laseve

Bonsoir, des lignes verticales en couleur (comme des codes barre..) apparaissent de plus en plus lors de navigation internet avec firefox. ces derniers temps, mon pc portable chauffait pas mal (ventilos en permanence), avec des lenteurs. ça va mieux depuis que je surélève mon pc portable,; mais les lignes demeurent. pouvez-vous m' aider s' il vous plait ? remarque: les lignes sur les mêmes sites n' apparaissent pas avec IE merci

Bonsoir, je ne peux plus ouvrir de session windows (vista), car le champ mot de passe se remplit automatiquement de 'g' (ou autres caractéres) j' ai éteint - rallumé sans succés, le fond noir s' accompagnant désormais de 'bips' discontinus. ça sent le virus à plein nez... pouvez vous m' aider svp ? merci d' avance, bonne soirée,

Bonjour et merci de ton aide ab-web, j' aide alexia à réparer son ordi. Nous avons tenté réparation et restauration, sans succés. à la fin de la restauration du plus ancient point, un message d' erreur = "une erreur indéterminée s'est produite pendant la restauration. (0x8000ffff)" que peut-on faire maintenant? merci d'avance, laseve, pour Alexia

Bonsoir tom tom, voici le rapport delfix en copier coller (bizarre quand je clique sur le lien de l' hébergeur, cela m'ouvre une page firefox anciennement visitée...? je n'arrive plus à héberger les rapports) merci, laseve # DelFix v10.7 - Rapport créé le 22/05/2014 à 21:29:31 # Mis à jour le 27/04/2014 par Xplode # Nom d'utilisateur : sevoz - PCSEVOZ # Système d'exploitation : Windows Vista Business Service Pack 2 (32 bits) ~ Suppression des outils de désinfection ... Supprimé : C:\AdwCleaner Supprimé : C:\Users\sevoz\AppData\Roaming\ZHP Supprimé : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ZHP Supprimé : C:\Users\sevoz\Desktop\RK_Quarantine Supprimé : C:\Program Files\ZHPDiag Supprimé : C:\PhysicalDisk0_MBR.bin Supprimé : C:\Users\sevoz\Desktop\AdwCleaner[s0].txt Supprimé : C:\Users\sevoz\Desktop\adwcleaner_3.208.exe Supprimé : C:\Users\sevoz\Desktop\JRT.exe Supprimé : C:\Users\sevoz\Desktop\JRT.txt Supprimé : C:\Users\sevoz\Desktop\RKreport[0]_DN_05112014_225245.txt Supprimé : C:\Users\sevoz\Desktop\RKreport[0]_D_05112014_225211.txt Supprimé : C:\Users\sevoz\Desktop\RKreport[0]_H_05112014_225237.txt Supprimé : C:\Users\sevoz\Desktop\RKreport[0]_PR_05112014_225227.txt Supprimé : C:\Users\sevoz\Desktop\RKreport[0]_S_05112014_225051.txt Supprimé : C:\Users\sevoz\Desktop\RogueKiller.exe Supprimé : C:\Users\sevoz\Desktop\ZHPDiag 15mai.txt Supprimé : C:\Users\sevoz\Desktop\ZHPDiag 19mai.txt Supprimé : C:\Users\sevoz\Desktop\ZHPDiag laseve 11mai.txt Supprimé : C:\Users\sevoz\Desktop\ZHPDiag.lnk Supprimé : C:\Users\sevoz\Desktop\ZHPDiag2.exe Supprimé : C:\Users\sevoz\Desktop\ZHPFix.lnk Supprimé : C:\Users\sevoz\Desktop\ZHPFixReport.txt Supprimée : HKLM\SOFTWARE\AdwCleaner Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZHPDiag_is1 ~ Purge de la restauration système ... Supprimé : RP #183 [Point de contrôle planifié | 04/07/2014 06:53:28] Supprimé : RP #184 [Windows Update | 04/08/2014 21:30:53] Supprimé : RP #185 [Point de contrôle planifié | 04/16/2014 06:13:14] Supprimé : RP #186 [Point de contrôle planifié | 05/05/2014 07:38:33] Supprimé : RP #187 [Windows Update | 05/08/2014 01:00:14] Supprimé : RP #189 [uniblue SpeedUpMyPC installation | 05/10/2014 08:42:58] Supprimé : RP #190 [Removed Snap.Do | 05/11/2014 20:18:38] Supprimé : RP #191 [Removed Snap.Do | 05/11/2014 21:20:54] Supprimé : RP #192 [Windows Update | 05/16/2014 22:09:58] Supprimé : RP #193 [Removed Snap.Do | 05/21/2014 19:09:48] Supprimé : RP #195 [ZHPFix Restore System Point | 05/21/2014 19:10:47] Nouveau point de restauration créé ! ########## - EOF - ##########

Re bonsoir, voici le rapport SFTGC http://cjoint.com/?DEvvxPqDIMg enfin, voici le rapport mbam, http://cjoint.com/?DEvv5cDTWLf merci pour tout Laseve

Bonsoir tom tom, voici le lien vers Zhpfixreport http://cjoint.com/?DEvvnE5XJ2W a+ Laseve

Bonsoir, voici le dernier rapport zhpdiag http://cjoint.com/?DEtwC0xf5rk merci,

voici le zhpdiag au 15mai, merci http://cjoint.com/?DEtiI0DInux

Oups, Désolé, je viens de voir qu' il y avait une réponse sur la page suivante .....(autant pour moi) je continue bien évidemment la procédure jusqu' au bout !

Bonjour, le PC est-il désinfecté ? merci de votre aide dans tous les cas,

Bonsoir, le pc est-il désinfecté ? en tout cas, c'est rentré ds l' ordre merci pour tout !!

rebonsoir, enfin le ZHPDiag du 15mai, merci laseve

bonsoir voici le rapport JRT : http://cjoint.com/?DEpxmjzp1Tz ainsi que le rapport ADwcleaner : http://cjoint.com/?DEpxiThKswf merci, Laseve

Bonsoir, voici le rapport JRT http://cjoint.com/?DEpwWs7qqEX cordialement, Laseve

Bonsoir, voici les liens pour les 5 rapports roguekiller : http://cjoint.com/?DElw76XsLeH http://cjoint.com/?DElxcSNycLZ http://cjoint.com/?DElxeLo5QNj http://cjoint.com/?DElxf7alqVI http://cjoint.com/?DElxiv6y9eX merci de votre aide

Bonjour Tomtom95, j' ai exécuté ListLoginstall comme demandé. La liste des logiciels s' affiche dans une fenêtre, mais pas de fichier .txt créé sur le bureau !? je ne peux donc joindre de lien pour vous le communiquer et le copier collé ne marche pas.. j' ai donc fait une impression d' ecran, ci dessous. merci

bonjour tomtom95, et merci de vous pencher sur mon probléme ! voici le lien pour le ZHPdiag http://cjoint.com/?DElaLoKcTDH

Bonjour, suite à une mise à jour Java et/ou Flash player ce matin, je me retrouve avec mozilla firefox planté : me demande de quitter ou redémarrer FFox, ce qui entraine l' ouverture d' une page d' accueuil "Websearch" frauduleuse.. mon antivirus (AVIRA) a détecté 2 fois la présence d' un adware/crossrider.316 (de mémoire), que j' ai supprimé dans la foulée. en même temps, des raccourcis ont été installés automatiquement sur mon bureau : speedup my pc, continue vuuPC installation, Regcleanpro, Optimizer Elitemax, Anyprotect, Advanced system protector, Sync Folder j' aides fentéres me demandant de metre à jour mon navigateur (je ne le fais pas, de peur d' introduire encore des malwares) je n' ai pas redémarré le PC pour ne pas entériner certaines actions mafaisantes en cours ? je suis sous Windows Vista Professionnel. merci de votre aide pour désinfecter mon PC cordialement,

Bonsoir Lance_yien, tout marche parfaitement ! mille mercis pour ton aide experte.. longue vie à ce site !

Bonsoir Lance_yien, çi dessous les rapports manquants de Scan et de Checkup sécurité. en attendant tes prochaines consignes, encore merci pour ton aide (plus de probleme apparent) Results of screen317's Security Check version 0.99.24 Windows Vista Service Pack 2 x86 Internet Explorer 9 `````````````````````````````` Antivirus/Firewall Check: Avira AntiVir Personal - Free Antivirus SonicStage Mastering Studio Audio Filter Custom Preset WMI entry may not exist for antivirus; attempting automatic update. Avira successfully updated! ``````````````````````````````` Anti-malware/Other Utilities Check: Java SE Runtime Environment 6 Adobe Flash Player 11.0.1.152 Mozilla Thunderbird (7.0.1) ```````````````````````````````` Process Check: objlist.exe by Laurent Avira Antivir avgnt.exe Avira Antivir avguard.exe ``````````End of Log```````````` C:\ZHP\Quarantine\BabylonToolbar.DIR\BabylonToolbar\1.4.35.10\BabylonToolbarApp.dll une variante de Win32/Toolbar.Babylon application nettoyé par suppression - mis en quarantaine C:\ZHP\Quarantine\BabylonToolbar.DIR\BabylonToolbar\1.4.35.10\BabylonToolbarsrv.exe une variante probable de Win32/Toolbar.Babylon application nettoyé par suppression - mis en quarantaine

Bonsoir Lance_yien, désolé pour ma réponse tardive, mais les mises à jour de Windows sont interminables ...... je joins déjà le rapport Combofix, le rapport security check sera joint quand les maj seront terminées. merci de ta patience ComboFix 11-11-01.03 - sevoz 02/11/2011 10:50:28.1.2 - x86 Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6000.0.1252.33.1036.18.2046.1007 [GMT 1:00] Lancé depuis: c:\users\sevoz\Desktop\ComboFix.exe Commutateurs utilisés :: c:\users\sevoz\Desktop\CFScript.txt . . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . . Une copie infectée de c:\windows\system32\Drivers\atapi.sys a été trouvée et désinfectée Copie restaurée à partir de - c:\windows\SoftwareDistribution\Download\df81987ce1972154ab659b2f560f1610\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys . . ((((((((((((((((((((((((((((( Fichiers créés du 2011-10-02 au 2011-11-02 )))))))))))))))))))))))))))))))))))) . . 2011-11-02 10:01 . 2011-11-02 10:01 56200 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{534228AF-9592-417D-BFCA-1B30720B75FB}\offreg.dll 2011-11-02 09:59 . 2011-11-02 10:05 -------- d-----w- c:\users\sevoz\AppData\Local\temp 2011-11-02 09:59 . 2011-11-02 09:59 -------- d-----w- c:\users\Default\AppData\Local\temp 2011-11-01 12:42 . 2011-11-01 12:42 512 ----a-w- C:\PhysicalDisk0_MBR.bin 2011-11-01 12:39 . 2011-11-01 13:59 -------- d-----w- C:\ZHP 2011-11-01 11:44 . 2011-11-01 13:52 -------- d-----w- c:\program files\ZHPDiag 2011-11-01 09:14 . 2011-10-07 03:48 6668624 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{534228AF-9592-417D-BFCA-1B30720B75FB}\mpengine.dll 2011-10-29 16:41 . 2011-10-29 16:41 -------- d-----w- c:\users\sevoz\AppData\Roaming\Toshiba 2011-10-22 18:54 . 2011-10-22 18:54 -------- d-----w- c:\program files\Minibar 2011-10-22 18:54 . 2011-10-22 18:55 -------- d-----w- c:\program files\FaceSmooch Smileys 2011-10-22 18:53 . 2011-10-22 18:53 -------- d-----w- c:\users\sevoz\AppData\Roaming\TuneUp Software 2011-10-22 18:52 . 2011-10-22 19:09 -------- d-----w- c:\programdata\TuneUp Software 2011-10-22 18:51 . 2011-10-22 18:51 -------- d-sh--w- c:\programdata\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16} 2011-10-22 18:49 . 2011-10-22 19:04 -------- d-----w- c:\program files\SMPlayer . . . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . . . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-10 1232896] "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2006-11-02 125440] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Apoint"="c:\program files\Apoint\Apoint.exe" [2006-09-11 118784] "VAIOCameraUtility"="c:\program files\Sony\VAIO Camera Utility\VCUServe.exe" [2006-11-14 411768] "ISBMgr.exe"="c:\program files\Sony\ISB Utility\ISBMgr.exe" [2006-11-11 43128] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-12-07 7766016] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-12-07 81920] "Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2008-10-14 623992] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2007-05-22 185784] "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-12-13 281768] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-01-19 282624] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2006-11-25 2134016] Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360] . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon] 2006-11-24 09:36 73728 ----a-w- c:\windows\System32\VESWinlogon.dll . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R3 VAIOMediaPlatform-UCLS-AppServer;VAIO Media Content Collection;c:\program files\Sony\VAIO Media Integrated Server\UCLS.exe [2007-01-10 745472] R3 VAIOMediaPlatform-UCLS-HTTP;VAIO Media Content Collection (HTTP);c:\program files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe [2007-01-08 397312] R3 VAIOMediaPlatform-UCLS-UPnP;VAIO Media Content Collection (UPnP);c:\program files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe [2007-01-08 1089536] R3 WPFFontCache_v0400;Cache de police de Windows Presentation Foundation 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504] S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2011-04-29 136360] S2 MSSQL$VAIO_VEDB;SQL Server (VAIO_VEDB);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2009-05-27 29262680] S3 R5U870FLx86;R5U870 UVC Lower Filter ;c:\windows\system32\Drivers\R5U870FLx86.sys [2006-10-27 72704] S3 R5U870FUx86;R5U870 UVC Upper Filter ;c:\windows\system32\Drivers\R5U870FUx86.sys [2006-10-27 43904] S3 SonyImgF;Sony Image Conversion Filter Driver;c:\windows\system32\DRIVERS\SonyImgF.sys [2006-09-06 30976] S3 ti21sony;ti21sony;c:\windows\system32\drivers\ti21sony.sys [2006-11-06 227328] . . Contenu du dossier 'Tâches planifiées' . 2011-11-01 c:\windows\Tasks\User_Feed_Synchronization-{749F7267-3809-4F65-A674-B375A4B1B6E4}.job - c:\windows\system32\msfeedssync.exe [2006-11-02 09:45] . . ------- Examen supplémentaire ------- . uStart Page = hxxp://www.google.fr/ IE: Ajouter au fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Ajouter un site de support RSS à VAIO Information FLOW - c:\program files\Sony\VAIO Information FLOW\aiesc.html IE: Convertir en Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convertir la cible du lien en Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convertir la cible du lien en un fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convertir la sélection en Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convertir la sélection en un fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convertir les liens sélectionnés en fichier Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: Convertir les liens sélectionnés en un fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000 TCP: DhcpNameServer = 212.27.40.241 212.27.40.240 FF - ProfilePath - c:\users\sevoz\AppData\Roaming\Mozilla\Firefox\Profiles\bvzyi8uk.default\ FF - prefs.js: browser.startup.homepage - hxxp://google.fr/ FF - prefs.js: keyword.URL - hxxp://search.babylon.com/?babsrc=SP_&q={searchTerms}&mntrId=4a03a7bf0000000000000016fef47fea&tlver=1.4.35.10& FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF - Ext: TVU Web Player: firefox@tvunetworks.com - %profile%\extensions\firefox@tvunetworks.com FF - Ext: Garmin Communicator: {195A3098-0BD5-4e90-AE22-BA1C540AFD1E} - %profile%\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E} FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b} FF - Ext: Fast Search by Surf Canyon: {75623d5d-4683-402a-b610-ac4bab767c86} - %profile%\extensions\{75623d5d-4683-402a-b610-ac4bab767c86} FF - Ext: DealPly: {EB9394A3-4AD6-4918-9537-31A1FD8E8EDF} - %profile%\extensions\{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF} FF - Ext: SearchPreview: {EF522540-89F5-46b9-B6FE-1829E2B572C6} - %profile%\extensions\{EF522540-89F5-46b9-B6FE-1829E2B572C6} FF - Ext: FoxLingo: {ef62e1ce-d2a4-4cdd-b7ec-92b120366b66} - %profile%\extensions\{ef62e1ce-d2a4-4cdd-b7ec-92b120366b66} FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension user_pref(surfcanyon.inst_id,'29cf5a64ab644094'); user_pref(surfcanyon.inst_timestamp,22 10 2011 Saturday 18 51 28); user_pref(surfcanyon.partner_code,'AFA'); user_pref(surfcanyon.display_similar_product_images,true); user_pref(surfcanyon.coupons_enabled,true); user_pref(surfcanyon.price_trace_enabled,true); user_pref(foxlingo.fulllogo,false); . . ************************************************************************** Recherche de processus cachés ... . Recherche d'éléments en démarrage automatique cachés ... . Recherche de fichiers cachés ... . Scan terminé avec succès Fichiers cachés: . ************************************************************************** . ------------------------ Autres processus actifs ------------------------ . c:\program files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe c:\program files\Avira\AntiVir Desktop\avguard.exe c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe c:\program files\Avira\AntiVir Desktop\avshadow.exe c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe c:\program files\SigmaTel\C-Major Audio\WDM\STacSV.exe c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe c:\program files\Sony\VAIO Event Service\VESMgr.exe c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe c:\windows\system32\DRIVERS\xaudio.exe c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe c:\program files\Sony\VAIO Event Service\VESMgrSub.exe c:\windows\system32\WUDFHost.exe c:\program files\Sony\VAIO Power Management\SPMgr.exe c:\program files\Sony\Wireless Switch Setting Utility\Switcher.exe c:\windows\system32\conime.exe c:\program files\Windows Media Player\wmpnetwk.exe c:\windows\ehome\ehmsas.exe c:\program files\Apoint\ApMsgFwd.exe c:\program files\Apoint\Apntex.exe c:\windows\system32\wbem\unsecapp.exe c:\program files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe c:\program files\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe c:\program files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe c:\program files\Windows Media Player\wmplayer.exe c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtProc.exe c:\windows\servicing\TrustedInstaller.exe . ************************************************************************** . Heure de fin: 2011-11-02 11:13:55 - La machine a redémarré ComboFix-quarantined-files.txt 2011-11-02 10:12 ComboFix2.txt 2011-11-01 17:40 . Avant-CF: 54 126 551 040 octets libres Après-CF: 53 887 303 680 octets libres . - - End Of File - - C014C39F1655F76C1D9F9338B1C96296

voici les rapports. Merci encore. ComboFix 11-11-01.03 - sevoz 01/11/2011 18:14:13.1.2 - x86 Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6000.0.1252.33.1036.18.2046.1177 [GMT 1:00] Lancé depuis: c:\users\sevoz\Desktop\ComboFix.exe . . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . . c:\documentation\_desktop.ini c:\documentation\Documentation\_desktop.ini c:\documentation\Documentation\CS\_desktop.ini c:\documentation\Documentation\DE\_desktop.ini c:\documentation\Documentation\EN\_desktop.ini c:\documentation\Documentation\ES\_desktop.ini c:\documentation\Documentation\FI\_desktop.ini c:\documentation\Documentation\FR\_desktop.ini c:\documentation\Documentation\GR\_desktop.ini c:\documentation\Documentation\IT\_desktop.ini c:\documentation\Documentation\NL\_desktop.ini c:\documentation\Documentation\PO\_desktop.ini c:\documentation\Documentation\RU\_desktop.ini c:\documentation\Documentation\SV\_desktop.ini c:\documentation\Leaflets\_desktop.ini c:\documentation\Leaflets\CS\_desktop.ini c:\documentation\Leaflets\DE\_desktop.ini c:\documentation\Leaflets\EN\_desktop.ini c:\documentation\Leaflets\ES\_desktop.ini c:\documentation\Leaflets\FI\_desktop.ini c:\documentation\Leaflets\FR\_desktop.ini c:\documentation\Leaflets\GR\_desktop.ini c:\documentation\Leaflets\IT\_desktop.ini c:\documentation\Leaflets\NL\_desktop.ini c:\documentation\Leaflets\PO\_desktop.ini c:\documentation\Leaflets\RU\_desktop.ini c:\documentation\Leaflets\SV\_desktop.ini c:\users\sevoz\AppData\Local\Minibar c:\users\sevoz\AppData\Local\Minibar\chrome\background.html c:\users\sevoz\AppData\Local\Minibar\chrome\cached_http_request.js c:\users\sevoz\AppData\Local\Minibar\chrome\extension_info.json c:\users\sevoz\AppData\Local\Minibar\chrome\icons\icon128.png c:\users\sevoz\AppData\Local\Minibar\chrome\icons\icon19.png c:\users\sevoz\AppData\Local\Minibar\chrome\icons\icon32.png c:\users\sevoz\AppData\Local\Minibar\chrome\icons\icon48.png c:\users\sevoz\AppData\Local\Minibar\chrome\includes\content.js c:\users\sevoz\AppData\Local\Minibar\chrome\includes\content_kango.js c:\users\sevoz\AppData\Local\Minibar\chrome\includes\content_messaging.js c:\users\sevoz\AppData\Local\Minibar\chrome\includes\content_userscript.js c:\users\sevoz\AppData\Local\Minibar\chrome\kango-ui\button.js c:\users\sevoz\AppData\Local\Minibar\chrome\kango-ui\ui.js c:\users\sevoz\AppData\Local\Minibar\chrome\kango\browser.js c:\users\sevoz\AppData\Local\Minibar\chrome\kango\console.js c:\users\sevoz\AppData\Local\Minibar\chrome\kango\event_listener.js c:\users\sevoz\AppData\Local\Minibar\chrome\kango\initialize.js c:\users\sevoz\AppData\Local\Minibar\chrome\kango\io.js c:\users\sevoz\AppData\Local\Minibar\chrome\kango\jsonstorage.js c:\users\sevoz\AppData\Local\Minibar\chrome\kango\kango.js c:\users\sevoz\AppData\Local\Minibar\chrome\kango\lang.js c:\users\sevoz\AppData\Local\Minibar\chrome\kango\messaging.js c:\users\sevoz\AppData\Local\Minibar\chrome\kango\userscript_engine.js c:\users\sevoz\AppData\Local\Minibar\chrome\kango\xhr.js c:\users\sevoz\AppData\Local\Minibar\chrome\main.js c:\users\sevoz\AppData\Local\Minibar\chrome\manifest.json c:\users\sevoz\AppData\Local\Minibar\chrome\minibar\actions.js c:\users\sevoz\AppData\Local\Minibar\chrome\minibar\cachedxhr.js c:\users\sevoz\AppData\Local\Minibar\chrome\minibar\config.js c:\users\sevoz\AppData\Local\Minibar\chrome\minibar\macros.js c:\users\sevoz\AppData\Local\Minibar\chrome\minibar\minibar.js c:\users\sevoz\AppData\Local\Minibar\chrome\popup.html c:\users\sevoz\AppData\Local\Minibar\chrome\popup.js c:\users\sevoz\AppData\Local\Minibar\chrome\tab.html c:\users\sevoz\AppData\Local\Minibar\chrome\tab.js c:\users\sevoz\AppData\Local\Minibar\chrome_installer.js c:\users\sevoz\AppData\Local\Minibar\common.js c:\users\sevoz\AppData\Local\Minibar\firefox\chrome.manifest c:\users\sevoz\AppData\Local\Minibar\firefox\chrome\content\cached_http_request.js c:\users\sevoz\AppData\Local\Minibar\firefox\chrome\content\content.xul c:\users\sevoz\AppData\Local\Minibar\firefox\chrome\content\extension_info.json c:\users\sevoz\AppData\Local\Minibar\firefox\chrome\content\icons\icon128.png c:\users\sevoz\AppData\Local\Minibar\firefox\chrome\content\icons\icon19.png c:\users\sevoz\AppData\Local\Minibar\firefox\chrome\content\icons\icon32.png c:\users\sevoz\AppData\Local\Minibar\firefox\chrome\content\icons\icon48.png c:\users\sevoz\AppData\Local\Minibar\firefox\chrome\content\kango-ui\button.js c:\users\sevoz\AppData\Local\Minibar\firefox\chrome\content\kango-ui\popup.js c:\users\sevoz\AppData\Local\Minibar\firefox\chrome\content\kango-ui\popup_window.js c:\users\sevoz\AppData\Local\Minibar\firefox\chrome\content\kango-ui\popup_window.xul c:\users\sevoz\AppData\Local\Minibar\firefox\chrome\content\kango-ui\theme\bubble\bottom-left.png c:\users\sevoz\AppData\Local\Minibar\firefox\chrome\content\kango-ui\theme\bubble\bottom-middle.png c:\users\sevoz\AppData\Local\Minibar\firefox\chrome\content\kango-ui\theme\bubble\bottom-right.png c:\users\sevoz\AppData\Local\Minibar\firefox\chrome\content\kango-ui\theme\bubble\middle-left.png c:\users\sevoz\AppData\Local\Minibar\firefox\chrome\content\kango-ui\theme\bubble\middle-right.png c:\users\sevoz\AppData\Local\Minibar\firefox\chrome\content\kango-ui\theme\bubble\style.css c:\users\sevoz\AppData\Local\Minibar\firefox\chrome\content\kango-ui\theme\bubble\tail-bottom.png c:\users\sevoz\AppData\Local\Minibar\firefox\chrome\content\kango-ui\theme\bubble\tail-left.png c:\users\sevoz\AppData\Local\Minibar\firefox\chrome\content\kango-ui\theme\bubble\tail-right.png c:\users\sevoz\AppData\Local\Minibar\firefox\chrome\content\kango-ui\theme\bubble\tail-top.png c:\users\sevoz\AppData\Local\Minibar\firefox\chrome\content\kango-ui\theme\bubble\top-left.png c:\users\sevoz\AppData\Local\Minibar\firefox\chrome\content\kango-ui\theme\bubble\top-middle.png c:\users\sevoz\AppData\Local\Minibar\firefox\chrome\content\kango-ui\theme\bubble\top-right.png c:\users\sevoz\AppData\Local\Minibar\firefox\chrome\content\kango-ui\ui.js c:\users\sevoz\AppData\Local\Minibar\firefox\chrome\content\kango\browser.js c:\users\sevoz\AppData\Local\Minibar\firefox\chrome\content\kango\console.js c:\users\sevoz\AppData\Local\Minibar\firefox\chrome\content\kango\event_listener.js c:\users\sevoz\AppData\Local\Minibar\firefox\chrome\content\kango\initialize.js c:\users\sevoz\AppData\Local\Minibar\firefox\chrome\content\kango\io.js c:\users\sevoz\AppData\Local\Minibar\firefox\chrome\content\kango\jsonstorage.js c:\users\sevoz\AppData\Local\Minibar\firefox\chrome\content\kango\kango.js c:\users\sevoz\AppData\Local\Minibar\firefox\chrome\content\kango\lang.js c:\users\sevoz\AppData\Local\Minibar\firefox\chrome\content\kango\messaging.js c:\users\sevoz\AppData\Local\Minibar\firefox\chrome\content\kango\storage.js c:\users\sevoz\AppData\Local\Minibar\firefox\chrome\content\kango\uninstall_observer.js c:\users\sevoz\AppData\Local\Minibar\firefox\chrome\content\kango\userscript_engine.js c:\users\sevoz\AppData\Local\Minibar\firefox\chrome\content\kango\xhr.js c:\users\sevoz\AppData\Local\Minibar\firefox\chrome\content\main.js c:\users\sevoz\AppData\Local\Minibar\firefox\chrome\content\minibar\actions.js c:\users\sevoz\AppData\Local\Minibar\firefox\chrome\content\minibar\cachedxhr.js c:\users\sevoz\AppData\Local\Minibar\firefox\chrome\content\minibar\config.js c:\users\sevoz\AppData\Local\Minibar\firefox\chrome\content\minibar\config.json c:\users\sevoz\AppData\Local\Minibar\firefox\chrome\content\minibar\homepage_helper.js c:\users\sevoz\AppData\Local\Minibar\firefox\chrome\content\minibar\macros.js c:\users\sevoz\AppData\Local\Minibar\firefox\chrome\content\minibar\minibar.js c:\users\sevoz\AppData\Local\Minibar\firefox\chrome\content\minibar\search_helper.js c:\users\sevoz\AppData\Local\Minibar\firefox\chrome\content\minibar\search_hook.js c:\users\sevoz\AppData\Local\Minibar\firefox\chrome\content\minibar\tabpage_helper.js c:\users\sevoz\AppData\Local\Minibar\firefox\install.rdf c:\users\sevoz\AppData\Local\Minibar\firefox_installer.js c:\users\sevoz\AppData\Local\Minibar\ie_installer.js c:\users\sevoz\AppData\Local\Minibar\install.json c:\users\sevoz\AppData\Local\Minibar\minibar.crx c:\users\sevoz\AppData\Local\Minibar\minibar.xpi c:\users\sevoz\AppData\Local\Minibar\sqlite3.exe c:\users\sevoz\AppData\Local\Minibar\Uninstall.exe c:\users\sevoz\Documents\~WRL2146.tmp c:\users\sevoz\Documents\~WRL2325.tmp c:\users\sevoz\Documents\~WRL3804.tmp c:\users\sevoz\Documents\~WRL3849.tmp . . ((((((((((((((((((((((((((((((((((((((( Pilotes/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . . -------\Service_usnjsvc . . ((((((((((((((((((((((((((((( Fichiers créés du 2011-10-01 au 2011-11-01 )))))))))))))))))))))))))))))))))))) . . 2011-11-01 17:28 . 2011-11-01 17:28 56200 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{534228AF-9592-417D-BFCA-1B30720B75FB}\offreg.dll 2011-11-01 17:26 . 2011-11-01 17:32 -------- d-----w- c:\users\sevoz\AppData\Local\temp 2011-11-01 17:26 . 2011-11-01 17:26 -------- d-----w- c:\users\Default\AppData\Local\temp 2011-11-01 12:42 . 2011-11-01 12:42 512 ----a-w- C:\PhysicalDisk0_MBR.bin 2011-11-01 12:39 . 2011-11-01 13:59 -------- d-----w- C:\ZHP 2011-11-01 11:44 . 2011-11-01 13:52 -------- d-----w- c:\program files\ZHPDiag 2011-11-01 09:14 . 2011-10-07 03:48 6668624 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{534228AF-9592-417D-BFCA-1B30720B75FB}\mpengine.dll 2011-10-29 16:41 . 2011-10-29 16:41 -------- d-----w- c:\users\sevoz\AppData\Roaming\Toshiba 2011-10-22 18:54 . 2011-10-22 18:54 -------- d-----w- c:\program files\Minibar 2011-10-22 18:54 . 2011-10-22 18:55 -------- d-----w- c:\program files\FaceSmooch Smileys 2011-10-22 18:53 . 2011-10-22 18:53 -------- d-----w- c:\users\sevoz\AppData\Roaming\TuneUp Software 2011-10-22 18:52 . 2011-10-22 19:09 -------- d-----w- c:\programdata\TuneUp Software 2011-10-22 18:51 . 2011-10-22 18:51 -------- d-sh--w- c:\programdata\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16} 2011-10-22 18:49 . 2011-10-22 19:04 -------- d-----w- c:\program files\SMPlayer . . . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . . . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-10 1232896] "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2006-11-02 125440] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Apoint"="c:\program files\Apoint\Apoint.exe" [2006-09-11 118784] "VAIOCameraUtility"="c:\program files\Sony\VAIO Camera Utility\VCUServe.exe" [2006-11-14 411768] "ISBMgr.exe"="c:\program files\Sony\ISB Utility\ISBMgr.exe" [2006-11-11 43128] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-12-07 7766016] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-12-07 81920] "Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2008-10-14 623992] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2007-05-22 185784] "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-12-13 281768] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-01-19 282624] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2006-11-25 2134016] Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360] . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon] 2006-11-24 09:36 73728 ----a-w- c:\windows\System32\VESWinlogon.dll . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R3 VAIOMediaPlatform-UCLS-AppServer;VAIO Media Content Collection;c:\program files\Sony\VAIO Media Integrated Server\UCLS.exe [2007-01-10 745472] R3 VAIOMediaPlatform-UCLS-HTTP;VAIO Media Content Collection (HTTP);c:\program files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe [2007-01-08 397312] R3 VAIOMediaPlatform-UCLS-UPnP;VAIO Media Content Collection (UPnP);c:\program files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe [2007-01-08 1089536] R3 WPFFontCache_v0400;Cache de police de Windows Presentation Foundation 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504] S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2011-04-29 136360] S2 MSSQL$VAIO_VEDB;SQL Server (VAIO_VEDB);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2009-05-27 29262680] S3 R5U870FLx86;R5U870 UVC Lower Filter ;c:\windows\system32\Drivers\R5U870FLx86.sys [2006-10-27 72704] S3 R5U870FUx86;R5U870 UVC Upper Filter ;c:\windows\system32\Drivers\R5U870FUx86.sys [2006-10-27 43904] S3 SonyImgF;Sony Image Conversion Filter Driver;c:\windows\system32\DRIVERS\SonyImgF.sys [2006-09-06 30976] S3 ti21sony;ti21sony;c:\windows\system32\drivers\ti21sony.sys [2006-11-06 227328] . . Contenu du dossier 'Tâches planifiées' . 2011-11-01 c:\windows\Tasks\User_Feed_Synchronization-{749F7267-3809-4F65-A674-B375A4B1B6E4}.job - c:\windows\system32\msfeedssync.exe [2006-11-02 09:45] . . ------- Examen supplémentaire ------- . uStart Page = hxxp://www.google.fr/ IE: Ajouter au fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Ajouter un site de support RSS à VAIO Information FLOW - c:\program files\Sony\VAIO Information FLOW\aiesc.html IE: Convertir en Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convertir la cible du lien en Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convertir la cible du lien en un fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convertir la sélection en Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convertir la sélection en un fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convertir les liens sélectionnés en fichier Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: Convertir les liens sélectionnés en un fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000 FF - ProfilePath - c:\users\sevoz\AppData\Roaming\Mozilla\Firefox\Profiles\bvzyi8uk.default\ FF - prefs.js: browser.startup.homepage - hxxp://google.fr/ FF - prefs.js: keyword.URL - hxxp://search.babylon.com/?babsrc=SP_&q={searchTerms}&mntrId=4a03a7bf0000000000000016fef47fea&tlver=1.4.35.10& FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF - Ext: TVU Web Player: firefox@tvunetworks.com - %profile%\extensions\firefox@tvunetworks.com FF - Ext: Garmin Communicator: {195A3098-0BD5-4e90-AE22-BA1C540AFD1E} - %profile%\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E} FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b} FF - Ext: Fast Search by Surf Canyon: {75623d5d-4683-402a-b610-ac4bab767c86} - %profile%\extensions\{75623d5d-4683-402a-b610-ac4bab767c86} FF - Ext: DealPly: {EB9394A3-4AD6-4918-9537-31A1FD8E8EDF} - %profile%\extensions\{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF} FF - Ext: SearchPreview: {EF522540-89F5-46b9-B6FE-1829E2B572C6} - %profile%\extensions\{EF522540-89F5-46b9-B6FE-1829E2B572C6} FF - Ext: FoxLingo: {ef62e1ce-d2a4-4cdd-b7ec-92b120366b66} - %profile%\extensions\{ef62e1ce-d2a4-4cdd-b7ec-92b120366b66} FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension user_pref(surfcanyon.inst_id,'29cf5a64ab644094'); user_pref(surfcanyon.inst_timestamp,22 10 2011 Saturday 18 51 28); user_pref(surfcanyon.partner_code,'AFA'); user_pref(surfcanyon.display_similar_product_images,true); user_pref(surfcanyon.coupons_enabled,true); user_pref(surfcanyon.price_trace_enabled,true); user_pref(foxlingo.fulllogo,false); . - - - - ORPHELINS SUPPRIMES - - - - . AddRemove-HijackThis - c:\users\sevoz\Desktop\HijackThis.exe AddRemove-SMPlayer - c:\program files\SMPlayer\uninst.exe AddRemove-{7B63B2922B174135AFC0E1377DD81EC2} - c:\program files\DivX\DivXCodecUninstall.exe . . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover Rootkit scan 2011-11-01 18:32 Windows 6.0.6000 NTFS . Recherche de processus cachés ... . Recherche d'éléments en démarrage automatique cachés ... . Recherche de fichiers cachés ... . Scan terminé avec succès Fichiers cachés: 0 . ************************************************************************** . --------------------- CLES DE REGISTRE BLOQUEES --------------------- . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . ------------------------ Autres processus actifs ------------------------ . c:\program files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe c:\program files\Avira\AntiVir Desktop\avguard.exe c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe c:\program files\Avira\AntiVir Desktop\avshadow.exe c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe c:\program files\SigmaTel\C-Major Audio\WDM\STacSV.exe c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe c:\program files\Sony\VAIO Event Service\VESMgr.exe c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe c:\windows\system32\DRIVERS\xaudio.exe c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe c:\program files\Sony\VAIO Event Service\VESMgrSub.exe c:\windows\system32\WUDFHost.exe c:\program files\Sony\VAIO Power Management\SPMgr.exe c:\program files\Sony\Wireless Switch Setting Utility\Switcher.exe c:\windows\system32\conime.exe c:\program files\Windows Media Player\wmpnscfg.exe c:\windows\system32\wbem\unsecapp.exe c:\program files\Apoint\ApMsgFwd.exe c:\program files\Apoint\Apntex.exe c:\program files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe c:\program files\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe c:\program files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtProc.exe c:\windows\servicing\TrustedInstaller.exe . ************************************************************************** . Heure de fin: 2011-11-01 18:40:55 - La machine a redémarré ComboFix-quarantined-files.txt 2011-11-01 17:40 . Avant-CF: 53 671 161 856 octets libres Après-CF: 53 295 259 648 octets libres . - - End Of File - - 9C9EAA04DE032AD0D29A4FDEE7820A39 Results of screen317's Security Check version 0.99.24 Windows Vista x86 Out of date service pack!! Internet Explorer 7 Out of date! `````````````````````````````` Antivirus/Firewall Check: Avira AntiVir Personal - Free Antivirus SonicStage Mastering Studio Audio Filter Custom Preset WMI entry may not exist for antivirus; attempting automatic update. Avira successfully updated! ``````````````````````````````` Anti-malware/Other Utilities Check: Java SE Runtime Environment 6 Adobe Flash Player ( 10.1.102.64) Flash Player Out of Date! Mozilla Thunderbird (3.1.15) Thunderbird Out of Date! ```````````````````````````````` Process Check: objlist.exe by Laurent Avira Antivir avgnt.exe Avira Antivir avguard.exe ``````````End of Log````````````

Voici le rapport. pour l' instant, plus de pubs intempestives .. le nettoyage a l' air d'avoir été trés efficace ! Merci beaucoup, lance_yien ! ps: comment as-tu repéré les lignes néfastes à l' intérieur du Diag ? Rapport de ZHPFix 1.12.3366 par Nicolas Coolman, Update du 26/10/2011 Fichier d'export Registre : Run by sevoz at 01/11/2011 14:59:38 Windows Vista Home Premium Edition, 32-bit (Build 6000) Web site : ZHPFix Fix de rapport ========== Logiciel(s) ========== ABSENT Uninstall Process: c:\program files\babylontoolbar\babylontoolbar\1.4.35.10\uninstall.exe SUPPRIME O42 - Logiciel: PcTuto 1.1 - (.Agence-Exclusive.) [HKLM] -- PcTuto_is1 ABSENT Software Key: Tuto The Gimp_is1 SUPPRIME O42 - Logiciel: Complitly - (.Pas de propriétaire.) [HKLM] -- {4FFBB818-B13C-11E0-931D-B2664824019B}_is1 ABSENT Uninstall Process: c:\program files\emule\uninstall.exe ========== Processus mémoire ========== SUPPRIME Memory Process: C:\Users\sevoz\AppData\Local\Temp\insDCF3.tmp.exe ========== Module(s) mémoire ========== SUPPRIME Memory Module: C:\Users\sevoz\AppData\Local\Temp\AskSLib.dll ========== Clé(s) du Registre ========== SUPPRIME [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BabylonToolbar] SUPPRIME [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\eMule] ABSENT Key: CLSID BHO: {293A63F7-C3B6-423a-9845-901AC0A7EE6E} SUPPRIME Key: CLSID BHO: {2EECD738-5844-4a99-B4B6-146BF802613B} ABSENT Key: HKCU\Software\Agence-Exclusive SUPPRIME Key: HKCU\Software\AppDataLow\Software\PriceGong SUPPRIME Key: HKCU\Software\BabylonToolbar ABSENT Key: HKLM\Software\Agence-Exclusive SUPPRIME CLSID MPSK: {a1aa7be4-aea7-11de-8155-f8a57419c017} SUPPRIME Key: SearchScopes :{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} SUPPRIME Key: HKLM\Software\Classes\AppID\esrv.EXE ABSENT Key: HKLM\Software\Classes\AppID\PCTutoBHO.DLL SUPPRIME Key: HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Live-Player SUPPRIME Key: HKLM\Software\Classes\b SUPPRIME Key: HKLM\Software\Classes\Babylon.dskBnd SUPPRIME Key: HKLM\Software\Classes\Babylon.dskBnd.1 SUPPRIME Key: HKLM\Software\Classes\bbylnApp.appCore SUPPRIME Key: HKLM\Software\Classes\bbylnApp.appCore.1 SUPPRIME Key: HKLM\Software\Classes\escort.escortIEPane SUPPRIME Key: HKLM\Software\Classes\escort.escortIEPane.1 SUPPRIME Key: HKLM\Software\Classes\escort.escrtBtn.1 SUPPRIME Key: HKLM\Software\Classes\esrv.BabylonESrvc SUPPRIME Key: HKLM\Software\Classes\esrv.BabylonESrvc.1 ABSENT Key: HKLM\Software\Classes\PCTutoBHO.PCTBHO ABSENT Key: HKLM\Software\Classes\PCTutoBHO.PCTBHO.1 ABSENT Key: HKLM\Software\Classes\suggestmeyes.suggestmeyesbho ABSENT Key: HKLM\Software\Classes\suggestmeyes.suggestmeyesbho.1 ABSENT Key: HKLM\Software\Classes\TypeLib\{01bcb858-2f62-4f06-a8f4-48f927c15333} SUPPRIME Key: HKLM\Software\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947} ABSENT Key: HKLM\Software\Classes\TypeLib\{0BF73E27-2734-4F7B-925A-4BBB1457F5FA} ABSENT Key: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ecdf796-c2dc-4d79-a620-cce0c0a66cc9} SUPPRIME Key: HKLM\Software\Classes\CLSID\{291BCCC1-6890-484a-89D3-318C928DAC1B} SUPPRIME Key: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{293A63F7-C3B6-423A-9845-901AC0A7EE6E} ABSENT Key: HKLM\Software\Classes\CLSID\{293A63F7-C3B6-423A-9845-901AC0A7EE6E} ABSENT Key: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{293A63F7-C3B6-423A-9845-901AC0A7EE6E} ABSENT Key: HKLM\Software\Classes\CLSID\{2EECD738-5844-4a99-B4B6-146BF802613B} ABSENT Key: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2EECD738-5844-4a99-B4B6-146BF802613B} SUPPRIME Key: HKLM\Software\Classes\AppID\{35C1605E-438B-4D64-AAB1-8885F097A9B1} SUPPRIME Key: HKLM\Software\Classes\TypeLib\{35C1605E-438B-4D64-AAB1-8885F097A9B1} ABSENT Key: HKLM\Software\Classes\AppID\{442f13bc-2031-42d5-9520-437f65271153} SUPPRIME Key: HKLM\Software\Classes\Interface\{44C3C1DB-2127-433C-98EC-4C9412B5FC3A} SUPPRIME Key: HKLM\Software\Classes\Interface\{4D5132DD-BB2B-4249-B5E0-D145A8C982E1} SUPPRIME Key: HKLM\Software\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921} SUPPRIME Key: HKLM\Software\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921} SUPPRIME Key: HKLM\Software\Classes\TypeLib\{6E8BF012-2C85-4834-B10A-1B31AF173D70} SUPPRIME Key: HKLM\Software\Classes\Interface\{706D4A4B-184A-4434-B331-296B07493D2D} ABSENT Key: HKLM\Software\Classes\AppID\{759F1421-4D31-4c1f-8C51-E4956A037676} SUPPRIME Key: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8375D9C8-634F-4ECB-8CF5-C7416BA5D542} SUPPRIME Key: HKLM\Software\Classes\Interface\{8BE10F21-185F-4CA0-B789-9921674C3993} SUPPRIME Key: HKLM\Software\Classes\Interface\{94C0B25D-3359-4B10-B227-F96A77DB773F} SUPPRIME Key: HKLM\Software\Classes\CLSID\{97F2FF5B-260C-4ccf-834A-2DDA4E29E39E} ABSENT Key: HKLM\Software\Classes\CLSID\{98889811-442D-49dd-99D7-DC866BE87DBC} SUPPRIME Key: HKLM\Software\Classes\Interface\{B0B75FBA-7288-4FD3-A9EB-7EE27FA65599} SUPPRIME Key: HKLM\Software\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D} SUPPRIME Key: HKLM\Software\Classes\Interface\{B173667F-8395-4317-8DD6-45AD1FE00047} SUPPRIME Key: HKLM\Software\Classes\Interface\{B32672B3-F656-46E0-B584-FE61C0BB6037} SUPPRIME Key: HKLM\Software\Classes\CLSID\{B8276A94-891D-453C-9FF3-715C042A2575} SUPPRIME Key: HKLM\Software\Classes\AppID\{BDB69379-802F-4eaf-B541-F8DE92DD98DB} SUPPRIME Key: HKLM\Software\Classes\Interface\{BFE569F7-646C-4512-969B-9BE3E580D393} SUPPRIME Key: HKLM\Software\Classes\Interface\{C2434722-5C85-4CA0-BA69-1B67E7AB3D68} SUPPRIME Key: HKLM\Software\Classes\Interface\{C2996524-2187-441F-A398-CD6CB6B3D020} ABSENT Key: HKLM\Software\Classes\Interface\{c9ae652b-8c99-4ac2-b556-8b501182874e} SUPPRIME Key: HKLM\Software\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800} SUPPRIME Key: HKLM\Software\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800} SUPPRIME Key: HKLM\Software\Classes\Interface\{E047E227-5342-4D94-80F7-CFB154BF55BD} ABSENT Key: HKLM\Software\Classes\Interface\{E2ED56B6-35FC-4484-9530-EC87FB458E78} SUPPRIME Key: HKLM\Software\Classes\Interface\{E3F79BE9-24D4-4F4D-8C13-DF2C9899F82E} SUPPRIME Key: HKLM\Software\Classes\CLSID\{E46C8196-B634-44a1-AF6E-957C64278AB1} SUPPRIME Key: HKLM\Software\Classes\Interface\{E77EEF95-3E83-4BB8-9C0D-4A5163774997} SUPPRIME Key: HKLM\Software\Classes\CLSID\{FFB9ADCB-8C79-4C29-81D3-74D46A93D370} ABSENT Key: HKLM\Software\Google\Chrome\Extensions\defdhglnppeioeflggkmglipcecffkhk SUPPRIME Key: HKLM\Software\BabylonToolbar ABSENT Key: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\BabylonToolbar ABSENT Key: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\PcTuto_is1 ABSENT Key: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Tuto The Gimp_is1 ABSENT Key: Service: gpsvc SUPPRIME Key: HKCU\Software\Complitly SUPPRIME Key: HKCU\Software\TVANTS SUPPRIME Key: HKCU\Software\eMule ========== Valeur(s) du Registre ========== SUPPRIME Toolbar: {98889811-442D-49dd-99D7-DC866BE87DBC} ABSENT RunValue: pctuto SUPPRIME RunValue: autoupdater ABSENT [HKLM\Software\Microsoft\Windows\CurrentVersion\Run]:PCTuto SUPPRIME {889F2D3E-A7AA-4677-A92E-97D2388A5047} SUPPRIME {E11F6EDB-E77D-4557-A044-051C0331C9C1} SUPPRIME {12B036C8-9C2F-4C44-AE8A-E8A87CC13ECE} SUPPRIME {D4ED0997-A278-4697-8255-EDE6CB235C9F} SUPPRIME {4717CAC9-6FAE-4848-998E-E1E730074D31} SUPPRIME {4936A664-557B-418A-950E-840107A62681} SUPPRIME {19E494DC-CFAA-4109-A2DB-DC1A87812D64} SUPPRIME {E0780AFF-1C57-47F6-BAC2-DB97C7006D5B} SUPPRIME TCP Query User{45A05983-9065-4357-B58E-8EAEB5600001}C:/program files/emule/emule.exe SUPPRIME UDP Query User{CBBC445A-9B30-4BFD-B088-6F91B1AADFC2}C:/program files/emule/emule.exe SUPPRIME TCP Query User{281DB6C1-EFDC-4D2B-885D-5DCAA92EA544}C:/program files/emule/emule.exe SUPPRIME UDP Query User{98D7FAEF-77C2-4577-9E9A-7B0331FF5DA4}C:/program files/emule/emule.exe SUPPRIME MWPS Value: FilterAdministratorToken ========== Elément(s) de donnée du Registre ========== SUPPRIME R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page SUPPRIME R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy ========== Dossier(s) ========== SUPPRIME Folder: C:\Users\sevoz\AppData\Roaming\Mozilla\Firefox\Profiles\bvzyi8uk.default\extensions\vshare@toolbar SUPPRIME Folder: C:\Users\sevoz\AppData\Roaming\Mozilla\Firefox\Profiles\bvzyi8uk.default\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829} ABSENT C:\Program Files\Agence-Exclusive SUPPRIME Folder: C:\Program Files\BabylonToolbar ABSENT C:\Program Files\pctuto ABSENT C:\Users\sevoz\AppData\Roaming\Agence-Exclusive ABSENT C:\Users\sevoz\AppData\Local\Agence-Exclusive SUPPRIME Folder: C:\Users\sevoz\AppData\Local\live-player SUPPRIME Folder: c:\programdata\microsoft\windows\start menu\programs\pctuto SUPPRIME Folder: c:\users\sevoz\appdata\locallow\pricegong SUPPRIME Folder: C:\Program Files\Complitly ABSENT C:\Users\sevoz\AppData\Roaming\Complitly SUPPRIME Folder: C:\Program Files\eMule SUPPRIME Folder: C:\ProgramData\eMule SUPPRIME Folder: C:\Users\sevoz\AppData\Local\eMule SUPPRIME Temporaires Windows: : 633 SUPPRIME Flash Cookies: 850 ========== Fichier(s) ========== ABSENT Folder/File: c:\users\sevoz\appdata\roaming\agence-exclusive\agence-exclusive\autoupdater.exe 440] ABSENT Folder/File: c:\program files\agence-exclusive\pctuto.exe 612] SUPPRIME File: c:\program files\mozilla firefox\searchplugins\babylon.xml ABSENT File: c:\program files\agence-exclusive\pctutobho.dll SUPPRIME File: c:\program files\babylontoolbar\babylontoolbar\1.4.35.10\bh\babylontoolbar.dll SUPPRIME File: c:\program files\babylontoolbar\babylontoolbar\1.4.35.10\babylontoolbartlbr.dll ABSENT File: c:\program files\agence-exclusive\pctuto.exe ABSENT File: c:\users\sevoz\appdata\roaming\agence-exclusive\agence-exclusive\autoupdater.exe SUPPRIME File: c:\users\sevoz\appdata\local\temp\insdcf3.tmp.exe ABSENT Folder/File: c:\program files\agence-exclusive ABSENT Folder/File: c:\program files\babylontoolbar ABSENT Folder/File: c:\program files\pctuto ABSENT Folder/File: c:\users\sevoz\appdata\roaming\agence-exclusive ABSENT Folder/File: c:\users\sevoz\appdata\local\agence-exclusive ABSENT Folder/File: c:\users\sevoz\appdata\local\live-player ABSENT Folder/File: c:\users\sevoz\appdata\roaming\mozilla\firefox\profiles\bvzyi8uk.default\extensions\{8a9386b4-e958-4c4c-adf4-8f26db3e4829} SUPPRIME File: c:\users\sevoz\desktop\loto1n2 - raccourci.lnk ABSENT File: c:\program files\loto1n2\loto1n2.exe SUPPRIME File: c:\users\sevoz\desktop\incoming - raccourci.lnk SUPPRIME Reboot c:\users\sevoz\downloads\emule\incoming SUPPRIME File*: c:\users\sevoz\appdata\local\temp\askslib.dll SUPPRIME Temporaires Windows: : 2978 SUPPRIME Flash Cookies: 412 ========== Récapitulatif ========== 1 : Processus mémoire 1 : Module(s) mémoire 79 : Clé(s) du Registre 17 : Valeur(s) du Registre 2 : Elément(s) de donnée du Registre 17 : Dossier(s) 23 : Fichier(s) 5 : Logiciel(s) End of clean in 01mn 24s ========== Chemin de fichier rapport ========== C:\ZHP\ZHPFix[R1].txt - 01/11/2011 14:59:38 [11085]

Bonjour, et merci de vous occuper de mon cas ! voici le lien vers mon rapport ZHP Diag : Lien CJoint.com 3Kbn3gxK3XI

Bonjour, j' ai des fenêtres intempestives qui s' ouvrent de plus en plus fréquemment. j' ai lancé une analyse hijackthis (voir ci dessous), et il me semble détecter des lignes suspectes = -> Agence-Exclusive/PC tuto (C: , O2, O4) -> Minibar/Froggy (R3, 02, 09) -> Babylon (R0, 02, 03) -> Complitly (02) pouvez-vous m' aider, SVP ? Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 18:57:30, on 31/10/2011 Platform: Windows Vista (WinNT 6.00.1904) MSIE: Internet Explorer v7.00 (7.00.6000.17037) Boot mode: Normal Running processes: C:\Windows\system32\Dwm.exe C:\Windows\system32\taskeng.exe C:\Windows\Explorer.EXE C:\Windows\system32\taskeng.exe C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe C:\Users\sevoz\AppData\Roaming\Agence-Exclusive\Agence-Exclusive\autoupdater.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\Apoint\Apoint.exe C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe C:\Program Files\Sony\ISB Utility\ISBMgr.exe C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Avira\AntiVir Desktop\avgnt.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Apoint\ApMsgFwd.exe C:\Program Files\Agence-Exclusive\pctuto.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Windows\ehome\ehtray.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe C:\Windows\system32\wbem\unsecapp.exe C:\Program Files\Apoint\Apntex.exe C:\Windows\ehome\ehmsas.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe C:\Windows\system32\wuauclt.exe C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FAMTCDE.EXE C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtProc.exe C:\Hijackthis\HiJackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.club-vaio.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Babylon Search R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.club-vaio.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN Hotmail, Messenger, Actualité, Sport, People, Femmes - MSN France R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: FroggyBoss Class - {539F76FD-084E-4858-86D5-62F02F54AE86} - C:\Program Files\Minibar\Froggy.dll O1 - Hosts: ::1 localhost O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: PCTBHO - {293A63F7-C3B6-423a-9845-901AC0A7EE6E} - C:\Program Files\Agence-Exclusive\pctutoBHO.dll O2 - BHO: Babylon toolbar helper - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.35.10\bh\BabylonToolbar.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: MrFroggy - {856E12B5-22D7-4E22-9ACA-EA9A008DD65B} - C:\Program Files\Minibar\Froggy.dll O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Minibar BHO - {AA74D58F-ACD0-450D-A85E-6C04B171C044} - C:\Program Files\Minibar\Kango.dll O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O2 - BHO: Complitly - {D27FC31C-6E3D-4305-8D53-ACDAEFA5F862} - C:\Users\sevoz\AppData\Roaming\Complitly\Complitly.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Babylon Toolbar - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.35.10\BabylonToolbarTlbr.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe O4 - HKLM\..\Run: [VAIOCameraUtility] "C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe" O4 - HKLM\..\Run: [iSBMgr.exe] "C:\Program Files\Sony\ISB Utility\ISBMgr.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" O4 - HKLM\..\Run: [pctuto] "C:\Program Files\Agence-Exclusive\pctuto.exe" O4 - HKLM\..\RunOnce: [autoupdater] C:\Users\sevoz\AppData\Roaming\Agence-Exclusive\Agence-Exclusive\autoupdater.exe -runonce O4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [EPSON Stylus DX7400 Series] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATICDE.EXE /FU "C:\Windows\TEMP\E_S8CD4.tmp" /EF "HKCU" O4 - HKCU\..\Run: [EPSON Stylus DX7400 Series (Copie 1)] C:\Windows\system32\spool\DRIVERS\W32X86\3\1\E_FATICDE.EXE /FU "C:\Windows\TEMP\E_S2D2F.tmp" /EF "HKCU" O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU') O4 - Global Startup: Bluetooth Manager.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: Ajouter au fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Ajouter un site de support RSS à VAIO Information FLOW - C:\Program Files\Sony\VAIO Information FLOW\aiesc.html O8 - Extra context menu item: Convertir en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convertir la cible du lien en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convertir la cible du lien en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convertir la sélection en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convertir la sélection en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convertir les liens sélectionnés en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: Share Your Mood - {AAA38851-3CFF-475F-B5E0-720D3645E4A5} - C:\Program Files\Minibar\MinibarButton.dll O13 - Gopher Prefix: O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab O23 - Service: Adobe Active File Monitor V5 (AdobeActiveFileMonitor5.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing) O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AvLib\MSCSPTISRV.exe O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AvLib\PACSPTISVR.exe O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AvLib\SPTISRV.exe O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AvLib\SSScsiSV.exe O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Program Files\SigmaTel\C-Major Audio\WDM\STacSV.exe O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe O23 - Service: VAIO Media Content Collection (VAIOMediaPlatform-UCLS-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\UCLS.exe O23 - Service: VAIO Media Content Collection (HTTP) (VAIOMediaPlatform-UCLS-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe O23 - Service: VAIO Media Content Collection (UPnP) (VAIOMediaPlatform-UCLS-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe -- End of file - 12826 bytes