[Résolu]publicité intempéstive

david11 · le 19 mai 2009

Bonjour,

J'ai de la publicité intempestive sur mon PC et il est de plus en plus lent.

j'ai fait un rapport HijackThis mais je n'y connait rien , y a t'il quelqu'un pour me donner un coup de main

Merci d'avance.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 19:41, on 2009-05-19

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16827)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe

C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe

C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe

C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe

C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe

C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Fichiers communs\Symantec Shared\DJSNETCN.exe

C:\Program Files\ewido anti-spyware 4.0\guard.exe

C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe

C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Acer\Empowering Technology\eRecovery\Monitor.exe

C:\Program Files\BroadJump\Client Foundation\CFD.exe

C:\Program Files\Logitech\Video\LogiTray.exe

C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe

C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\EoRezo\EoEngine.exe

C:\Documents and Settings\david\Application Data\eoRezo\SoftwareUpdate\SoftwareUpdateHP.exe

C:\WINDOWS\System32\regsvr32.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\MSN Messenger\MsnMsgr.Exe

C:\PROGRA~1\MICROS~4\wcescomm.exe

C:\WINDOWS\system32\sistray.exe

C:\Program Files\Club-Internet\Lanceur\lanceur.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\PROGRA~1\MICROS~4\rapimgr.exe

C:\WINDOWS\system32\LVComS.exe

C:\Program Files\Club-Internet\Dr Club Internet\bin\mpbtn.exe

C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE

C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe

C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe

C:\Program Files\internet explorer\iexplore.exe

C:\Documents and Settings\david\Bureau\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.club-internet.fr

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://y.lo.st

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: mysidesearch search enhancer - {0A9B4917-75DE-DC18-8E51-6886B312543E} - C:\WINDOWS\system32\djlisorlwffvzkgf.dll

O2 - BHO: snappyads browser enhancer - {4ECEFBFE-CB17-6086-5D4E-AA5DC37A06A9} - C:\WINDOWS\system32\qqunwgsmbuvub.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: snappyads - {8caf2803-f273-e790-8f3f-91f042e44ce0} - C:\WINDOWS\system32\nsbE.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll

O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll

O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

O2 - BHO: EoBHO - {C7B76B90-3455-4AE6-A752-EAC4D19689E5} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll

O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll

O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll

O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll

O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll

O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll

O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll

O4 - HKLM\..\Run: [LaunchApp] Alaunch

O4 - HKLM\..\Run: [ntiMUI] C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe

O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC

O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName

O4 - HKLM\..\Run: [siSPower] Rundll32.exe SiSPower.dll,ModeAgent

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe

O4 - HKLM\..\Run: [bJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe

O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe

O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [symantec PIF AlertEng] "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"

O4 - HKLM\..\Run: [EoEngine] "C:\Program Files\EoRezo\EoEngine.exe"

O4 - HKLM\..\Run: [softwareHelper] C:\Documents and Settings\david\Application Data\eoRezo\SoftwareUpdate\SoftwareUpdateHP.exe

O4 - HKLM\..\Run: [jugvgxpgtow] C:\WINDOWS\System32\regsvr32.exe /s "C:\WINDOWS\system32\qqunwgsmbuvub.dll"

O4 - HKLM\..\RunServices: [DJSNetCN] C:\Program Files\Fichiers communs\Symantec Shared\DJSNETCN.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\PROGRA~1\MICROS~4\wcescomm.exe"

O4 - Startup: Club Internet.lnk = C:\Program Files\Club-Internet\Lanceur\lanceur.exe

O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe

O4 - Global Startup: Docteur Club Internet.lnk = C:\Program Files\Club-Internet\Dr Club Internet\bin\matcli.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm

O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?c26964d197b1462190f40fda78675b26

O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?c26964d197b1462190f40fda78675b26

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll

O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll

O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll

O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe

O9 - Extra button: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe (file missing)

O9 - Extra 'Tools' menuitem: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe (file missing)

O9 - Extra button: PacificPoker4 - {94EDF7B4-4272-4af3-8F8B-4E2F68E225B7} - C:\PROGRA~1\PACIFI~1\pacificpoker.exe

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://webscanner.kaspersky.fr/kavwebscan_unicode.cab

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204

O16 - DPF: {2472DCCC-68CE-49DA-AA81-E7E6D83C1DFA} (PackageHTML) - http://www.easypackhtml.com/PackageHtmlCab.CAB

O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe

O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe

O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe

O23 - Service: Symantec Licensing Detect Internet Connection (DJSNETCN) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\DJSNETCN.exe

O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe

O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE

O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe

O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe

O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe

O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe

--

End of file - 13777 bytes

Modifié le 20 mai 2009 par david11

Apollo · le 19 mai 2009

Bonsoir,

Quand tu vois le nom EoRezo dans le nom d'un site, fiche le camp, voilà ce qui arrive quand on télécharge sur ce maudit site.

OTMOVEIT 3

Télécharge OTMoveIt3 de OldTimer sur ton Bureau en cliquant sur ce lien:

OtMoveIt3

Double-clique sur OTMoveIt3.exe pour le lancer (l'extension .exe peut ne pas apparaître)

---> sous VISTA: clic droit: exécuter en temps qu'administrateur.

Vérifie que la case Unregister Dll's and OCX's.exe soit bien cochée!

Copie l'entièreté du code ci-dessous (depuis :Processes)

:Processes

explorer.exe

:Files
c:\program files\eorezo
c:\documents and settings\david\application data\eorezo
c:\windows\system32\djlisorlwffvzkgf.dll
c:\windows\system32\qqunwgsmbuvub.dll
c:\windows\system32\nsbe.dll

:Reg
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0A9B4917-75DE-DC18-8E51-6886B312543E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0A9B4917-75DE-DC18-8E51-6886B312543E}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4ECEFBFE-CB17-6086-5D4E-AA5DC37A06A9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4ECEFBFE-CB17-6086-5D4E-AA5DC37A06A9}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8caf2803-f273-e790-8f3f-91f042e44ce0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8caf2803-f273-e790-8f3f-91f042e44ce0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C7B76B90-3455-4AE6-A752-EAC4D19689E5}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C7B76B90-3455-4AE6-A752-EAC4D19689E5}]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"EoEngine"=-
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SoftwareHelper"=-



:Commands
[purity]
[emptytemp]
[start explorer]
[reboot]

Colle ce code dans la partie jaune de OtMoveIt3 intitulée:
"Paste Instructions for Items to be Moved"
Clique sur le bouton Moveit! pour lancer le nettoyage:
Copie-colle dans ta prochaine réponse tout ce qui se trouve dans la fenêtre Results
--> Un rapport sera généré dans le dossier C:\ _OTMoveIt\MovedFiles avec la date et l'heure du passage de l'outil (mmddyyyy_hhmmss.log)
Ferme OTMoveIt3 en cliquant sur Exit:

Note : Si un fichier ou un dossier ne peut être supprimé directement, l'outil peut demander un redémarrage pour terminer le processus. Clique alors sur "Yes" pour accepter.

@++

david11 · le 19 mai 2009

Voici le rapport que j'ai obtenu.

@+

========== PROCESSES ==========

Process explorer.exe killed successfully.

========== FILES ==========

Folder move failed. c:\program files\EoRezo\EoAdv scheduled to be moved on reboot.

Folder move failed. c:\program files\EoRezo scheduled to be moved on reboot.

File/Folder c:\documents and settings\david\application data\eorezo not found.

File/Folder c:\windows\system32\djlisorlwffvzkgf.dll not found.

File/Folder c:\windows\system32\qqunwgsmbuvub.dll not found.

File/Folder c:\windows\system32\nsbe.dll not found.

========== REGISTRY ==========

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0A9B4917-75DE-DC18-8E51-6886B312543E}\\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0A9B4917-75DE-DC18-8E51-6886B312543E}\\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4ECEFBFE-CB17-6086-5D4E-AA5DC37A06A9}\\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4ECEFBFE-CB17-6086-5D4E-AA5DC37A06A9}\\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8caf2803-f273-e790-8f3f-91f042e44ce0}\\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8caf2803-f273-e790-8f3f-91f042e44ce0}\\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C7B76B90-3455-4AE6-A752-EAC4D19689E5}\\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C7B76B90-3455-4AE6-A752-EAC4D19689E5}\\ not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\EoEngine not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\SoftwareHelper deleted successfully.

========== COMMANDS ==========

File delete failed. C:\DOCUME~1\david\LOCALS~1\Temp\WCESLog.log scheduled to be deleted on reboot.

User's Temp folder emptied.

User's Internet Explorer cache folder emptied.

File delete failed. C:\Documents and Settings\david\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\david\Local Settings\Temporary Internet Files\Content.IE5\Z5TP7ZXI\;net=dn4845;sz=1x1;ord=1242651421795[1].htm scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\david\Local Settings\Temporary Internet Files\Content.IE5\Z5TP7ZXI\primescratch_form_FR[1].htm scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\david\Local Settings\Temporary Internet Files\Content.IE5\TNSXVAH2\td[1].htm scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\david\Local Settings\Temporary Internet Files\Content.IE5\J0W5XU54\index1[1].htm scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\david\Local Settings\Temporary Internet Files\Content.IE5\WNBTZMVP\su-iphone-slstar[1].htm scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\david\Local Settings\Temporary Internet Files\Content.IE5\WNBTZMVP\prep_ctr[1].htm scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\david\Local Settings\Temporary Internet Files\Content.IE5\I2AOKO6F\publicite-intempestive-t163292[1].htm scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\david\Local Settings\Temporary Internet Files\Content.IE5\FX4US39C\blank[1].htm scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\david\Local Settings\Temporary Internet Files\Content.IE5\FX4US39C\404[1].htm scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\david\Local Settings\Temporary Internet Files\Content.IE5\FX4US39C\hp[1].htm scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\david\Local Settings\Temporary Internet Files\Content.IE5\FX4US39C\cultures[1].htm scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\david\Local Settings\Temporary Internet Files\Content.IE5\7ODFPHYD\ads[1].htm scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\david\Local Settings\Temporary Internet Files\Content.IE5\7ODFPHYD\ads[5].htm scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\david\Local Settings\Temporary Internet Files\Content.IE5\7ODFPHYD\loisirs[1].htm scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\david\Local Settings\Temporary Internet Files\Content.IE5\7ODFPHYD\iframe[2].htm scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\david\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.

User's Temporary Internet Files folder emptied.

Local Service Temp folder emptied.

File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.

Local Service Temporary Internet Files folder emptied.

Network Service Temp folder emptied.

Network Service Temporary Internet Files folder emptied.

Windows Temp folder emptied.

Java cache emptied.

FireFox cache emptied.

Temp folders emptied.

Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 05192009_210009

Files moved on Reboot...

c:\program files\EoRezo\EoAdv moved successfully.

c:\program files\EoRezo moved successfully.

C:\DOCUME~1\david\LOCALS~1\Temp\WCESLog.log moved successfully.

C:\Documents and Settings\david\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat moved successfully.

C:\Documents and Settings\david\Local Settings\Temporary Internet Files\Content.IE5\Z5TP7ZXI\;net=dn4845;sz=1x1;ord=1242651421795[1].htm moved successfully.

C:\Documents and Settings\david\Local Settings\Temporary Internet Files\Content.IE5\Z5TP7ZXI\primescratch_form_FR[1].htm moved successfully.

C:\Documents and Settings\david\Local Settings\Temporary Internet Files\Content.IE5\TNSXVAH2\td[1].htm moved successfully.

C:\Documents and Settings\david\Local Settings\Temporary Internet Files\Content.IE5\J0W5XU54\index1[1].htm moved successfully.

C:\Documents and Settings\david\Local Settings\Temporary Internet Files\Content.IE5\WNBTZMVP\su-iphone-slstar[1].htm moved successfully.

C:\Documents and Settings\david\Local Settings\Temporary Internet Files\Content.IE5\WNBTZMVP\prep_ctr[1].htm moved successfully.

C:\Documents and Settings\david\Local Settings\Temporary Internet Files\Content.IE5\I2AOKO6F\publicite-intempestive-t163292[1].htm moved successfully.

C:\Documents and Settings\david\Local Settings\Temporary Internet Files\Content.IE5\FX4US39C\blank[1].htm moved successfully.

C:\Documents and Settings\david\Local Settings\Temporary Internet Files\Content.IE5\FX4US39C\404[1].htm moved successfully.

C:\Documents and Settings\david\Local Settings\Temporary Internet Files\Content.IE5\FX4US39C\hp[1].htm moved successfully.

C:\Documents and Settings\david\Local Settings\Temporary Internet Files\Content.IE5\FX4US39C\cultures[1].htm moved successfully.

C:\Documents and Settings\david\Local Settings\Temporary Internet Files\Content.IE5\7ODFPHYD\ads[1].htm moved successfully.

C:\Documents and Settings\david\Local Settings\Temporary Internet Files\Content.IE5\7ODFPHYD\ads[5].htm moved successfully.

C:\Documents and Settings\david\Local Settings\Temporary Internet Files\Content.IE5\7ODFPHYD\loisirs[1].htm moved successfully.

C:\Documents and Settings\david\Local Settings\Temporary Internet Files\Content.IE5\7ODFPHYD\iframe[2].htm moved successfully.

Apollo · le 19 mai 2009

Re,

Télécharge Toolbar-S&D (Team IDN) sur ton Bureau.

Lance l'installation du programme en exécutant le fichier téléchargé.
Double-clique sur le raccourci de Toolbar-S&D.
--> Sous VISTA: clic droit Exécuter en temps qu'administrateur.
Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.
Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche.
Poste le rapport généré. (C:\TB.txt)

@++

david11 · le 19 mai 2009

Voici le rapport de toolbar S&D

-----------\\ ToolBar S&D 1.2.8 XP/Vista

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3

X86-based PC ( Multiprocessor Free : Intel® Celeron® CPU 2.80GHz )

BIOS : Phoenix - AwardBIOS v6.00PG

USER : david ( Administrator )

BOOT : Normal boot

Antivirus : Norton Internet Security 2006 (Activated)

Firewall : Norton Internet Security 2006 (Activated)

C:\ (Local Disk) - FAT32 - Total:72 Go (Free:38 Go)

D:\ (Local Disk) - FAT32 - Total:72 Go (Free:72 Go)

E:\ (CD or DVD)

F:\ (USB)

G:\ (USB)

H:\ (USB)

I:\ (USB)

"C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )

Option : [1] ( 2009-05-19|21:27 )

-----------\\ Recherche de Fichiers / Dossiers ...

C:\DOCUME~1\david\MENUDÉ~1\PROGRA~1\Adssite Games Collection

C:\DOCUME~1\david\Cookies\[email protected][2].txt

C:\DOCUME~1\david\Cookies\[email protected][1].txt

C:\DOCUME~1\david\Cookies\david@starware[2].txt

C:\DOCUME~1\david\Cookies\[email protected][4].txt

C:\DOCUME~1\david\Cookies\[email protected][1].txt

-----------\\ Extensions

(david) - {3112ca9c-de6d-4884-a869-9855de68056c} => google-toolbar

-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

"Local Page"="C:\\WINDOWS\\system32\\blank.htm"

"Start Page"="http://www.club-internet.fr"

"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"

"SearchMigratedDefaultURL"="http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]

"Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157"

"Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"'>http://go.microsoft.com/fwlink/?LinkId=54896"

"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"

"Start Page"="http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home"

--------------------\\ Recherche d'autres infections

--------------------\\ Cracks & Keygens ..

C:\DOCUME~1\david\Cookies\david@likecrack[2].txt

1 - "C:\ToolBar SD\TB_1.txt" - 2009-05-19|21:29 - Option : [1]

-----------\\ Fin du rapport a 21:29:44.70

@++

Apollo · le 19 mai 2009

Re,

Relance Toolbar-S&D en double-cliquant sur le raccourci. Tape sur "2" puis valide en appuyant sur "Entrée".

--> Sous VISTA: clic droit Exécuter en temps qu'administrateur.

Ne ferme pas la fenêtre lors de la suppression !

Un rapport sera généré, poste son contenu dans ta réponse.

NB: Si ton Bureau ne réapparaissait pas, appuie simultanément sur Ctrl+Alt+Suppr pour ouvrir le Gestionnaire des tâches.

Poste également un nouveau log Hijackthis stp.

@++

david11 · le 19 mai 2009

Voici le deuxieme rapport toolbar S&D

-----------\\ ToolBar S&D 1.2.8 XP/Vista

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3

X86-based PC ( Multiprocessor Free : Intel® Celeron® CPU 2.80GHz )

BIOS : Phoenix - AwardBIOS v6.00PG

USER : david ( Administrator )

BOOT : Normal boot

Antivirus : Norton Internet Security 2006 (Activated)

Firewall : Norton Internet Security 2006 (Activated)

C:\ (Local Disk) - FAT32 - Total:72 Go (Free:38 Go)

D:\ (Local Disk) - FAT32 - Total:72 Go (Free:72 Go)

E:\ (CD or DVD)

F:\ (USB)

G:\ (USB)

H:\ (USB)

I:\ (USB)

"C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )

Option : [2] ( 2009-05-19|21:40 )

-----------\\ SUPPRESSION

Supprime! - C:\DOCUME~1\david\MENUDÉ~1\PROGRA~1\Adssite Games Collection

Supprime! - C:\DOCUME~1\david\Cookies\[email protected][2].txt

Supprime! - C:\DOCUME~1\david\Cookies\[email protected][1].txt

Supprime! - C:\DOCUME~1\david\Cookies\david@starware[2].txt

Supprime! - C:\DOCUME~1\david\Cookies\[email protected][4].txt

Supprime! - C:\DOCUME~1\david\Cookies\[email protected][1].txt

-----------\\ Recherche de Fichiers / Dossiers ...

-----------\\ Extensions

(david) - {3112ca9c-de6d-4884-a869-9855de68056c} => google-toolbar

-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

"Local Page"="C:\\WINDOWS\\system32\\blank.htm"

"Start Page"="http://www.club-internet.fr"

"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"

"SearchMigratedDefaultURL"="http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]

"Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157"

"Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"'>http://go.microsoft.com/fwlink/?LinkId=54896"

"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"

"Start Page"="http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home"

--------------------\\ Recherche d'autres infections

--------------------\\ Cracks & Keygens ..

C:\DOCUME~1\david\Cookies\david@likecrack[2].txt

1 - "C:\ToolBar SD\TB_1.txt" - 2009-05-19|21:29 - Option : [1]

2 - "C:\ToolBar SD\TB_2.txt" - 2009-05-19|21:42 - Option : [2]

-----------\\ Fin du rapport a 21:42:20.71

Et le rapport HijachThis que tu ma demandé

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 21:46, on 2009-05-19

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16827)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe

C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe

C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe

C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe

C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe

C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Fichiers communs\Symantec Shared\DJSNETCN.exe

C:\Program Files\ewido anti-spyware 4.0\guard.exe

C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe

C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Acer\Empowering Technology\eRecovery\Monitor.exe

C:\Program Files\BroadJump\Client Foundation\CFD.exe

C:\Program Files\Logitech\Video\LogiTray.exe

C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe

C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe

C:\Program Files\QuickTime\qttask.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\MSN Messenger\MsnMsgr.Exe

C:\PROGRA~1\MICROS~4\wcescomm.exe

C:\WINDOWS\system32\sistray.exe

C:\Program Files\Club-Internet\Lanceur\lanceur.exe

C:\PROGRA~1\MICROS~4\rapimgr.exe

C:\Program Files\Club-Internet\Dr Club Internet\bin\mpbtn.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\LVComS.exe

C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE

C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe

C:\Program Files\internet explorer\iexplore.exe

C:\Documents and Settings\david\Bureau\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.club-internet.fr

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R3 - Default URLSearchHook is missing