désolé de vous déranger pour pareille imprudance mais un ami débutant est allé sur le net avec un antivirus périmé. Il a je suppose aussi utiliser des programmes de partage de fichiers. J ai du dans un premier temps lancer le rescue disk de avira tellement l ordi était infecté. Maintenant antivir tourne dessus j ai fait tourner filewalker plusieur fois mais il me semble qu il y a des reste d infection.... et des redirections bizzard dans iexplorer (ça ne trompe pas!)
je me permet donc de vous soumettre pour analyse le log de hijack this et je vous remercie par avance pour votre aide,

Christophe


Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 14:35:05, on 28.09.2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18943)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Acer\Empowering Technology\SysMonitor.exe
C:\Program Files\Acer\Empowering Technology\Framework.Launcher.exe
C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Northstar\SmartCopy\SmartCopy.exe
C:\Program Files\Northstar\SmartLauncher\SmartLauncher.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Windows\system32\conime.exe
C:\program files\avira\antivir desktop\avcenter.exe
C:\Windows\explorer.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Trend Micro\HijackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACA ... pire_m1201
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.mirarsearch.com/?useie5=1&q=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = ${URL_SEARCHPAGE}
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ch/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACA ... pire_m1201
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.mirarsearch.com/?useie5=1&q=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = ${URL_SEARCHPAGE}
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId= ... pire_m1201
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (file missing)
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: PHPNukeFR Toolbar - {1c491116-c175-45e1-a570-6fb14fea8b7b} - C:\Program Files\PHPNukeFR\tbPHP1.dll (file missing)
R3 - URLSearchHook: Softonic_France Toolbar - {4daac69c-cba7-45e2-9bc8-1044483d3352} - C:\Program Files\Softonic_France\tbSof1.dll (file missing)
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {01D8B6D0-4B7A-4134-B84F-DE292AA9A7F5} - C:\ProgramData\efsadu32.dll (file missing)
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: PHPNukeFR Toolbar - {1c491116-c175-45e1-a570-6fb14fea8b7b} - C:\Program Files\PHPNukeFR\tbPHP1.dll (file missing)
O2 - BHO: hotrevenue browser enhancer - {289B10DA-CDF6-FE9E-9192-FDA2F422291F} - C:\Windows\system32\taadlhjrywyrltzqd.dll (file missing)
O2 - BHO: SmartAds browser enhancer pumsvbyq - {3708A380-ABD9-490E-AF50-7603D5DB6FB8} - C:\Windows\system32\pumsvbyq.dll (file missing)
O2 - BHO: Softonic_France Toolbar - {4daac69c-cba7-45e2-9bc8-1044483d3352} - C:\Program Files\Softonic_France\tbSof1.dll (file missing)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (file missing)
O2 - BHO: ezLife browser enhancer naboqczr - {6FEBCDD4-C207-4B1E-A5C5-8CA9F584ACD1} - C:\Windows\system32\naboqczr.dll (file missing)
O2 - BHO: dymanet - {74d2af10-4719-bd5e-2420-4e4eeb5c3a22} - C:\Windows\system32\69c6df51-5e66-26b8-e791-50c4abdce714.dll (file missing)
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll (file missing)
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (file missing)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (file missing)
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: FrostWire Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (file missing)
O3 - Toolbar: PHPNukeFR Toolbar - {1c491116-c175-45e1-a570-6fb14fea8b7b} - C:\Program Files\PHPNukeFR\tbPHP1.dll (file missing)
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: Softonic_France Toolbar - {4daac69c-cba7-45e2-9bc8-1044483d3352} - C:\Program Files\Softonic_France\tbSof1.dll (file missing)
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (file missing)
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\Program Files\Acer\Empowering Technology\SysMonitor.exe
O4 - HKLM\..\Run: [EmpoweringTechnology] C:\Program Files\Acer\Empowering Technology\Framework.Launcher.exe boot
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe
O4 - HKLM\..\Run: [BkupTray] "C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Program Files\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Setresolution] C:\ACER\config\1680x1050.cmd
O4 - HKLM\..\Run: [PCMMediaSharing] C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Windows\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [hmrkljesoylxnxw] C:\Windows\System32\regsvr32.exe /s "C:\Windows\system32\taadlhjrywyrltzqd.dll"
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: IMVU.lnk = Pascal\AppData\Roaming\IMVUClient\IMVUQualityAgent.exe
O4 - Global Startup: SmartCopy.lnk = C:\Program Files\Northstar\SmartCopy\SmartCopy.exe
O4 - Global Startup: SmartLauncher.lnk = C:\Program Files\Northstar\SmartLauncher\SmartLauncher.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (file missing)
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (file missing)
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/200 ... ader55.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} (get_atlcom Class) - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL,C:\Windows\system32\brcoinst32.dll C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL,C:\Windows\system32\brcoinst32.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Acer HomeMedia Connect Service - CyberLink - C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: @%SystemRoot%\system32\aelupsvc.dll,-1 (AeLookupSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: @%systemroot%\system32\appinfo.dll,-100 (Appinfo) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: @%SystemRoot%\system32\audiosrv.dll,-204 (AudioEndpointBuilder) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\audiosrv.dll,-200 (Audiosrv) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\bfe.dll,-1001 (BFE) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\qmgr.dll,-1000 (BITS) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\browser.dll,-100 (Browser) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
O23 - Service: @%SystemRoot%\System32\certprop.dll,-11 (CertPropSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\cryptsvc.dll,-1001 (CryptSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @oleres.dll,-5012 (DcomLaunch) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe
O23 - Service: @%SystemRoot%\system32\dhcpcsvc.dll,-100 (Dhcp) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\dnsapi.dll,-101 (Dnscache) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\dot3svc.dll,-1102 (dot3svc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\dps.dll,-500 (DPS) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\eapsvc.dll,-1 (EapHost) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: EBP Pervasive.SQL - Unknown owner - C:\PVSW\Bin\WGE_SRV.exe
O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
O23 - Service: @%SystemRoot%\ehome\ehrecvr.exe,-101 (ehRecvr) - Unknown owner - C:\Windows\ehome\ehRecvr.exe
O23 - Service: @%SystemRoot%\ehome\ehsched.exe,-101 (ehSched) - Unknown owner - C:\Windows\ehome\ehsched.exe
O23 - Service: @%SystemRoot%\ehome\ehstart.dll,-101 (ehstart) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\emdmgmt.dll,-1000 (EMDMgmt) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
O23 - Service: @%SystemRoot%\system32\wevtsvc.dll,-200 (Eventlog) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @comres.dll,-2450 (EventSystem) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\fdPHost.dll,-100 (fdPHost) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\fdrespub.dll,-100 (FDResPub) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\FntCache.dll,-100 (FontCache) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @C:\Program Files\NOS\bin\getPlus_Helper.dll,-101 (getPlusHelper) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: Google Desktop Manager 5.9.1005.12335 (GoogleDesktopManager-051210-111108) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: @gpapi.dll,-112 (gpsvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: Service Google Update (gupdate1c9d70eca8ac256) (gupdate1c9d70eca8ac256) - Unknown owner - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: @%SystemRoot%\System32\hidserv.dll,-101 (hidserv) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\kmsvc.dll,-6 (hkmsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\ikeext.dll,-501 (IKEEXT) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\IPBusEnum.dll,-102 (IPBusEnum) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\iphlpsvc.dll,-200 (iphlpsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe
O23 - Service: @comres.dll,-2946 (KtmRm) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\srvsvc.dll,-100 (LanmanServer) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\wkssvc.dll,-100 (LanmanWorkstation) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: @%SystemRoot%\system32\lltdres.dll,-1 (lltdsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\lmhsvc.dll,-101 (lmhosts) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\mmcss.dll,-100 (MMCSS) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\FirewallAPI.dll,-23090 (MpsSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe
O23 - Service: @%SystemRoot%\system32\iscsidsc.dll,-5000 (MSiSCSI) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\msimsg.dll,-27 (msiserver) - Unknown owner - C:\Windows\system32\msiexec.exe
O23 - Service: @%SystemRoot%\system32\qagentrt.dll,-6 (napagent) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe
O23 - Service: @%SystemRoot%\system32\netman.dll,-109 (Netman) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\netprof.dll,-246 (netprofm) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\nlasvc.dll,-1 (NlaSvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing)
O23 - Service: @%SystemRoot%\system32\nsisvc.dll,-200 (nsi) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
O23 - Service: @%SystemRoot%\system32\p2psvc.dll,-8004 (p2pimsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\p2psvc.dll,-8006 (p2psvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\pcasvc.dll,-1 (PcaSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\pla.dll,-500 (pla) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\umpnpmgr.dll,-100 (PlugPlay) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\p2psvc.dll,-8002 (PNRPAutoReg) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\p2psvc.dll,-8000 (PNRPsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\polstore.dll,-5010 (PolicyAgent) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\profsvc.dll,-300 (ProfSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%Systemroot%\system32\rasauto.dll,-200 (RasAuto) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%Systemroot%\system32\rasmans.dll,-200 (RasMan) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: RelevantKnowledge - Unknown owner - C:\Program Files\RelevantKnowledge\rlservice.exe (file missing)
O23 - Service: @regsvc.dll,-1 (RemoteRegistry) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe
O23 - Service: @oleres.dll,-5010 (RpcSs) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe
O23 - Service: @%SystemRoot%\System32\SCardSvr.dll,-1 (SCardSvr) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\schedsvc.dll,-100 (Schedule) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\certprop.dll,-13 (SCPolicySvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\sdrsvc.dll,-107 (SDRSVC) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: SeaPort - Unknown owner - C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (file missing)
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\Sens.dll,-200 (SENS) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\SessEnv.dll,-1026 (SessionEnv) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\shsvcs.dll,-12288 (ShellHWDetection) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe
O23 - Service: @%SystemRoot%\system32\SLUINotify.dll,-103 (SLUINotify) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe
O23 - Service: @%systemroot%\system32\ssdpsrv.dll,-100 (SSDPSRV) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\sstpsvc.dll,-200 (SstpSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\wiaservc.dll,-9 (stisvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\swprv.dll,-103 (swprv) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\sysmain.dll,-1000 (SysMain) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\TabSvc.dll,-100 (TabletInputService) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\tapisrv.dll,-10100 (TapiSrv) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\tbssvc.dll,-100 (TBS) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\termsrv.dll,-268 (TermService) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\shsvcs.dll,-8192 (Themes) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\mmcss.dll,-102 (THREADORDER) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\trkwks.dll,-1 (TrkWks) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\servicing\TrustedInstaller.exe,-100 (TrustedInstaller) - Unknown owner - C:\Windows\servicing\TrustedInstaller.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe
O23 - Service: @%systemroot%\system32\upnphost.dll,-213 (upnphost) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\dwm.exe,-2000 (UxSms) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe
O23 - Service: @%SystemRoot%\system32\w32time.dll,-200 (W32Time) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\wcncsvc.dll,-3 (wcncsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\WcsPlugInService.dll,-200 (WcsPlugInService) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\wdi.dll,-502 (WdiServiceHost) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\wdi.dll,-500 (WdiSystemHost) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\webclnt.dll,-100 (WebClient) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\wecsvc.dll,-200 (Wecsvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\wercplsupport.dll,-101 (wercplsupport) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\wersvc.dll,-100 (WerSvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%ProgramFiles%\Windows Defender\MsMpRes.dll,-103 (WinDefend) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\winhttp.dll,-100 (WinHttpAutoProxySvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%Systemroot%\system32\wbem\wmisvc.dll,-205 (Winmgmt) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%Systemroot%\system32\wsmsvc.dll,-101 (WinRM) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\wlansvc.dll,-257 (Wlansvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\wmpnetwk.exe
O23 - Service: @%SystemRoot%\system32\wpcsvc.dll,-100 (WPCSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\wpdbusenum.dll,-100 (WPDBusEnum) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100 (WPFFontCache_v0400) - Unknown owner - C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
O23 - Service: @%SystemRoot%\System32\wscsvc.dll,-200 (wscsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\SearchIndexer.exe,-103 (WSearch) - Unknown owner - C:\Windows\system32\SearchIndexer.exe
O23 - Service: @%systemroot%\system32\wuaueng.dll,-105 (wuauserv) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\wudfsvc.dll,-1000 (wudfsvc) - Unknown owner - C:\Windows\system32\svchost.exe

--
End of file - 28396 bytes

Bonjour,

Comme tu dis, il reste des traces.
Voici trois outils à passer.

1- Télécharge AD-Remover sur ton bureau.

Double clique sur AD-R.exe
Clique sur le bouton Nettoyer.
Poste le rapport qui va s'ouvrir en fin de scan.
Le rapport est sauvegardé sous C:\Ad-report-SCAN[1].txt
Puis ferme le programme par Quitter.

2- Télécharge et installe Malwarebytes Anti-Malware de RubbeR DuckY

Double-clique sur le fichier mbam-setup-1.46.exe (sous Vista et 7 autorise les modifications)
A la fin de l'installation, veille à ce que les options suivantes soient cochées

-Mettre à jour Malwarebytes' Anti-Malware
-Exécuter Malwarebytes' Anti-Malware

Clique sur Terminer
Une fenêtre Mise à jour de Malwarebytes' Anti-Malware va s'ouvrir avec une barre de progression.
Puis une autre annonçant le succès de la mise à jour de la base de données. Clique sur OK.
Le programme s'ouvre sur l'onglet Recherche.
Coche Exécuter un examen rapide, clique sur le bouton

A la fin du scan, sélectionne tout et clique sur Supprimer la sélection

Poste le rapport qui s'ouvre après cette suppression.
Redémarre le pc si cela est demandé
Tu peux retrouver le rapport dans l'onglet Rapports/Logs avec la date et l'heure d'exécution.

3- Télécharge ZHPDiag de Nicolas Coolman sur ton bureau.

Clique sur pour lancer l'installation.
Clique sur pour lancer le programme.

Sous Vista et Sept , il faut cliquer droit dessus et dans le menu contextuel sur Exécuter en tant qu'administrateur.
Clique sur pour vérifier si une mise à jour du logiciel est disponible.
Clique sur pour lancer le scan.
Clique sur quand le scan sera terminé pour mettre le rapport dans le presse-papier.

Poste ce dernier dans ta réponse en envoyant le lien créé par Cjoint où tu vas l'héberger
Referme l'outil.
Le rapport sera enregistré sur le bureau.

@+

@+

voici les 3 rapports, encore merci pour ton aide.


*******************************************************************
rapport Adreport:
*******************************************************************
======= RAPPORT D'AD-REMOVER 2.0.0.1,F | UNIQUEMENT XP/VISTA/7 =======

Mis à jour par C_XX le 16/09/10 à 13:30
Contact: AdRemover.contact[AT]gmail.com
Site web: http://www.teamxscript.org

C:\Program Files\Ad-Remover\main.exe (CLEAN [1]) -> Lancé à 14:12:22 le 29/09/2010, Mode normal

Microsoft® Windows Vista™ Édition Familiale Premium Service Pack 2 (X86)
Pascal@PC-DE-MPARC (Acer Aspire M1201)

============== ACTION(S) ==============

Service: "RelevantKnowledge" Stoppé et supprimé

0,Dossier supprimé: C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
0,Dossier supprimé: C:\Users\Pascal\AppData\Roaming\SystemProc
0,Erreur suppression dossier: C:\Program Files\Ask.com (Error code: 0)
0,Dossier supprimé: C:\Users\Pascal\AppData\LocalLow\Conduit
0,Dossier supprimé: C:\Program Files\Conduit
0,Dossier supprimé: C:\Users\Pascal\AppData\LocalLow\ezLife
0,Dossier supprimé: C:\Users\Pascal\AppData\LocalLow\FunWebProducts
0,Dossier supprimé: C:\Program Files\FunWebProducts
0,Dossier supprimé: C:\Users\Pascal\AppData\LocalLow\MyWebSearch
0,Dossier supprimé: C:\Program Files\MyWebSearch
0,Dossier supprimé: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RelevantKnowledge
0,Dossier supprimé: C:\Program Files\RelevantKnowledge
0,Dossier supprimé: C:\Users\Pascal\AppData\LocalLow\Smart-Ads-Solutions
0,Dossier supprimé: C:\Users\Pascal\AppData\Roaming\WhereSphere
0,Fichier supprimé: C:\Windows\system32\65c74056-eb24-326a-f81e-f7b18a609cad.exe
3,Fichier supprimé: C:\Windows\Installer\202ef2.msi
3,Fichier supprimé: C:\Windows\Installer\396be5.msi

(!) -- Fichiers temporaires supprimés.


1,Clé supprimée: HKLM\Software\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
1,Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00000000-6E41-4FD3-8538-502F5495E5FC}
1,Clé supprimée: HKLM\Software\Classes\CLSID\{289B10DA-CDF6-FE9E-9192-FDA2F422291F}
1,Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{289B10DA-CDF6-FE9E-9192-FDA2F422291F}
1,Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{289B10DA-CDF6-FE9E-9192-FDA2F422291F}
1,Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{289B10DA-CDF6-FE9E-9192-FDA2F422291F}
1,Clé supprimée: HKLM\Software\Classes\CLSID\{3708A380-ABD9-490E-AF50-7603D5DB6FB8}
1,Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3708A380-ABD9-490E-AF50-7603D5DB6FB8}
1,Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3708A380-ABD9-490E-AF50-7603D5DB6FB8}
1,Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3708A380-ABD9-490E-AF50-7603D5DB6FB8}
1,Clé supprimée: HKLM\Software\Classes\CLSID\{6FEBCDD4-C207-4B1E-A5C5-8CA9F584ACD1}
1,Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6FEBCDD4-C207-4B1E-A5C5-8CA9F584ACD1}
1,Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6FEBCDD4-C207-4B1E-A5C5-8CA9F584ACD1}
1,Clé supprimée: HKLM\Software\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
1,Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
1,Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
1,Clé supprimée: HKLM\Software\Classes\Interface\{2E9937FC-CF2F-4F56-AF54-5A6A3DD375CC}
1,Clé supprimée: HKLM\Software\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
1,Clé supprimée: HKLM\Software\Classes\Interface\{741DE825-A6F0-4497-9AA6-8023CF9B0FFF}
1,Clé supprimée: HKLM\Software\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
1,Clé supprimée: HKLM\Software\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
1,Clé supprimée: HKLM\Software\Classes\Interface\{CF54BE1C-9359-4395-8533-1657CF209CFE}
1,Clé supprimée: HKLM\Software\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
1,Clé supprimée: HKLM\Software\Classes\TypeLib\{D518921A-4A03-425E-9873-B9A71756821E}
3,Clé supprimée: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\oimriqtbimdzs
0,Clé supprimée: HKLM\Software\Classes\GenericAskToolbar.ToolbarWnd
0,Clé supprimée: HKLM\Software\Classes\GenericAskToolbar.ToolbarWnd.1
0,Clé supprimée: HKLM\Software\Classes\Toolbar.CT2102473
0,Clé supprimée: HKLM\Software\Classes\Toolbar.CT2542115
0,Clé supprimée: HKLM\Software\Classes\AppID\GenericAskToolbar.DLL
1,Clé supprimée: HKLM\Software\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
0,Clé supprimée: HKLM\Software\Conduit
0,Clé supprimée: HKLM\Software\FocusInteractive
0,Clé supprimée: HKLM\Software\Fun Web Products
0,Clé supprimée: HKLM\Software\FunWebProducts
0,Clé supprimée: HKLM\Software\MyWebSearch
0,Clé supprimée: HKCU\Software\Ask.com
0,Clé supprimée: HKCU\Software\MyWebSearch
0,Clé supprimée: HKCU\Software\Smart-Ads-Solutions
0,Clé supprimée: HKCU\Software\AppDataLow\AskBarDis
0,Clé supprimée: HKCU\Software\AppDataLow\AskHomePage
0,Clé supprimée: HKCU\Software\AppDataLow\AskToolbarInfo
0,Clé supprimée: HKCU\Software\AppDataLow\HavingFunOnline
0,Clé supprimée: HKCU\Software\AppDataLow\Software\AskToolbar
0,Clé supprimée: HKCU\Software\AppDataLow\Software\Conduit
0,Clé supprimée: HKCU\Software\AppDataLow\Software\Fun Web Products
0,Clé supprimée: HKCU\Software\AppDataLow\Software\FunWebProducts
0,Clé supprimée: HKCU\Software\AppDataLow\Software\MyWebSearch
0,Clé supprimée: HKCU\Software\AppDataLow\c081f41e-6a44-2779-83c3-757d7ccca4e8
3,Clé supprimée: HKLM\Software\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
3,Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
3,Clé supprimée: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0}
3,Clé supprimée: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{92DDD366-6DF7-435D-B853-389B43CD276C}
3,Clé supprimée: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}
3,Clé supprimée: HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0}
3,Clé supprimée: HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{92DDD366-6DF7-435D-B853-389B43CD276C}
3,Clé supprimée: HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}
3,Clé supprimée: HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
3,Clé supprimée: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59C7FC09-1C83-4648-B3E6-003D2BBC7481}
3,Clé supprimée: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170B96C-28D4-4626-8358-27E6CAEEF907}
3,Clé supprimée: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
3,Clé supprimée: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D1A71FA0-FF48-48dd-9B6D-7A13A3E42127}
3,Clé supprimée: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DDB1968E-EAD6-40fd-8DAE-FF14757F60C7}
3,Clé supprimée: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F138D901-86F0-4383-99B6-9CDD406036DA}
0,Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
0,Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{D08D9F98-1C78-4704-87E6-368B0023D831}
0,Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF1-072E-44CF-8957-5838F569A31D}
0,Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA1-A523-4961-B6BB-170DE4475CCA}
0,Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA9-A523-4961-B6BB-170DE4475CCA}
0,Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EAB-A523-4961-B6BB-170DE4475CCA}
0,Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB}
0,Clé supprimée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C}
0,Clé supprimée: HKLM\Software\Classes\CLSID\{A4730EBE-43A6-443e-9776-36915D323AD3}
0,Clé supprimée: HKLM\Software\Classes\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239}
0,Clé supprimée: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68AF847F-6E91-45DD-9B68-D6A12C30E5D7}
0,Clé supprimée: HKLM\Software\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll
0,Clé supprimée: HKLM\Software\Microsoft\Multimedia\WMPlayer\Schemes\f3pss

0,Valeur supprimée: HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks|{00000000-6E41-4FD3-8538-502F5495E5FC}
0,Valeur supprimée: HKLM\Software\Microsoft\Internet Explorer\Toolbar|{D4027C7F-154A-4066-A1AD-4243D8127440}


============== SCAN ADDITIONNEL ==============

** Internet Explorer Version [8.0.6001.18943] **

[HKCU\Software\Microsoft\Internet Explorer\Main]
AutoHide: yes
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dl ... ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dl ... r=iesearch
Do404Search: 0x01000000
Enable Browser Extensions: yes
Local Page: C:\Windows\system32\blank.htm
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Show_ToolBar: yes
Start Page: hxxp://fr.msn.com/
Use Custom Search URL: 1
Use Search Asst: no

[HKLM\Software\Microsoft\Internet Explorer\Main]
AutoHide: yes
Default_Page_URL: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dl ... r=iesearch
Delete_Temp_Files_On_Exit: yes
Enable Browser Extensions: yes
Local Page: C:\Windows\System32\blank.htm
Search bar: hxxp://search.msn.com/spbasic.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dl ... r=iesearch
Start Page: hxxp://fr.msn.com/
Use Custom Search URL: 1
Use Search Asst: no

[HKLM\Software\Microsoft\Internet Explorer\ABOUTURLS]
Tabs: res://ieframe.dll/tabswelcome.htm
Blank: res://mshtml.dll/blank.htm

========================================

C:\Program Files\Ad-Remover\Quarantine: 83 Fichier(s)
C:\Program Files\Ad-Remover\Backup: 15 Fichier(s)

C:\Ad-Report-CLEAN[1].txt - 29/09/2010 (10426 Octet(s))

Fin à: 14:19:16, 29/09/2010

============== E.O.F ==============




*******************************************************************
rapport MBAM
*******************************************************************

Malwarebytes' Anti-Malware 1.46
http://www.malwarebytes.org

Version de la base de données: 4715

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18943

29.09.2010 14:51:54
mbam-log-2010-09-29 (14-51-54).txt

Type d'examen: Examen rapide
Elément(s) analysé(s): 147124
Temps écoulé: 8 minute(s), 31 seconde(s)

Processus mémoire infecté(s): 1
Module(s) mémoire infecté(s): 3
Clé(s) du Registre infectée(s): 10
Valeur(s) du Registre infectée(s): 2
Elément(s) de données du Registre infecté(s): 2
Dossier(s) infecté(s): 2
Fichier(s) infecté(s): 24

Processus mémoire infecté(s):
C:\Users\Pascal\AppData\Roaming\SysWin\lsass.exe (Trojan.Tracur) -> Unloaded process successfully.

Module(s) mémoire infecté(s):
C:\Windows\System32\brcoinst32.dll (Trojan.Tracur) -> Delete on reboot.
C:\Users\Pascal\AppData\Roaming\8526.tmp (Trojan.Tracur) -> Delete on reboot.
C:\ProgramData\dxmasf32.dll (Trojan.Tracur) -> Delete on reboot.

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\CLSID\{01d8b6d0-4b7a-4134-b84f-de292aa9a7f5} (Trojan.Tracur) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{01d8b6d0-4b7a-4134-b84f-de292aa9a7f5} (Trojan.Tracur) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{01d8b6d0-4b7a-4134-b84f-de292aa9a7f5} (Trojan.Tracur) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{01d8b6d0-4b7a-4134-b84f-de292aa9a7f5} (Trojan.Tracur) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{6d5ae610-803a-e578-8b93-ee9ce23be350} (Adware.Dymanet) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\.fsharproj (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WhereSphere (Adware.WhereSphere) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\WhereSphere (Adware.WhereSphere) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{74d2af10-4719-bd5e-2420-4e4eeb5c3a22} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{74d2af10-4719-bd5e-2420-4e4eeb5c3a22} (Trojan.BHO) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rthdbpl (Trojan.Tracur) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hmrkljesoylxnxw (Trojan.Agent) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Tracur) -> Data: c:\windows\system32\brcoinst32.dll -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Tracur) -> Data: system32\brcoinst32.dll -> Delete on reboot.

Dossier(s) infecté(s):
C:\ProgramData\1016287130 (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Users\Pascal\AppData\Roaming\SysWin (Trojan.Agent) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Windows\System32\brcoinst32.dll (Trojan.Tracur) -> Delete on reboot.
C:\Users\Pascal\AppData\Roaming\8526.tmp (Trojan.Tracur) -> Delete on reboot.
C:\ProgramData\dxmasf32.dll (Trojan.Tracur) -> Delete on reboot.
C:\Users\Pascal\AppData\Roaming\SysWin\lsass.exe (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\ProgramData\atmlib32.dll (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\ProgramData\ci32.dll (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\ProgramData\cliconfg32.dll (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\ProgramData\cmdial3232.dll (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\ProgramData\dhcpcsvc32.dll (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\ProgramData\divx_xx073232.dll (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\ProgramData\dmdskres32.dll (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\ProgramData\dot3cfg32.dll (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\ProgramData\gpedit32.dll (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\ProgramData\divx_xx0c32.dll (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\Users\Pascal\AppData\Roaming\A591.tmp (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\Windows\System32\brcplsdw32.dll (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\Windows\System32\divx_xx0732.dll (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\Users\Pascal\AppData\Local\Temp\C82F.tmp (Trojan.Tracur) -> Quarantined and deleted successfully.
C:\Windows\Temp\~os42CA.tmp\rlxf.dll (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
C:\Windows\Temp\~os42CA.tmp\rlxg.dll (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
C:\Windows\Temp\~os6D63.tmp\rlservice.exe (Adware.RelevantKnowledge) -> Quarantined and deleted successfully.
C:\Users\Pascal\AppData\Roaming\chrtmp (Malware.Trace) -> Quarantined and deleted successfully.
C:\Users\Pascal\Desktop\windows defender antivirus.docx (Rogue.WindowsAntiVirus) -> Quarantined and deleted successfully.
C:\Windows\GnuHashes.ini (Malware.Trace) -> Quarantined and deleted successfully.


*******************************************************************
rapport ZHP:
*******************************************************************
http://cjoint.com/?jDptMXmptp

Bonjour,

Voici une liste de programmes à désinstaller par Ajout/suppression des programmes.

PHPNukeFR
Softonic_France
Yahoo! Toolbar
Abdio DVD CD Burner v5.2
Acoustica MP3 CD Burner
Express Burn
FrostWire 4.20.1
HOTZIC CD Burner V1.1
Java(TM) 6 Update 12
Norton Security Scan
OfficeBoots-Franz-5to4
RM-X Player Pack V5.3
Paint Shop Pro 7 Try And Buy
Adobe Photoshop CS2
Adobe Photoshop CS3
Sateira CD&DVD Burner 2.71
Studio-Scrap 2
LimeWire

Télécharge OTM de OldTimer
Enregistre-le sur le Bureau.
Double-clique sur OTM.exe pour lancer l'outil.
Note :
Sous Vista, clic droit sur le fichier et Exécuter en tant qu'administrateur.
Copie toutes les lignes ci-dessous en citation par CTRL+C dans le presse-papier.

:file
C:\Windows\system32\brcoinst32.dll
C:\Windows\Tasks\Norton Security Scan for Pascal.job
C:\Program Files\Ask.com
C:\Program Files\FrostWire
C:\Program Files\LimeWire
C:\Program Files\Norton Security Scan
C:\Program Files\NortonInstaller
C:\Program Files\PHPNukeFR
C:\Program Files\Sateira
C:\Program Files\Softonic_France
C:\ProgramData\McAfee
C:\ProgramData\Norton
C:\ProgramData\NortonInstaller
C:\ProgramData\Symantec
C:\Program Files\Common Files\Symantec Shared

:reg
[HKCU\Software\Krvqyoenyd]
"WinUsr"=-

:commands
[purity]
[emptytemp]

Dans OTM, place le curseur dans la la fenêtre "Paste Instructions for Items to be Moved" et tu cliques sur CTRL+V pour coller le contenu du presse-papier.
Clique sur le bouton MoveIt!, le rouge.



Ferme l'outil. Le pc va redémarrer
Poste le contenu du rapport C:\_OTM\MovedFiles\********_******.log
Les * représentent Mois/Jour/Année_Heure/Minutes/Secondes

Mise à jour à effectuer sans délais
Java(TM) 6 Update 12
-Java Runtime Environment (JRE)6u21 :
http://java.sun.com/javase/downloads/index.jsp
Clique sur Download Java Runtime Environment (JRE) 6 update21
Dans la page suivante, choisis Windows dans Platform coche I agree to the Java SE Runtime Environment 6 License Agreement et Continue
Dans la nouvelle page, coche Windows Offline Installation, et clique sur jre-6u21-windows-i586.exe //15.54MB.
Tu l'installeras hors connexion.

@+

j ai fait ce que tu m as dit mais tout ne marche pas comme sur des roulettes... j ai pu déinstaller la plupart des programme que tu m as lister sauf:

Limewire qui est pas dans la liste des programme installé???
HotZIc qui ne trouve pas son programme de dé installation
norton idem

j ai ensuite passer a oldtimer mais tu verras qu il y a bcp d erreur, j ai réinstallé par contre java hors ligne sans soucis.


log oldtimer:

All processes killed
Error: Unable to interpret <:file> in the current context!
Error: Unable to interpret <C:\Windows\system32\brcoinst32.dll> in the current context!
Error: Unable to interpret <C:\Windows\Tasks\Norton Security Scan for Pascal.job> in the current context!
Error: Unable to interpret <C:\Program Files\Ask.com> in the current context!
Error: Unable to interpret <C:\Program Files\FrostWire> in the current context!
Error: Unable to interpret <C:\Program Files\LimeWire> in the current context!
Error: Unable to interpret <C:\Program Files\Norton Security Scan> in the current context!
Error: Unable to interpret <C:\Program Files\NortonInstaller> in the current context!
Error: Unable to interpret <C:\Program Files\PHPNukeFR> in the current context!
Error: Unable to interpret <C:\Program Files\Sateira> in the current context!
Error: Unable to interpret <C:\Program Files\Softonic_France> in the current context!
Error: Unable to interpret <C:\ProgramData\McAfee> in the current context!
Error: Unable to interpret <C:\ProgramData\Norton> in the current context!
Error: Unable to interpret <C:\ProgramData\NortonInstaller> in the current context!
Error: Unable to interpret <C:\ProgramData\Symantec> in the current context!
Error: Unable to interpret <C:\Program Files\Common Files\Symantec Shared> in the current context!
========== REGISTRY ==========
Registry value HKEY_CURRENT_USER\Software\Krvqyoenyd\\WinUsr not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Pascal
->Temp folder emptied: 1648202906 bytes
->Temporary Internet Files folder emptied: 503865911 bytes
->Java cache emptied: 83849579 bytes
->Google Chrome cache emptied: 72280000 bytes
->Flash cache emptied: 135184 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 72106883 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 4266221 bytes
%systemroot%\system32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 743 bytes
RecycleBin emptied: 2091811 bytes

Total Files Cleaned = 2'276.00 mb


OTM by OldTimer - Version 3.1.16.1 log created on 09302010_175734

Files moved on Reboot...
File move failed. C:\Windows\temp\CLDigitalHome\CLMS_AGENT_LOG1.txt scheduled to be moved on reboot.
File move failed. C:\Windows\temp\CLDigitalHome\PCMMediaServer.log scheduled to be moved on reboot.

Registry entries deleted on Reboot...

Bonsoir

Refais OTM avec ce qui suit :

:files
C:\Windows\system32\brcoinst32.dll
C:\Windows\Tasks\Norton Security Scan for Pascal.job
C:\Program Files\Ask.com
C:\Program Files\FrostWire
C:\Program Files\LimeWire
C:\Program Files\Norton Security Scan
C:\Program Files\NortonInstaller
C:\Program Files\PHPNukeFR
C:\Program Files\Sateira
C:\Program Files\Softonic_France
C:\ProgramData\McAfee
C:\ProgramData\Norton
C:\ProgramData\NortonInstaller
C:\ProgramData\Symantec
C:\Program Files\Common Files\Symantec Shared

:reg
[-HKCU\Software\Krvqyoenyd]

Et poste le nouveau rapport.
@+

bonsoir a toi aussi. J ai refait OTM avec les nouvelles lignes que tu m as fourni et çA FONCTIONNE mieux. J ai vraiment manquer d esprit critique sur ce coup car je pense qu avec un peux de recherche j aurai vu qu il manquait le "S" à "file". Désolé d avoir manquer cette coquille et encore merci pour ton aide,

Christophe

========== FILES ==========
File/Folder C:\Windows\system32\brcoinst32.dll not found.
C:\Windows\Tasks\Norton Security Scan for Pascal.job moved successfully.
Folder move failed. C:\Program Files\Ask.com scheduled to be moved on reboot.
File/Folder C:\Program Files\FrostWire not found.
C:\Program Files\LimeWire\root\magnet10 folder moved successfully.
C:\Program Files\LimeWire\root folder moved successfully.
C:\Program Files\LimeWire\lib folder moved successfully.
C:\Program Files\LimeWire\Incomplete folder moved successfully.
C:\Program Files\LimeWire folder moved successfully.
C:\Program Files\Norton Security Scan\Norton Security Scan\Engine\2.7.3.34 folder moved successfully.
C:\Program Files\Norton Security Scan\Norton Security Scan\Engine folder moved successfully.
C:\Program Files\Norton Security Scan\Norton Security Scan folder moved successfully.
C:\Program Files\Norton Security Scan folder moved successfully.
C:\Program Files\NortonInstaller\{397E31AA-0D78-4649-A01C-339D73A2ED35}\_lck folder moved successfully.
C:\Program Files\NortonInstaller\{397E31AA-0D78-4649-A01C-339D73A2ED35}\NSS\LicenseType\2.7.3.34 folder moved successfully.
C:\Program Files\NortonInstaller\{397E31AA-0D78-4649-A01C-339D73A2ED35}\NSS\LicenseType folder moved successfully.
C:\Program Files\NortonInstaller\{397E31AA-0D78-4649-A01C-339D73A2ED35}\NSS folder moved successfully.
C:\Program Files\NortonInstaller\{397E31AA-0D78-4649-A01C-339D73A2ED35} folder moved successfully.
C:\Program Files\NortonInstaller folder moved successfully.
File/Folder C:\Program Files\PHPNukeFR not found.
C:\Program Files\Sateira\SCDB folder moved successfully.
C:\Program Files\Sateira folder moved successfully.
C:\Program Files\Softonic_France folder moved successfully.
C:\ProgramData\McAfee\MSC\Cache folder moved successfully.
C:\ProgramData\McAfee\MSC folder moved successfully.
C:\ProgramData\McAfee folder moved successfully.
C:\ProgramData\Norton\{397E31AA-0D78-4649-A01C-339D73A2ED35} folder moved successfully.
C:\ProgramData\Norton folder moved successfully.
C:\ProgramData\NortonInstaller\Settings folder moved successfully.
C:\ProgramData\NortonInstaller\Logs\11-07-2009-18h01m11s folder moved successfully.
C:\ProgramData\NortonInstaller\Logs\09-30-2010-17h32m23s folder moved successfully.
C:\ProgramData\NortonInstaller\Logs\09-30-2010-17h32m08s folder moved successfully.
C:\ProgramData\NortonInstaller\Logs\09-30-2010-17h04m37s folder moved successfully.
C:\ProgramData\NortonInstaller\Logs\09-30-2010-17h04m25s folder moved successfully.
C:\ProgramData\NortonInstaller\Logs\09-30-2010-17h04m07s folder moved successfully.
C:\ProgramData\NortonInstaller\Logs\09-24-2010-11h03m56s folder moved successfully.
C:\ProgramData\NortonInstaller\Logs\09-24-2010-11h02m37s folder moved successfully.
C:\ProgramData\NortonInstaller\Logs\05-09-2010-18h00m41s folder moved successfully.
C:\ProgramData\NortonInstaller\Logs\05-09-2010-18h00m39s folder moved successfully.
C:\ProgramData\NortonInstaller\Logs\05-09-2010-18h00m36s folder moved successfully.
C:\ProgramData\NortonInstaller\Logs folder moved successfully.
C:\ProgramData\NortonInstaller folder moved successfully.
C:\ProgramData\Symantec\Definitions\SymcData\virusdefs-2.5-e\BinHub folder moved successfully.
C:\ProgramData\Symantec\Definitions\SymcData\virusdefs-2.5-e\20100509.002 folder moved successfully.
C:\ProgramData\Symantec\Definitions\SymcData\virusdefs-2.5-e folder moved successfully.
C:\ProgramData\Symantec\Definitions\SymcData folder moved successfully.
C:\ProgramData\Symantec\Definitions folder moved successfully.
C:\ProgramData\Symantec folder moved successfully.
C:\Program Files\Common Files\Symantec Shared folder moved successfully.
========== REGISTRY ==========
Registry key HKEY_CURRENT_USER\Software\Krvqyoenyd\ deleted successfully.

OTM by OldTimer - Version 3.1.16.1 log created on 10012010_004535

Files moved on Reboot...
Folder move failed. C:\Program Files\Ask.com scheduled to be moved on reboot.

Registry entries deleted on Reboot...

Bonsoir
Envoie un nouveau rapport ZHP de contrôle.
@+

Bonjour,
désolé de n avoir pas répondu plus vite j étais absent tout le week end, j ai refait ZHPdiag comme tu m as demander:

le rapport est chez Cjoint:

http://cjoint.com/?kenUJ5qYd6

bon début d après-midi,

Christophe

Bonjour,
Encore quelques corrections à faire.
Ouvre ce lien et applique en cochant les lignes ci-dessous

O4 - Global Startup: C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMVU.lnk . (.Pas de propriétaire.) -- C:\Users\Pascal\AppData\Roaming\IMVUClient\IMVUQualityAgent.exe
O42 - Logiciel: Contextual Tracker Dymanet - (.Pas de propriétaire.) [HKLM] -- 65c74056-eb24-326a-f81e-f7b18a609cad
[HKCU\Software\AppDataLow\Software\PriceGong]
[HKCU\Software\Prodiff]
O43 - CFD:Common File Directory ----D- C:\Program Files\Ask.com
O43 - CFD:Common File Directory -SH-D- C:\ProgramData\SysWoW32
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0

Poste le rapport.
@+

j ai fait ce que tu m as demandé je colle le rapport a la fin de mon texte. Note que je vais relancer l ordi car un des dossiers sera éliminé au reboot, merci pour ton aide et bon début de soirée,

Christophe

Rapport de ZHPFix 1.12.3204 par Nicolas Coolman, Update du 28/09/2010
Fichier d'export Registre : C:\ZHPExportRegistry-06.10.2010-17-44-05.txt
Run by Pascal at 06.10.2010 17:44:05
Web site : http://www.premiumorange.com/zeb-help-p ... hpfix.html
Contact : nicolascoolman@yahoo.fr

========== Clé(s) du Registre ==========
O42 - Logiciel: Contextual Tracker Dymanet - (.Pas de propriétaire.) [HKLM] -- 65c74056-eb24-326a-f81e-f7b18a609cad => Désinstallation logicielle annulée par l'utilisateur !
HKCU\Software\AppDataLow\Software\PriceGong => Clé absente
HKCU\Software\Prodiff => Clé supprimée avec succès

========== Valeur(s) du Registre ==========
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0 => Valeur supprimée avec succès
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0 => Valeur supprimée avec succès

========== Dossier(s) ==========
C:\Program Files\Ask.com => Fichier supprimé au reboot
C:\ProgramData\SysWoW32 => Supprimé et mis en quarantaine

========== Fichier(s) ==========
c:\users\pascal\appdata\roaming\microsoft\windows\start menu\programs\startup\imvu.lnk => Supprimé et mis en quarantaine
c:\users\pascal\appdata\roaming\imvuclient\imvuqualityagent.exe => Supprimé et mis en quarantaine


========== Récapitulatif ==========
3 : Clé(s) du Registre
2 : Valeur(s) du Registre
2 : Dossier(s)
2 : Fichier(s)


End of the scan

Bonsoir,
Pense à me donner des informations sur l'évolution de la situation.
@+

Bonsoiir,

oui ben avant que je fasse ce que tu m as demander de faire en dernier il semblais déja en forme... il n y avais plus de soucis pour reconnaitre l antivirus si je le rebootais plusieurs fois alors qu au début ça marchais pas.

J ai fait le dernier point comme tu as dit et si je décripte bien le rapport de ZHPfix tout ce que tu m as demander de faire semble s être dérouler sans accros. Toi qui a plus d expertise que moi dans la lecture des derniers log tu penses que ya plus rien qui traine sur l ordi? Car de mon point de vue c est mieux, mais c est une impression d utilisateur pas d expert .
En tout les cas merci pour ton aide et le temps précieux que tu y consacres.

Bonjour,
Seul toi peut savoir si le pc fonctionne mieux.
Pour moi au travers du dernier rapport si tu as bien fixé avec ZHPFix tout semble OK.
Nous pouvons donc supprimer les outils si tu me confirmes.
@+

Bonsoir,
oui je te confirme que l ordi va bcp mieux. Tu m as grandement aider sur ce coup là encore merci a toi. Par contre je dois d installer tout les outils? ou je peux faire tourner MBAM ou AD remove de temps en temps?

Bonjour,

**Suppression OTM**
Tu lances OTM et tu cliques sur le bouton [CleanUp].

** Ad-Remover**
Clique sur le bouton Désinstaller

**Suppression ZHPDiag**
Dans le dossier correspondant à ta distribution, clique sur le fichier unins000.exe
- XP C:\Program Files\ZHPDiag\unins000.exe
- Vista/7 32 bit C\Programmes\ZHPDiag\unins000.exe
- Vista/7 64 bis C:\Program Files (x86)\ZHPDiag\unins000.exe

Tu peux conserver Malwarebytes mais ne pas oublier de le mettre à jour régulièrement et surtout avant emploi si possible.

**Création d'un point sain de restauration système**
Désactive la restauration système comme indiqué sur ce lien :
Et réactive-la pour recréer automatiquement un point sain de toute infection.

**Fermer la question**
Tu peux éditer le titre de ta question de base et y ajouter [résolu].

@+

ok je vais enlevé les programme de désinfection selon tes informations. encore merci pour tout, ton aide a été très précieuse. Merci aussi au reste le l équipe de libellule vous faites un boulot génial!