAfee.comAgentmcagent.exe" /runkey
O4 - HKLM..Run: [eDataSecurity Loader] C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDSloader.exe
O4 - HKLM..Run: [RemoteControl] "C:Program FilesCyberLinkPowerDVDPDVDServ.exe"
O4 - HKLM..Run: [LanguageShortcut] "C:Program FilesCyberLinkPowerDVDLanguageLanguage.exe"
O4 - HKLM..Run: [BkupTray] "C:Program FilesNewTech InfosystemsNTI Backup Now 5BkupTray.exe"
O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:Windowssystem32NvCpl.dll,NvStartup
O4 - HKLM..Run: [WarReg_PopUp] C:Program FilesAcerWR_PopUpWarReg_PopUp.exe
O4 - HKLM..Run: [Google Desktop Search] "C:Program FilesGoogleGoogle Desktop SearchGoogleDesktop.exe" /startup
O4 - HKLM..Run: [Adobe Reader Speed Launcher] "C:Program FilesAdobeReader 8.0ReaderReader_sl.exe"
O4 - HKCU..Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU..Run: [msnmsgr] "C:Program FilesWindows LiveMessengermsnmsgr.exe" /background
O4 - HKCU..Run: [swg] "C:Program FilesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe"
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:PROGRA~1MICROS~2Office12EXCEL.EXE/3000
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:PROGRA~1MICROS~2Office12ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:PROGRA~1MICROS~2Office12ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:PROGRA~1MICROS~2Office12REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:windowssystem32
vlsp.dll
O10 - Unknown file in Winsock LSP: c:windowssystem32
vlsp.dll
O10 - Unknown file in Winsock LSP: c:windowssystem32
vlsp.dll
O10 - Unknown file in Winsock LSP: c:windowssystem32
vlsp.dll
O13 - Gopher Prefix:
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:PROGRA~1mcafeeSITEAD~1mcieplg.dll
O20 - AppInit_DLLs: C:PROGRA~1GoogleGOOGLE~1GOEC62~1.DLL
O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:Program FilesNewTech InfosystemsNTI Backup Now 5ClientAgentsvc.exe
O23 - Service: eDataSecurity Service - Egis Incorporated - C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDSService.exe
O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:Program FilesAcerEmpowering TechnologyServiceETService.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:Program Filesin32
SvcAppFlt.exe
O23 - Service: Google Desktop Manager 5.7.808.7150 (GoogleDesktopManager-080708-050100) - Google - C:Program FilesGoogleGoogle Desktop SearchGoogleDesktop.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:Program FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:Program FilesCommon FilesLightScribeLSSrvc.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:Program FilesMcAfeeSiteAdvisorMcSACore.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:PROGRA~1McAfeeMSCmcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:PROGRA~1COMMON~1mcafeemnamcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:PROGRA~1McAfeeVIRUSS~1mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:PROGRA~1COMMON~1mcafeemcproxymcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:PROGRA~1McAfeeVIRUSS~1mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:PROGRA~1McAfeeVIRUSS~1mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:Program FilesMcAfeeMPFMPFSrv.exe
O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:Program FilesMcAfeeMSKMskSrver.exe
O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - C:Program Filesin32
SvcIp.exe
O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:Program FilesNewTech InfosystemsNTI Backup Now 5BackupSvc.exe
O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:Program FilesNewTech InfosystemsNTI Backup Now 5SchedulerSvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:Windowssystem32
vvsvc.exe
O23 - Service: Partner Service - Google Inc. - c:programdatapartnerpartner.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:Program FilesCyberlinkShared filesRichVideo.exe

--
End of file - 9934 bytes

[J&B]

salut tu veut quoi faire supprimé alpha antivirus ou autre

[J&B]

tu a quoi comme pc un acer

[DouDou9455]

Bonjour & Bienvenue,

A supprimer :

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Partner BHO Class - {83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4} - C:ProgramDataPartnerpartner.dll
O2 - BHO: (no name) - {A77D3539-581D-450C-9E44-A84C415A6172} - C:WindowsSystem32msnaoladdon.dll
O4 - HKLM..Run: [RemoteControl] "C:Program FilesCyberLinkPowerDVDPDVDServ.exe"
O4 - HKLM..Run: [LanguageShortcut] "C:Program FilesCyberLinkPowerDVDLanguageLanguage.exe"
O4 - HKLM..Run: [BkupTray] "C:Program FilesNewTech InfosystemsNTI Backup Now 5BkupTray.exe"
O4 - HKLM..Run: [Adobe Reader Speed Launcher] "C:Program FilesAdobeReader 8.0ReaderReader_sl.exe"
O4 - HKCU..Run: [msnmsgr] "C:Program FilesWindows LiveMessengermsnmsgr.exe" /background
O4 - HKCU..Run: [swg] "C:Program FilesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe"
O23 - Service: Partner Service - Google Inc. - c:programdatapartnerpartner.exe

Ensuite :

Bonjour.



1_ Tu télécharges Malwarebytes' Anti-Malware, tu l'installes puis tu procèdes à sa mise à jour.

Tu lances l'application en double-cliquant sur l'icône Malwarebytes' Anti Malware.

Tu cliques ensuite sur Exécuter un examen complet puis tu lances l'analyse en cliquant sur Rechercher.

_ Si l'utilitaire ne trouve rien de néfaste, cliques sur Ok. Le Bloc-notes va s'ouvrir avec le rapport d'analyse, celui-ci n'est pas intéressant car la machine est propre.
Tu peux fermer le Bloc-notes.

_ Si l'utilitaire trouve des éléments suspects, tu cliques sur Afficher les résultats puis sur Supprimer la sélection.
Tu enregistres le rapport d'analyse que tu nous copies-colles dans ton prochain message.

Il est possible que le programme te demande de redémarrer pour effectuer des suppressions supplémentaires, tu acceptes le redémarrage volontaire en cliquant sur Ok.



2_ Tu télécharges ComboFix.

Pour les utilisateurs Vista, il faut désactiver l'UAC avant d'utiliser l'utilitaire.

Pour cela, il faut cliquer sur Démarrer puis Panneau de configuration.

Tu cliques ensuite sur Comptes d'utilisateurs puis sur Activer ou désactiver le contrôle des comptes d'utilisateurs.

Une fenêtre de confirmation s'ouvrira, décoches la ligne Utiliser le contrôle des comptes d'utilisateurs pour vous aider à protéger votre ordinateur puis cliques sur Ok.

Le redémarrage demandé sera nécessaire pour que l'UAC soit inactive.

Avant de lancer ComboFix, tu dois désactiver ta connexion Internet, ton antivirus, ton anti-spyware & ton pare-feu car ils peuvent bloquer l'exécution de l'utilitaire (faux-positifs).
Tu les réactiveras après l'utilisation de ComboFix.
Tu fermes toutes les fenêtres ouvertes.

Tu lances ensuite l'utilitaire en double cliquant dessus, tu confirmes l'ouverture en cliquant sur Exécuter.

A la fenêtre Disclaimer, tu tapes sur [1].

L'analyse se lancera par la suite avec création d'un point de restauration et sauvegarde des fichiers Windows.
Patientes, ComboFix nettoie en 41 étapes.

Tu ne t'inquiètes pas, il se charge de tout.
Laisse-le faire et suis bien les instructions à l'écran, il est possible qu'il te demande de redémarrer.

Pendant son nettoyage, le Bureau peut disparaître à plusieurs reprises. Tout redeviendra normal par la suite.

Surtout, tant que tu n'as pas un message de ComboFix t'informant que le ménage est terminé, tu ne fais rien de plus que ce que l'utilitaire t'indique, c'est important car il peut être long mais travaille efficacement.

Quand tout sera fini, tu liras:

Code: Tout sélectionner

Almost done... This window will close in a short while
Please wait a few seconds for the report log to pop up

ComboFix's log shall be located at C:ComboFix.txt

Normalement, le rapport s'ouvrira dans le Bloc-notes, tu nous copies-colles l'intégralité du fichier.
Si le Bloc-notes ne s'ouvre pas, tu iras chercher le rapport ici: C:ComboFix.txt et tu nous le colles dans ton prochain message.

[danakil]

Salut à tous !

J&B

dz.malek
Tu as une infection BT Trojan.BHO

Edit :
Suis les procédures données par DD9455

[dz.malek]

Merci a tous pour vos reponses rapides.

J'ai donc effacer les lignes que tu m'a dit, mais il y en a 3 que je n'est pas trouvé.

Quand a la recherche Malwarebytes' Anti Malware, je l'ai deja effectuer hier soir et il m'a supprimer 15 fichiers.
Je vais tout de meme la refaire.

[dz.malek]

J'ai refait un rapport :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:47:02, on 26/09/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18294)
Boot mode: Normal

Running processes:
c:PROGRA~1mcafee.comagentmcagent.exe
C:Windowssystem32Dwm.exe
C:WindowsExplorer.EXE
C:Windowssystem32 askeng.exe
C:Program FilesWindows DefenderMSASCui.exe
C:WindowsRtHDVCpl.exe
C:Program FilesAcerEmpowering TechnologySysMonitor.exe
C:Program FilesAcerEmpowering TechnologyFramework.Launcher.exe
C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDSLoader.exe
C:Program FilesGoogleGoogle Desktop SearchGoogleDesktop.exe
C:WindowsSystem32 undll32.exe
C:Program FilesGoogleGoogle Desktop SearchGoogleDesktop.exe
C:Program FilesGoogleGoogle Desktop SearchGoogleDesktop.exe
C:Program FilesInternet Explorerieuser.exe
C:Program FilesInternet Exploreriexplore.exe
C:Program FilesGoogleGoogle ToolbarGoogleToolbarUser_32.exe
C:Windowssystem32MacromedFlashFlashUtil10c.exe
C:Windowssystem32wuauclt.exe
C:Program FilesAcerEmpowering TechnologyNotificationCenterFramework.NotificationCenter.exe
C:UsersMouzaouiDesktopsolution.exe

R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACA ... pire_x3200
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.google.fr/
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACA ... pire_x3200
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://fr.fr.acer.yahoo.com
R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant =
R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch =
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll
O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:PROGRA~1mcafeemskmskapbho.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:PROGRA~1mcafeeVIRUSS~1scriptsn.dll
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:Program FilesAcerEmpowering TechnologyeDataSecurityx86ActiveToolBand.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:Program FilesCommon FilesMicrosoft SharedWindows LiveWindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:Program FilesGoogleGoogle ToolbarGoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:Program FilesGoogleGoogleToolbarNotifier5.2.4204.1700swg.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:PROGRA~1mcafeeSITEAD~1mcieplg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:Program FilesGoogleGoogle ToolbarComponentfastsearch_B7C5AC242193BB3E.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDStoolbar.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:Program FilesGoogleGoogle ToolbarGoogleToolbar_32.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:PROGRA~1mcafeeSITEAD~1mcieplg.dll
O4 - HKLM..Run: [Windows Defender] %ProgramFiles%Windows DefenderMSASCui.exe -hide
O4 - HKLM..Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM..Run: [Acer Empowering Technology Monitor] C:Program FilesAcerEmpowering TechnologySysMonitor.exe
O4 - HKLM..Run: [EmpoweringTechnology] C:Program FilesAcerEmpowering TechnologyFramework.Launcher.exe boot
O4 - HKLM..Run: [mcagent_exe] "C:Program FilesMcAfee.comAgentmcagent.exe" /runkey
O4 - HKLM..Run: [eDataSecurity Loader] C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDSloader.exe
O4 - HKLM..Run: [RemoteControl] "C:Program FilesCyberLinkPowerDVDPDVDServ.exe"
O4 - HKLM..Run: [LanguageShortcut] "C:Program FilesCyberLinkPowerDVDLanguageLanguage.exe"
O4 - HKLM..Run: [BkupTray] "C:Program FilesNewTech InfosystemsNTI Backup Now 5BkupTray.exe"
O4 - HKLM..Run: [WarReg_PopUp] C:Program FilesAcerWR_PopUpWarReg_PopUp.exe
O4 - HKLM..Run: [Google Desktop Search] "C:Program FilesGoogleGoogle Desktop SearchGoogleDesktop.exe" /startup
O4 - HKLM..Run: [Adobe Reader Speed Launcher] "C:Program FilesAdobeReader 8.0ReaderReader_sl.exe"
O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:Windowssystem32NvCpl.dll,NvStartup
O4 - HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:Windowssystem32NvMcTray.dll,NvTaskbarInit
O4 - HKLM..Run: [Malwarebytes Anti-Malware (reboot)] "C:Program FilesMalwarebytes' Anti-Malwarembam.exe" /runcleanupscript
O4 - HKCU..Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:PROGRA~1MICROS~2Office12EXCEL.EXE/3000
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:PROGRA~1MICROS~2Office12ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:PROGRA~1MICROS~2Office12ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:PROGRA~1MICROS~2Office12REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:windowssystem32
vlsp.dll
O10 - Unknown file in Winsock LSP: c:windowssystem32
vlsp.dll
O10 - Unknown file in Winsock LSP: c:windowssystem32
vlsp.dll
O10 - Unknown file in Winsock LSP: c:windowssystem32
vlsp.dll
O13 - Gopher Prefix:
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:PROGRA~1mcafeeSITEAD~1mcieplg.dll
O20 - AppInit_DLLs: C:PROGRA~1GoogleGOOGLE~1GOEC62~1.DLL
O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:Program FilesNewTech InfosystemsNTI Backup Now 5ClientAgentsvc.exe
O23 - Service: eDataSecurity Service - Egis Incorporated - C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDSService.exe
O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:Program FilesAcerEmpowering TechnologyServiceETService.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:Program Filesin32
SvcAppFlt.exe
O23 - Service: Google Desktop Manager 5.7.808.7150 (GoogleDesktopManager-080708-050100) - Google - C:Program FilesGoogleGoogle Desktop SearchGoogleDesktop.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:Program FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:Program FilesCommon FilesLightScribeLSSrvc.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:Program FilesMcAfeeSiteAdvisorMcSACore.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:PROGRA~1McAfeeMSCmcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:PROGRA~1COMMON~1mcafeemnamcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:PROGRA~1McAfeeVIRUSS~1mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:PROGRA~1COMMON~1mcafeemcproxymcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:PROGRA~1McAfeeVIRUSS~1mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:PROGRA~1McAfeeVIRUSS~1mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:Program FilesMcAfeeMPFMPFSrv.exe
O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:Program FilesMcAfeeMSKMskSrver.exe
O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - C:Program Filesin32
SvcIp.exe
O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:Program FilesNewTech InfosystemsNTI Backup Now 5BackupSvc.exe
O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:Program FilesNewTech InfosystemsNTI Backup Now 5SchedulerSvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:Windowssystem32
vvsvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:Program FilesCyberlinkShared filesRichVideo.exe

--
End of file - 9367 bytes

[dz.malek]

ComboFix 09-09-25.01 - Mouzaoui 26/09/2009 15:07.1.2 - NTFSx86
Microsoft® Windows Vista™ Edition Familiale Basique 6.0.6001.1.1252.33.1036.18.3070.1855 [GMT 2:00]
Lancé depuis: c:usersMouzaouiDocumentsFichier setupComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
* Un antivirus résident est actif

.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:$recycle.binS-1-5-21-207698152-2804168146-3376597036-500
c:$recycle.binS-1-5-21-2760852498-2543259003-1422614318-1000

.
((((((((((((((((((((((((((((( Fichiers créés du 2009-08-26 au 2009-09-26 ))))))))))))))))))))))))))))))))))))
.

2009-09-26 13:14 . 2009-09-26 13:14 -------- d-----w- c:usersDefaultAppDataLocal emp
2009-09-25 18:56 . 2009-09-25 18:56 -------- d-----w- c:windowssystem32plesn.chm
2009-09-25 18:53 . 2009-09-25 18:53 -------- d-----w- c:usersMouzaouiAppDataLocalMicrosoft Help
2009-09-25 17:58 . 2009-09-25 17:58 -------- d-----w- c:usersMouzaouiAppDataRoamingMalwarebytes
2009-09-25 17:58 . 2009-09-10 12:54 38224 ----a-w- c:windowssystem32driversmbamswissarmy.sys
2009-09-25 17:58 . 2009-09-25 17:58 -------- d-----w- c:programdataMalwarebytes
2009-09-25 17:58 . 2009-09-10 12:53 19160 ----a-w- c:windowssystem32driversmbam.sys
2009-09-25 17:58 . 2009-09-25 17:58 -------- d-----w- c:program filesMalwarebytes' Anti-Malware
2009-09-25 16:51 . 2009-09-25 16:52 -------- d-----w- c:program files rend micro
2009-09-25 16:51 . 2009-09-25 16:52 -------- d-----w- C: sit
2009-09-25 14:25 . 2009-09-25 14:25 -------- d-----w- c:program filesCommon FilesUninstall
2009-09-24 11:33 . 2009-09-24 11:37 -------- d-----w- C:DVDVideoSoft
2009-09-24 11:32 . 2009-09-24 11:41 -------- d-----w- c:program filesCommon FilesDVDVideoSoft
2009-09-24 11:32 . 2009-09-24 11:41 -------- d-----w- c:program filesDVDVideoSoft
2009-09-24 10:22 . 2009-09-24 17:24 -------- d-----w- c:usersMouzaouiAppDataRoamingdvdcss
2009-09-24 10:22 . 2009-09-26 12:49 -------- d-----w- c:usersMouzaouiAppDataRoamingvlc
2009-09-24 10:21 . 2009-09-24 10:21 -------- d-----w- c:program filesVideoLAN
2009-09-23 22:56 . 2009-06-22 10:22 2048 ----a-w- c:windowssystem32 zres.dll
2009-09-23 22:32 . 2009-09-23 22:32 -------- d-----w- c:usersDefaultAppDataLocalMicrosoft Help
2009-09-23 22:19 . 2008-06-20 01:14 97800 ----a-w- c:windowssystem32infocardapi.dll
2009-09-23 22:19 . 2008-06-20 01:14 105016 ----a-w- c:windowssystem32PresentationCFFRasterizerNative_v0300.dll
2009-09-23 22:19 . 2008-06-20 01:14 43544 ----a-w- c:windowssystem32PresentationHostProxy.dll
2009-09-23 22:19 . 2008-06-20 01:14 11264 ----a-w- c:windowssystem32icardres.dll
2009-09-23 22:19 . 2008-06-20 01:14 622080 ----a-w- c:windowssystem32icardagt.exe
2009-09-23 22:19 . 2008-06-20 01:14 781344 ----a-w- c:windowssystem32PresentationNative_v0300.dll
2009-09-23 22:19 . 2008-06-20 01:14 326160 ----a-w- c:windowssystem32PresentationHost.exe
2009-09-23 22:15 . 2008-07-27 18:03 96760 ----a-w- c:windowssystem32dfshim.dll
2009-09-23 22:15 . 2008-07-27 18:03 282112 ----a-w- c:windowssystem32mscoree.dll
2009-09-23 22:15 . 2008-07-27 18:03 41984 ----a-w- c:windowssystem32
etfxperf.dll
2009-09-23 22:15 . 2008-07-27 18:03 158720 ----a-w- c:windowssystem32mscorier.dll
2009-09-23 22:14 . 2008-07-27 18:03 83968 ----a-w- c:windowssystem32mscories.dll
2009-09-23 22:14 . 2009-09-23 22:14 -------- d-----w- c:program filesMSXML 4.0
2009-09-23 17:51 . 2009-09-23 17:52 -------- d-----w- c:usersMouzaouiAppDataLocalAdobe
2009-09-23 14:45 . 2009-04-21 11:55 2033152 ----a-w- c:windowssystem32win32k.sys
2009-09-23 14:45 . 2008-06-26 01:45 12240896 ----a-w- c:windowssystem32NlsLexicons0007.dll
2009-09-23 14:45 . 2008-06-26 01:45 2644480 ----a-w- c:windowssystem32NlsLexicons0009.dll
2009-09-23 14:45 . 2008-06-26 03:29 801280 ----a-w- c:windowssystem32NaturalLanguage6.dll
2009-09-23 14:43 . 2009-08-28 12:39 28672 ----a-w- c:windowssystem32Apphlpdm.dll
2009-09-23 14:43 . 2009-08-28 10:15 4240384 ----a-w- c:windowssystem32GameUXLegacyGDFs.dll
2009-09-23 14:41 . 2009-09-23 14:41 -------- d-----w- c:program filesWindows Live SkyDrive
2009-09-23 14:41 . 2009-09-23 14:41 -------- d-----w- c:program filesWindows Live
2009-09-23 14:41 . 2009-03-17 03:38 13824 ----a-w- c:windowssystem32apilogen.dll
2009-09-23 14:41 . 2009-03-17 03:38 24064 ----a-w- c:windowssystem32amxread.dll
2009-09-23 14:41 . 2008-06-23 01:59 996352 ----a-w- c:windowssystem32WMNetMgr.dll
2009-09-23 14:41 . 2008-06-23 01:58 94720 ----a-w- c:windowssystem32logagent.exe
2009-09-23 13:40 . 2008-06-26 03:29 303616 ----a-w- c:windowssystem32wmpeffects.dll
2009-09-23 13:39 . 2009-07-14 12:58 7680 ----a-w- c:windowssystem32spwmp.dll
2009-09-23 13:39 . 2009-07-14 12:59 4096 ----a-w- c:windowssystem32dxmasf.dll
2009-09-23 13:39 . 2009-07-14 10:59 8147456 ----a-w- c:windowssystem32wmploc.DLL
2009-09-23 13:39 . 2009-04-23 12:43 784896 ----a-w- c:windowssystem32 pcrt4.dll
2009-09-23 13:39 . 2008-04-26 08:08 1314816 ----a-w- c:windowssystem32quartz.dll
2009-09-23 13:39 . 2008-12-16 02:42 288768 ----a-w- c:windowssystem32driverssrv.sys
2009-09-23 13:39 . 2008-06-19 03:31 361984 ----a-w- c:windowssystem32IPSECSVC.DLL
2009-09-23 13:39 . 2008-06-26 03:29 565248 ----a-w- c:windowssystem32emdmgmt.dll
2009-09-23 13:39 . 2008-08-02 03:26 36864 ----a-w- c:windowssystem32cdd.dll
2009-09-23 13:39 . 2008-08-02 01:01 625152 ----a-w- c:windowssystem32driversdxgkrnl.sys
2009-09-23 13:39 . 2008-06-26 03:29 45056 ----a-w- c:windowssystem32dataclen.dll
2009-09-23 13:39 . 2008-05-20 02:07 148480 ----a-w- c:windowssystem32drivers
wifi.sys
2009-09-23 13:31 . 2008-09-10 03:40 1334272 ----a-w- c:windowssystem32msxml6.dll
2009-09-23 13:26 . 2008-10-16 21:09 43544 ----a-w- c:windowssystem32wups2.dll
2009-09-23 13:26 . 2008-10-16 21:13 1809944 ----a-w- c:windowssystem32wuaueng.dll
2009-09-23 13:26 . 2008-10-16 21:09 51224 ----a-w- c:windowssystem32wuauclt.exe
2009-09-23 13:26 . 2008-10-16 20:56 1524736 ----a-w- c:windowssystem32wucltux.dll
2009-09-23 13:26 . 2008-10-16 21:12 561688 ----a-w- c:windowssystem32wuapi.dll
2009-09-23 13:26 . 2008-10-16 21:08 34328 ----a-w- c:windowssystem32wups.dll
2009-09-23 13:26 . 2008-10-16 20:55 83456 ----a-w- c:windowssystem32wudriver.dll
2009-09-23 13:26 . 2008-10-16 12:08 162064 ----a-w- c:windowssystem32wuwebv.dll
2009-09-23 13:26 . 2008-10-16 11:56 31232 ----a-w- c:windowssystem32wuapp.exe
2009-09-23 13:19 . 2009-09-23 13:19 -------- d-----w- c:usersMouzaouiAppDataRoamingeSobi
2009-09-23 13:16 . 2009-09-24 18:50 -------- d-----w- c:usersMouzaouiAppDataLocalGoogle
2009-09-23 13:15 . 2009-09-25 20:38 -------- d-----w- c:programdataPartner
2009-09-23 13:15 . 2009-09-24 09:13 -------- d-----w- c:program filesGoogle
2009-09-23 13:15 . 2009-09-25 20:42 71280 ----a-w- c:usersMouzaouiAppDataLocalGDIPFONTCACHEV1.DAT
2009-09-23 13:15 . 2009-09-23 13:16 -------- d-----w- C:ACERSW
2009-09-23 13:10 . 2009-09-23 13:10 -------- d-sh--we c:usersDefaultVoisinage réseau
2009-09-23 13:10 . 2009-09-23 13:10 -------- d-sh--we c:usersDefaultVoisinage d'impression
2009-09-23 13:10 . 2009-09-23 13:10 -------- d-sh--we c:usersDefaultModèles
2009-09-23 13:10 . 2009-09-23 13:10 -------- d-sh--we c:usersDefaultMes documents
2009-09-23 13:10 . 2009-09-23 13:10 -------- d-sh--we c:usersDefaultMenu Démarrer
2009-09-23 13:10 . 2009-09-23 13:10 -------- d-sh--we c:usersDefaultAppDataLocalHistorique
2009-09-23 13:10 . 2009-09-23 13:10 -------- d-sh--we c:programdataModèles
2009-09-23 13:10 . 2009-09-23 13:10 -------- d-sh--we c:programdataMenu Démarrer
2009-09-23 13:10 . 2009-09-23 13:10 -------- d-sh--we c:programdataFavoris
2009-09-23 13:10 . 2009-09-23 13:10 -------- d-sh--we c:programdataBureau
2009-09-23 13:10 . 2009-09-23 13:10 -------- d-sh--we c:program filesFichiers communs

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-26 12:11 . 2009-09-26 12:11 -------- d-----w- c:usersMouzaouiAppDataRoamingDeepBurner
2009-09-26 12:10 . 2009-09-26 12:10 -------- d-----w- c:program filesAstonsoft
2009-09-26 11:51 . 2009-09-26 11:50 -------- d-----w- c:usersMouzaouiAppDataRoamingCyberLink
2009-09-26 11:50 . 2009-09-26 11:50 -------- d-----w- c:programdataCyberLink
2009-09-26 11:11 . 2008-01-21 07:23 669328 ----a-w- c:windowssystem32perfh00C.dat
2009-09-26 11:11 . 2008-01-21 07:23 123350 ----a-w- c:windowssystem32perfc00C.dat
2009-09-26 11:04 . 2008-05-12 17:34 -------- d-----w- c:programdataMicrosoft Help
2009-09-25 20:42 . 2008-05-12 17:06 -------- d-----w- c:programdataNVIDIA
2009-09-25 18:51 . 2008-05-12 17:36 -------- d-----w- c:program filesMicrosoft Works
2009-09-25 09:49 . 2008-05-12 17:18 -------- d-----w- c:program filesMcAfee
2009-09-24 16:40 . 2008-05-12 17:18 -------- d-----w- c:programdataMcAfee
2009-09-24 16:37 . 2008-05-12 17:22 -------- d-----w- c:program filesCommon FilesAdobe
2009-09-24 16:35 . 2008-05-12 17:20 -------- d-----w- c:programdataSiteAdvisor
2009-09-24 09:15 . 2006-11-02 11:18 -------- d-----w- c:program filesWindows Mail
2009-07-26 14:44 . 2009-07-26 14:44 48448 ----a-w- c:windowssystem32sirenacm.dll
2009-07-18 16:06 . 2009-09-23 14:44 827904 ----a-w- c:windowssystem32wininet.dll
2009-07-18 16:01 . 2009-09-23 14:44 78336 ----a-w- c:windowssystem32ieencode.dll
2009-07-18 09:46 . 2009-09-23 14:44 26624 ----a-w- c:windowssystem32ieUnatt.exe
2009-07-17 14:35 . 2009-09-23 14:40 71680 ----a-w- c:windowssystem32atl.dll
2009-07-16 10:32 . 2008-05-12 17:19 130424 ----a-w- c:windowssystem32driversMpfp.sys
2009-07-14 13:00 . 2009-09-23 13:40 313344 ----a-w- c:windowssystem32wmpdxm.dll
2009-07-11 19:32 . 2009-09-23 13:40 302592 ----a-w- c:windowssystem32wlansec.dll
2009-07-11 19:32 . 2009-09-23 13:40 293376 ----a-w- c:windowssystem32wlanmsm.dll
2009-07-11 19:32 . 2009-09-23 13:40 513024 ----a-w- c:windowssystem32wlansvc.dll
2009-07-11 19:29 . 2009-09-23 13:40 127488 ----a-w- c:windowssystem32L2SecHC.dll
2009-07-08 11:44 . 2008-05-12 17:19 79816 ----a-w- c:windowssystem32driversmfeavfk.sys
2009-07-08 11:44 . 2008-05-12 17:19 40552 ----a-w- c:windowssystem32driversmfesmfk.sys
2009-07-08 11:44 . 2008-05-12 17:19 35272 ----a-w- c:windowssystem32driversmfebopk.sys
2009-07-08 11:44 . 2008-05-12 17:19 214024 ----a-w- c:windowssystem32driversmfehidk.sys
2009-07-08 11:43 . 2008-05-12 17:19 34248 ----a-w- c:windowssystem32driversmferkdk.sys
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionexplorershelliconoverlayidentifiersegisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOTCLSID{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2008-03-04 21:38 121392 ----a-w- c:program filesAcerEmpowering TechnologyeDataSecurityx86PSDProtect.dll

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
"swg"="c:program filesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe" [2009-09-23 68856]
"msnmsgr"="c:program filesWindows LiveMessengermsnmsgr.exe" [2009-07-26 3883856]
"WindowsWelcomeCenter"="oobefldr.dll" - c:windowsSystem32oobefldr.dll [2008-01-21 2153472]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
"Windows Defender"="c:program filesWindows DefenderMSASCui.exe" [2008-01-21 1008184]
"Acer Empowering Technology Monitor"="c:program filesAcerEmpowering TechnologySysMonitor.exe" [2008-04-25 319488]
"EmpoweringTechnology"="c:program filesAcerEmpowering TechnologyFramework.Launcher.exe" [2008-04-25 319488]
"mcagent_exe"="c:program filesMcAfee.comAgentmcagent.exe" [2009-07-09 645328]
"eDataSecurity Loader"="c:program filesAcerEmpowering TechnologyeDataSecurityx86eDSloader.exe" [2008-03-04 526896]
"RemoteControl"="c:program filesCyberLinkPowerDVDPDVDServ.exe" [2007-01-08 68640]
"LanguageShortcut"="c:program filesCyberLinkPowerDVDLanguageLanguage.exe" [2007-01-08 52256]
"BkupTray"="c:program filesNewTech InfosystemsNTI Backup Now 5BkupTray.exe" [2008-04-25 28672]
"WarReg_PopUp"="c:program filesAcerWR_PopUpWarReg_PopUp.exe" [2008-01-29 303104]
"Google Desktop Search"="c:program filesGoogleGoogle Desktop SearchGoogleDesktop.exe" [2009-09-23 24064]
"Adobe Reader Speed Launcher"="c:program filesAdobeReader 8.0ReaderReader_sl.exe" [2008-10-14 39792]
"NvCplDaemon"="c:windowssystem32NvCpl.dll" [2009-03-27 13687328]
"NvMediaCenter"="c:windowssystem32NvMcTray.dll" [2009-03-27 92704]
"Malwarebytes Anti-Malware (reboot)"="c:program filesMalwarebytes' Anti-Malwarembam.exe" [2009-09-10 1312080]
"RtHDVCpl"="RtHDVCpl.exe" - c:windowsRtHDVCpl.exe [2008-03-26 5369856]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionpoliciessystem]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionwindows]
"AppInit_DLLs"=c:progra~1GoogleGOOGLE~1GoogleDesktopNetwork3.dll

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversiondrivers32]
"mixer2"=wdmaud.drv

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetcontrolsession manager]
SetupExecute REG_MULTI_SZ

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalmcmscsvc]
@=""

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalMCODS]
@=""

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalWinDefend]
@="Service"

[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity centerMonitoringMcAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001

[HKLM~servicessharedaccessparametersfirewallpolicyFirewallRules]
"{773E2FD2-EB80-4473-BFAE-606F107B2017}"= Profile=Private|Profile=Public|c:program filesCommon FilesMcafeeMNAMcNaSvc.exe:McAfee Network Agent
"{A3381893-2AA0-4938-A355-21044CC1FD38}"= UDP:c:program filesMicrosoft OfficeOffice12ONENOTE.EXE:Microsoft Office OneNote
"{726EBDFD-BD05-4FBD-8217-24BE7CD31641}"= TCP:c:program filesMicrosoft OfficeOffice12ONENOTE.EXE:Microsoft Office OneNote
"{A2833FA7-F393-4028-90D9-94D8954EB299}"= c:program filesCyberlinkPowerDirectorPDR.EXE:CyberLink PowerDirector
"{95A5B6F1-AB4A-4C0F-B316-3D358944C376}"= c:program filesCyberLinkPowerDVDPowerDVD.EXE:CyberLink PowerDVD
"{514999C6-0ACD-41F3-9C36-59FF44C1BAE0}"= c:program filesAcer Arcade LiveAcer DVDivineAcer DVDivine.exe:Acer DVDivine
"{5CFAD744-915B-4F15-8DEA-B7244EC4EBD8}"= UDP:c:program filesNewTech InfosystemsNTI Backup Now 5ClientAgentsvc.exe:AgentSvc.exe
"{8275CD3F-1453-4C44-A1F3-8C90FF18ED20}"= UDP:c:program filesNewTech InfosystemsNTI Backup Now 5BackupSvc.exe:BackupSvc.exe
"{D6ADAA43-FB47-4EE8-B085-ECF97F8CB172}"= TCP:c:program filesNewTech InfosystemsNTI Backup Now 5ClientAgentsvc.exe:AgentSvc.exe
"{AA097394-2D5A-4B89-A22C-D684290F69B8}"= TCP:c:program filesNewTech InfosystemsNTI Backup Now 5BackupSvc.exe:BackupSvc.exe
"{9773C304-2055-4323-B6F9-58F8A64358B0}"= UDP:c:program filesNewTech InfosystemsNTI Backup Now 5SchedulerSvc.exe:SchedulerSvc.exe
"{E6598C06-23F9-45A7-AA87-F69F70F6DE5D}"= TCP:c:program filesNewTech InfosystemsNTI Backup Now 5SchedulerSvc.exe:SchedulerSvc.exe

R2 BUNAgentSvc;NTI Backup Now 5 Agent Service;c:program filesNewTech InfosystemsNTI Backup Now 5ClientAgentsvc.exe [03/03/2008 13:11 16384]
R2 ETService;Empowering Technology Service;c:program filesAcerEmpowering TechnologyServiceETService.exe [12/05/2008 19:16 24576]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:program filesMcAfeeSiteAdvisorMcSACore.exe [24/09/2009 18:35 210216]
R2 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:program filesNewTech InfosystemsNTI Backup Now 5BackupSvc.exe [25/04/2008 21:36 45056]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:windowsSystem32drivers
vhda32v.sys [12/05/2008 12:42 43552]
S2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:program filesNewTech InfosystemsNTI Backup Now 5SchedulerSvc.exe [25/04/2008 21:36 131072]
S3 GoogleDesktopManager-080708-050100;Google Desktop Manager 5.7.808.7150;c:program filesGoogleGoogle Desktop SearchGoogleDesktop.exe [23/09/2009 15:15 24064]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionsvchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
.
Contenu du dossier 'Tâches planifiées'

2008-05-12 c:windowsTasksMcDefragTask.job
- c:progra~1mcafeemqcQcConsol.exe [2009-09-24 19:26]

2008-05-12 c:windowsTasksMcQcTask.job
- c:progra~1mcafeemqcQcConsol.exe [2009-09-24 19:26]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
mStart Page = hxxp://fr.fr.acer.yahoo.com
IE: E&xporter vers Microsoft Excel - c:progra~1MICROS~2Office12EXCEL.EXE/3000
LSP: %SYSTEMROOT%system32
vLsp.dll
.
- - - - ORPHELINS SUPPRIMES - - - -

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
HKLM-Run-eRecoveryService - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-26 15:14
Windows 6.0.6001 Service Pack 1 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\Windows\system32\Macromed\Flash\FlashUtil10c.exe,-101"

[HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}LocalServer32]
@="c:\Windows\system32\Macromed\Flash\FlashUtil10c.exe"

[HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINESOFTWAREClassesInterface{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"

[HKEY_LOCAL_MACHINESOFTWAREClassesInterface{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINESOFTWAREClassesInterface{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'Explorer.exe'(8680)
c:windowssystem32NVSVC.DLL
c:program filesMcAfeeSiteAdvisorsaHook.dll
c:program filesAcerEmpowering TechnologyeDataSecurityx86PSDProtect.dll
c:program filesAcerEmpowering TechnologyeDataSecurityx86sysenv.dll
.
Heure de fin: 2009-09-26 15:16
ComboFix-quarantined-files.txt 2009-09-26 13:16

Avant-CF: 116 585 029 632 octets libres
Après-CF: 116 302 016 512 octets libres

259 --- E O F --- 2009-09-26 11:04

[DouDou9455]

Refait un scan HiJackThis et poste nous le rapport

[dz.malek]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:20:47, on 26/09/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18294)
Boot mode: Normal

Running processes:
c:PROGRA~1mcafee.comagentmcagent.exe
C:Windowssystem32Dwm.exe
C:Windowssystem32 askeng.exe
C:WindowsExplorer.EXE
C:Program FilesWindows DefenderMSASCui.exe
C:WindowsRtHDVCpl.exe
C:Program FilesAcerEmpowering TechnologySysMonitor.exe
C:Program FilesAcerEmpowering TechnologyFramework.Launcher.exe
C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDSLoader.exe
C:Program FilesCyberlinkPowerDVDPDVDServ.exe
C:Program FilesNewTech InfosystemsNTI Backup Now 5BkupTray.exe
C:Program FilesGoogleGoogle Desktop SearchGoogleDesktop.exe
C:WindowsSystem32 undll32.exe
C:Program FilesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe
C:Program FilesWindows LiveMessengermsnmsgr.exe
C:Program FilesGoogleGoogle Desktop SearchGoogleDesktop.exe
C:Program FilesGoogleGoogle Desktop SearchGoogleDesktop.exe
C:Program FilesWindows LiveContactswlcomm.exe
C:Program FilesInternet Explorerieuser.exe
C:Program FilesInternet Exploreriexplore.exe
C:Program FilesGoogleGoogle ToolbarGoogleToolbarUser_32.exe
C:Windowssystem32MacromedFlashFlashUtil10c.exe
C:Windowssystem32wuauclt.exe
C:Program FilesAcerEmpowering TechnologyNotificationCenterFramework.NotificationCenter.exe
C:WindowsSystem32wsqmcons.exe
C:Program FilesInternet Exploreriexplore.exe
C:UsersMouzaouiDesktopsolution.exe

R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.google.fr/
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACA ... pire_x3200
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://fr.fr.acer.yahoo.com
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll
O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:PROGRA~1mcafeemskmskapbho.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:PROGRA~1mcafeeVIRUSS~1scriptsn.dll
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:Program FilesAcerEmpowering TechnologyeDataSecurityx86ActiveToolBand.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:Program FilesCommon FilesMicrosoft SharedWindows LiveWindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:Program FilesGoogleGoogle ToolbarGoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:Program FilesGoogleGoogleToolbarNotifier5.2.4204.1700swg.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:PROGRA~1mcafeeSITEAD~1mcieplg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:Program FilesGoogleGoogle ToolbarComponentfastsearch_B7C5AC242193BB3E.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDStoolbar.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:Program FilesGoogleGoogle ToolbarGoogleToolbar_32.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:PROGRA~1mcafeeSITEAD~1mcieplg.dll
O4 - HKLM..Run: [Windows Defender] %ProgramFiles%Windows DefenderMSASCui.exe -hide
O4 - HKLM..Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM..Run: [Acer Empowering Technology Monitor] C:Program FilesAcerEmpowering TechnologySysMonitor.exe
O4 - HKLM..Run: [EmpoweringTechnology] C:Program FilesAcerEmpowering TechnologyFramework.Launcher.exe boot
O4 - HKLM..Run: [mcagent_exe] "C:Program FilesMcAfee.comAgentmcagent.exe" /runkey
O4 - HKLM..Run: [eDataSecurity Loader] C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDSloader.exe
O4 - HKLM..Run: [RemoteControl] "C:Program FilesCyberLinkPowerDVDPDVDServ.exe"
O4 - HKLM..Run: [LanguageShortcut] "C:Program FilesCyberLinkPowerDVDLanguageLanguage.exe"
O4 - HKLM..Run: [BkupTray] "C:Program FilesNewTech InfosystemsNTI Backup Now 5BkupTray.exe"
O4 - HKLM..Run: [WarReg_PopUp] C:Program FilesAcerWR_PopUpWarReg_PopUp.exe
O4 - HKLM..Run: [Google Desktop Search] "C:Program FilesGoogleGoogle Desktop SearchGoogleDesktop.exe" /startup
O4 - HKLM..Run: [Adobe Reader Speed Launcher] "C:Program FilesAdobeReader 8.0ReaderReader_sl.exe"
O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:Windowssystem32NvCpl.dll,NvStartup
O4 - HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:Windowssystem32NvMcTray.dll,NvTaskbarInit
O4 - HKLM..Run: [Malwarebytes Anti-Malware (reboot)] "C:Program FilesMalwarebytes' Anti-Malwarembam.exe" /runcleanupscript
O4 - HKCU..Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU..Run: [swg] "C:Program FilesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe"
O4 - HKCU..Run: [msnmsgr] "C:Program FilesWindows LiveMessengermsnmsgr.exe" /background
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:PROGRA~1MICROS~2Office12EXCEL.EXE/3000
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:PROGRA~1MICROS~2Office12ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:PROGRA~1MICROS~2Office12ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:PROGRA~1MICROS~2Office12REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:windowssystem32
vlsp.dll
O10 - Unknown file in Winsock LSP: c:windowssystem32
vlsp.dll
O10 - Unknown file in Winsock LSP: c:windowssystem32
vlsp.dll
O10 - Unknown file in Winsock LSP: c:windowssystem32
vlsp.dll
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:PROGRA~1mcafeeSITEAD~1mcieplg.dll
O20 - AppInit_DLLs: C:PROGRA~1GoogleGOOGLE~1GoogleDesktopNetwork3.dll
O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:Program FilesNewTech InfosystemsNTI Backup Now 5ClientAgentsvc.exe
O23 - Service: eDataSecurity Service - Egis Incorporated - C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDSService.exe
O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:Program FilesAcerEmpowering TechnologyServiceETService.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:Program Filesin32
SvcAppFlt.exe
O23 - Service: Google Desktop Manager 5.7.808.7150 (GoogleDesktopManager-080708-050100) - Google - C:Program FilesGoogleGoogle Desktop SearchGoogleDesktop.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:Program FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:Program FilesCommon FilesLightScribeLSSrvc.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:Program FilesMcAfeeSiteAdvisorMcSACore.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:PROGRA~1McAfeeMSCmcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:PROGRA~1COMMON~1mcafeemnamcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:PROGRA~1McAfeeVIRUSS~1mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:PROGRA~1COMMON~1mcafeemcproxymcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:PROGRA~1McAfeeVIRUSS~1mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:PROGRA~1McAfeeVIRUSS~1mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:Program FilesMcAfeeMPFMPFSrv.exe
O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:Program FilesMcAfeeMSKMskSrver.exe
O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - C:Program Filesin32
SvcIp.exe
O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:Program FilesNewTech InfosystemsNTI Backup Now 5BackupSvc.exe
O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:Program FilesNewTech InfosystemsNTI Backup Now 5SchedulerSvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:Windowssystem32
vvsvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:Program FilesCyberlinkShared filesRichVideo.exe

--
End of file - 9516 bytes



Voila chef

[DouDou9455]

Ligne à supprimer :

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O20 - AppInit_DLLs: C:PROGRA~1GoogleGOOGLE~1GoogleDesktopNetwork3.dll

Ensuite :

Refait un scan Mbam et poste nous le rapport.

Une fois cela fait tu nous reposte un rapport HijackThis

[dz.malek]

Malwarebytes' Anti-Malware 1.41
Version de la base de données: 2860
Windows 6.0.6001 Service Pack 1

26/09/2009 21:42:08
mbam-log-2009-09-26 (21-42-08).txt

Type de recherche: Examen complet (C:|F:|)
Eléments examinés: 184542
Temps écoulé: 2 hour(s), 48 minute(s), 40 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

[dz.malek]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:44:18, on 26/09/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18294)
Boot mode: Normal

Running processes:
c:PROGRA~1mcafee.comagentmcagent.exe
C:Windowssystem32Dwm.exe
C:Windowssystem32 askeng.exe
C:WindowsExplorer.EXE
C:Program FilesWindows DefenderMSASCui.exe
C:WindowsRtHDVCpl.exe
C:Program FilesAcerEmpowering TechnologySysMonitor.exe
C:Program FilesAcerEmpowering TechnologyFramework.Launcher.exe
C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDSLoader.exe
C:Program FilesCyberlinkPowerDVDPDVDServ.exe
C:Program FilesNewTech InfosystemsNTI Backup Now 5BkupTray.exe
C:Program FilesGoogleGoogle Desktop SearchGoogleDesktop.exe
C:WindowsSystem32 undll32.exe
C:Program FilesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe
C:Program FilesWindows LiveMessengermsnmsgr.exe
C:Program FilesGoogleGoogle Desktop SearchGoogleDesktop.exe
C:Program FilesGoogleGoogle Desktop SearchGoogleDesktop.exe
C:Program FilesWindows LiveContactswlcomm.exe
C:Windowssystem32wuauclt.exe
C:Program FilesAcerEmpowering TechnologyNotificationCenterFramework.NotificationCenter.exe
C:WindowsSystem32wsqmcons.exe
C:Program FilesInternet Explorerieuser.exe
C:Program FilesInternet Exploreriexplore.exe
C:Program FilesGoogleGoogle ToolbarGoogleToolbarUser_32.exe
C:Windowssystem32MacromedFlashFlashUtil10c.exe
C:UsersMouzaouiDesktopsolution.exe

R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.google.fr/
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACA ... pire_x3200
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://fr.fr.acer.yahoo.com
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:Program FilesCommon FilesAdobeAcrobatActiveXAcroIEHelper.dll
O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:PROGRA~1mcafeemskmskapbho.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:PROGRA~1mcafeeVIRUSS~1scriptsn.dll
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:Program FilesAcerEmpowering TechnologyeDataSecurityx86ActiveToolBand.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:Program FilesCommon FilesMicrosoft SharedWindows LiveWindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:Program FilesGoogleGoogle ToolbarGoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:Program FilesGoogleGoogleToolbarNotifier5.2.4204.1700swg.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:PROGRA~1mcafeeSITEAD~1mcieplg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:Program FilesGoogleGoogle ToolbarComponentfastsearch_B7C5AC242193BB3E.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDStoolbar.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:Program FilesGoogleGoogle ToolbarGoogleToolbar_32.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:PROGRA~1mcafeeSITEAD~1mcieplg.dll
O4 - HKLM..Run: [Windows Defender] %ProgramFiles%Windows DefenderMSASCui.exe -hide
O4 - HKLM..Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM..Run: [Acer Empowering Technology Monitor] C:Program FilesAcerEmpowering TechnologySysMonitor.exe
O4 - HKLM..Run: [EmpoweringTechnology] C:Program FilesAcerEmpowering TechnologyFramework.Launcher.exe boot
O4 - HKLM..Run: [mcagent_exe] "C:Program FilesMcAfee.comAgentmcagent.exe" /runkey
O4 - HKLM..Run: [eDataSecurity Loader] C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDSloader.exe
O4 - HKLM..Run: [RemoteControl] "C:Program FilesCyberLinkPowerDVDPDVDServ.exe"
O4 - HKLM..Run: [LanguageShortcut] "C:Program FilesCyberLinkPowerDVDLanguageLanguage.exe"
O4 - HKLM..Run: [BkupTray] "C:Program FilesNewTech InfosystemsNTI Backup Now 5BkupTray.exe"
O4 - HKLM..Run: [WarReg_PopUp] C:Program FilesAcerWR_PopUpWarReg_PopUp.exe
O4 - HKLM..Run: [Google Desktop Search] "C:Program FilesGoogleGoogle Desktop SearchGoogleDesktop.exe" /startup
O4 - HKLM..Run: [Adobe Reader Speed Launcher] "C:Program FilesAdobeReader 8.0ReaderReader_sl.exe"
O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:Windowssystem32NvCpl.dll,NvStartup
O4 - HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:Windowssystem32NvMcTray.dll,NvTaskbarInit
O4 - HKLM..Run: [Malwarebytes Anti-Malware (reboot)] "C:Program FilesMalwarebytes' Anti-Malwarembam.exe" /runcleanupscript
O4 - HKCU..Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU..Run: [swg] "C:Program FilesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe"
O4 - HKCU..Run: [msnmsgr] "C:Program FilesWindows LiveMessengermsnmsgr.exe" /background
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:PROGRA~1MICROS~2Office12EXCEL.EXE/3000
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:PROGRA~1MICROS~2Office12ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:PROGRA~1MICROS~2Office12ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:PROGRA~1MICROS~2Office12REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:windowssystem32
vlsp.dll
O10 - Unknown file in Winsock LSP: c:windowssystem32
vlsp.dll
O10 - Unknown file in Winsock LSP: c:windowssystem32
vlsp.dll
O10 - Unknown file in Winsock LSP: c:windowssystem32
vlsp.dll
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:PROGRA~1mcafeeSITEAD~1mcieplg.dll
O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:Program FilesNewTech InfosystemsNTI Backup Now 5ClientAgentsvc.exe
O23 - Service: eDataSecurity Service - Egis Incorporated - C:Program FilesAcerEmpowering TechnologyeDataSecurityx86eDSService.exe
O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:Program FilesAcerEmpowering TechnologyServiceETService.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:Program Filesin32
SvcAppFlt.exe
O23 - Service: Google Desktop Manager 5.7.808.7150 (GoogleDesktopManager-080708-050100) - Google - C:Program FilesGoogleGoogle Desktop SearchGoogleDesktop.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:Program FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:Program FilesCommon FilesLightScribeLSSrvc.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:Program FilesMcAfeeSiteAdvisorMcSACore.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:PROGRA~1McAfeeMSCmcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:PROGRA~1COMMON~1mcafeemnamcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:PROGRA~1McAfeeVIRUSS~1mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:PROGRA~1COMMON~1mcafeemcproxymcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:PROGRA~1McAfeeVIRUSS~1mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:PROGRA~1McAfeeVIRUSS~1mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:Program FilesMcAfeeMPFMPFSrv.exe
O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:Program FilesMcAfeeMSKMskSrver.exe
O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - C:Program Filesin32
SvcIp.exe
O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:Program FilesNewTech InfosystemsNTI Backup Now 5BackupSvc.exe
O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:Program FilesNewTech InfosystemsNTI Backup Now 5SchedulerSvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:Windowssystem32
vvsvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:Program FilesCyberlinkShared filesRichVideo.exe

--
End of file - 9244 bytes


Voila

[DouDou9455]

Voila tout est clean !

Pour terminer la désinfection et optimiser Windows:


_ Désinstallation des utilitaires utilisés:

Les programmes utilisés pour la désinfection ne sont pas à utiliser quotidiennement.

Pour les désinstaller, il faut cliquer sur Démarrer puis Panneau de configuration.

Ensuite tu cliques sur Programmes et enfin sur Programmes et fonctionnalités.
Tu sélectionnes les utilitaires et tu cliques sur Désinstaller.

Pour une suppression effective, penses à supprimer leurs dossiers respectifs, la plupart à la racine de ta partition principale.


_ Utilisation d'un navigateur internet alternatif:

Internet Explorer n'étant pas sûr, il est préférable d'installer un navigateur internet alternatif pour sécuriser ton surf.

Tu as le choix entre Mozilla Firefox, Apple Safari ou encore Opéra.

Il faudra ensuite définir ce navigateur internet alternatif comme navigateur par défaut.


_ Utilisation d'un pare-feu alternatif:

Il est recommandé de ne pas utiliser le pare-feu Windows et d'en prendre un plus efficace.

Le choix est possible entre Zone Alarm & Sunbelt, tous deux compatibles avec Vista.

Après avoir sélectionné le pare-feu idéal, il faudra désactiver celui de Windows.


_ Nettoyage des points de restauration:

Dans un premier temps, il faut supprimer tous les points de restauration.

Pour cela, cliques sur Démarrer puis Panneau de configuration, cliques ensuite sur Système et maintenance puis enfin sur Système.

Tu cliques sur l'onglet de gauche Protection du système.
Si Windows te demande ton mot de passe administrateur, tu le fournis, s'il demande une confirmation, tu confirmes l'action.

Dans le cadre du bas nommé Points de restauration automatiques, tu décoches la ligne correspondant à ton disque dur (par défaut nommé Disque local (C: ) (Système).

Tu confirmes la suppression de tous les points de restauration en cliquant sur Désactiver la restauration du système.

Ensuite, il faut réactiver la restauration automatique du système.

Tu refais la manipulation précédente pour relancer les Propriétés système.
Tu coches alors la ligne correspondant à ton disque dur (par défaut nommé Disque local (C: ) (Système), tu cliques enfin sur Appliquer & Ok.

Tu auras créer un point de restauration propre.


_ Nettoyage des fichiers temporaires & de la base de registre:

Pour cela, Ccleaner reste le moyen le plus sûr et pratique de tout nettoyer sans risques.

En suivant ce tutorial, cet utilitaire sera configuré correctement.

Il est aussi utile de purger régulièrement le dossier Prefetch en profitant de Ccleaner pour automatiser ce nettoyage.
Pour cela, il faut aller dans Options puis Personnaliser pour ajouter le dossier C:WindowsPREFETCH.


_ Un petit coup d'oeil à notre dossier Nettoyage peut être utile en supplément.

[dz.malek]

Je te remercie enormement pour ton aide Doudou, je sais pas comment j'aurai fait sans toi