virus de redirection de google

Bonjour !!
depuis le début de semaine je me suis rendu compte que j'ai le virus de redirection de google
j'ai regarder sur plein de forum pour m'en débarrasser mais je ne comprend pas grand chose.
quelqu'un pourrait m'aider s'il vous plait sinon je sent qu'il va passer par la fenêtre !!
merci de votre aide

Salut à toi et bienvenue,

Afin de nous éclairer sur la nature précise de tes soucis "infectieux", ( ou pas ? )
dans un premier temps fais cette procédure et poste le rapport généré par Random's system information tool (RSIT) par
random/random
Télécharge random's system information tool (RSIT) par random/random et sauvegarde-le sur le Bureau.

- Double-clique sur RSIT.exe afin de lancer RSIT.
- Clique Continue à l'écran Disclaimer.
- Si l'outil HIjackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera et tu devras accepter la licence.

- Poste le contenu de log.txt (<<qui sera affiché)
ainsi que info.txt (<<qui sera réduit dans la Barre des Tâches).

// ! Important !
=======================

Ps:
======
Conseil d'ordre général
---->> Aller sur le Net avec Windows Internet Explorer, n'est pas souhaitable.
Pour vous en convaincre, un petit test de votre navigateur

Comparez-donc Windows Internet Explorer avec Mozilla-Firefox (ce dernier devrait atteindre les 92 )
Quand à Windows Internet Explorer, j'en laisse la surprise...

Toutefois, ce qui ne veut pas dire que Windows Internet Explorer, ne doit pas être à jour ! (vérifier que vous avez la dernière version ! )

Télécharger Mozilla-Firefox 3.0. X. (le X représente évidemment la dernière version ) et le mettre à l'install comme Navigateur par défaut.

lien ici

-->source ici de conseils
Eviter à tous prix de poster dans plusieurs Forum à la fois...pas de multi-postage donc !



Poster les 2 rapports demandés (log.txt et info.txt)
En cas de fichier trop gros, suffit de le diviser sur deux réponses, ou plus.....




PS:
si tu ne peux pas télécharger en direct avec la machine infectée, il est évident qu'il faut faire usage, d'une carte SD ou clé usb via un autre PC.

j'ai les deux rapports, log.txt et info.txt
je fais du copier -coller ? parce que c'est les résultats sont très long

Salut




Pour les rapports
* rends toi sur >> cijoint.fr
* clic sur Parcourir
* trouve >> le rapport log.txt que tu viens d'enregistrer qui doit par exemple être sur ton bureau
* et valide en cliquant sur >> Cliquez ici pour déposer le Fichier
* un lien de ce genre [http://www.cijoint.fr/cjlink.php?file=cj201004/cijecaEGX.txt] te sera généré,
* il te suffit de le poster.

ensuite fais aprés de même avec le rapport >>info.txt

ou

ICI >> pjjoint.malekal

• Cliques sur >> Parcourir
• Trouve >> le rapport log.txt que tu viens d'enregistrer qui doit par exemple être sur ton bureau
• Au cas ou tu le poste en plusieurs parties ,Ok , mais >> en entier bien sur !!
• Cliques sur >> envoyer le fichier
• Un lien de ce genre te sera généré,
• il te suffit de le poster ici

• fais aprés de même avec le rapport >>info.txt

@+ VIRUS/C/C

alors le premier lien info.txt :
http://www.cijoint.fr/cjlink.php?file=cj201104/cij6u9PxPG.txt

le second log.txt :
http://www.cijoint.fr/cjlink.php?file=cj201104/cijEPktzBn.txt

Merci beaucoup

Logfile of random's system information tool 1.08 (written by random/random)
Run by Utilisateur at 2011-04-21 11:45:51
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 59 GB (78%) free of 76 GB
Total RAM: 256 MB (12% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:46:29, on 21/04/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\csrss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\system32\svchost.exe
C:\windows\system32\svchost.exe
C:\windows\system32\svchost.exe
C:\windows\system32\spoolsv.exe
C:\windows\system32\svchost.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\windows\system32\FsUsbExService.Exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
C:\windows\system32\nvsvc32.exe
C:\windows\system32\svchost.exe
C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\Xst.exe
C:\windows\Explorer.EXE
C:\windows\system32\wscntfy.exe
C:\windows\System32\alg.exe
C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe
C:\windows\system32\devldr32.exe
C:\windows\system32\hphmon05.exe
C:\windows\system32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe
C:\windows\System32\svchost.exe
C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\omliuz.exe
C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\qqr7ziy.exe
C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\ge0c3ej.exe
C:\windows\system32\HPZipm12.exe
C:\windows\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\windows\system32\rundll32.exe
C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\omliuz.exe
C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\qqr7ziy.exe
C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\ge0c3ej.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\windows\Xvikyh.exe
C:\Documents and Settings\Utilisateur\Mes documents\Téléchargements\RSIT(2).exe
C:\windows\system32\wbem\wmiprvse.exe
C:\Program Files\trend micro\Utilisateur.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fr/0SEFRFR/SAOS02
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.foozir.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: C:\windows\system32\sy9f62gb.dll - {B9B220C2-A500-99BD-F120-04B53A2C8952} - C:\windows\system32\sy9f62gb.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [HPHmon05] C:\windows\system32\hphmon05.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\windows\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe"
O4 - HKLM\..\Run: [HNUPSOXRqth] C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\omliuz.exe
O4 - HKLM\..\Run: [HNUPSOXRqld] C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\qqr7ziy.exe
O4 - HKLM\..\Run: [HNUPSOXRoKY] C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\ge0c3ej.exe
O4 - HKLM\..\Run: [HNUPSOXRsre] C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\wininst.exe
O4 - HKLM\..\Run: [HNUPSOXRrvc] C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\setup.exe
O4 - HKLM\..\Run: [Uqurb] C:\windows\taskmgr.exe
O4 - HKLM\..\Run: [HNUPSOXRotc] C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\hexdump.exe
O4 - HKLM\..\Run: [UqqZ] C:\windows\cmd.exe
O4 - HKLM\..\Run: [Uqsuc] C:\windows\lsass.exe
O4 - HKLM\..\Run: [Uqqyc] C:\windows\csrss.exe
O4 - HKLM\..\Run: [HNUPSOXRouqc] C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\iexplarer.exe
O4 - HKLM\..\Run: [HNUPSOXRnyc] C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\csrss.exe
O4 - HKLM\..\Run: [HNUPSOXRspe] C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\winamp.exe
O4 - HKLM\..\Run: [HNUPSOXRpw+] C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\nvsvc32.exe
O4 - HKLM\..\Run: [HNUPSOXRrse] C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\svchost.exe
O4 - HKLM\..\Run: [HNUPSOXRnZ] C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\cmd.exe
O4 - HKLM\..\Run: [Uqqoc] C:\windows\debug.exe
O4 - HKLM\..\Run: [HNUPSOXRrxe] C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\system.exe
O4 - HKLM\..\Run: [HNUPSOXRptc] C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\msmgm.exe
O4 - HKLM\..\Run: [HNUPSOXRnoc] C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\debug.exe
O4 - HKLM\..\Run: [Uquta] C:\windows\services.exe
O4 - HKLM\..\Run: [HNUPSOXRrwe] C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\sysmgm.exe
O4 - HKLM\..\Run: [HNUPSOXRsPc] C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\win32.exe
O4 - HKLM\..\Run: [HNUPSOXRrrb] C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\taskmgr.exe
O4 - HKLM\..\Run: [HNUPSOXRre] C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\user.exe
O4 - HKLM\..\Run: [Uqvre] C:\windows\wininst.exe
O4 - HKLM\..\Run: [HNUPSOXRota] C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\install.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [0ESKOMO9JO] C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\Xst.exe
O4 - HKCU\..\Run: [Imehuwesebe] rundll32.exe "C:\windows\kbdulf.dll",Startup
O4 - HKCU\..\Run: [HNUPSOXRqth] C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\omliuz.exe
O4 - HKCU\..\Run: [HNUPSOXRqld] C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\qqr7ziy.exe
O4 - HKCU\..\Run: [HNUPSOXRoKY] C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\ge0c3ej.exe
O4 - HKCU\..\Run: [HNUPSOXRsre] C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\wininst.exe
O4 - HKCU\..\Run: [HNUPSOXRrvc] C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\setup.exe
O4 - HKCU\..\Run: [Uqurb] C:\windows\taskmgr.exe
O4 - HKCU\..\Run: [HNUPSOXRotc] C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\hexdump.exe
O4 - HKCU\..\Run: [UqqZ] C:\windows\cmd.exe
O4 - HKCU\..\Run: [Uqsuc] C:\windows\lsass.exe
O4 - HKCU\..\Run: [Uqqyc] C:\windows\csrss.exe
O4 - HKCU\..\Run: [HNUPSOXRouqc] C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\iexplarer.exe
O4 - HKCU\..\Run: [HNUPSOXRnyc] C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\csrss.exe
O4 - HKCU\..\Run: [HNUPSOXRspe] C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\winamp.exe
O4 - HKCU\..\Run: [HNUPSOXRpw+] C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\nvsvc32.exe
O4 - HKCU\..\Run: [HNUPSOXRrse] C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\svchost.exe
O4 - HKCU\..\Run: [HNUPSOXRnZ] C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\cmd.exe
O4 - HKCU\..\Run: [Uqqoc] C:\windows\debug.exe
O4 - HKCU\..\Run: [HNUPSOXRrxe] C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\system.exe
O4 - HKCU\..\Run: [HNUPSOXRptc] C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\msmgm.exe
O4 - HKCU\..\Run: [HNUPSOXRnoc] C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\debug.exe
O4 - HKCU\..\Run: [Uquta] C:\windows\services.exe
O4 - HKCU\..\Run: [HNUPSOXRrwe] C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\sysmgm.exe
O4 - HKCU\..\Run: [HNUPSOXRsPc] C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\win32.exe
O4 - HKCU\..\Run: [HNUPSOXRrrb] C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\taskmgr.exe
O4 - HKCU\..\Run: [HNUPSOXRre] C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\user.exe
O4 - HKCU\..\Run: [Uqvre] C:\windows\wininst.exe
O4 - HKCU\..\Run: [HNUPSOXRota] C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\install.exe
O4 - HKCU\..\Run: [TBXQRHV4KR] C:\windows\Xvikyh.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: Ajouter à l'Anti-bannière - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\ie_banner_deny.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Clavier &virtuel - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll
O9 - Extra button: Analyse des &liens - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1269007287010
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} ("Ma-Config.com control) - http://fichiers.touslesdrivers.com/maconfig/MaConfig_4_2_1_1.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\windows\system32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\windows\system32\browseui.dll
O22 - SharedTaskScheduler: yshbef87w3hubdjnjksdf - {B9B220C2-A500-99BD-F120-04B53A2C8952} - C:\windows\system32\sy9f62gb.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Kaspersky Anti-Virus Service (AVP) - Kaspersky Lab ZAO - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\windows\System32\dmadmin.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\windows\system32\services.exe
O23 - Service: FsUsbExService - Teruten - C:\windows\system32\FsUsbExService.Exe
O23 - Service: Service Google Update (gupdate) (gupdate) - Unknown owner - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Ma-Config Service (maconfservice) - Unknown owner - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\windows\system32\nvsvc32.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\windows\system32\services.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\windows\system32\HPZipm12.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\windows\System32\SCardSvr.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\windows\system32\smlogsvc.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\windows\System32\vssvc.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe
O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe

--
End of file - 13220 bytes

======Scheduled tasks folder======

C:\windows\tasks\GoogleUpdateTaskMachineCore.job
C:\windows\tasks\GoogleUpdateTaskMachineUA.job
C:\windows\tasks\User_Feed_Synchronization-{2C026DAA-4642-4B66-BAE9-E09EC16136C8}.job
C:\windows\tasks\User_Feed_Synchronization-{D22B45F9-ECE1-4F78-A2F1-A202DFBE0E6D}.job
C:\windows\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job
C:\windows\tasks\{810401E2-DDE0-454e-B0E2-AA89C9E5967C}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B9B220C2-A500-99BD-F120-04B53A2C8952}]
C:\windows\system32\sy9f62gb.dll - C:\windows\system32\sy9f62gb.dll [2011-04-14 50000]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"=C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe [2010-05-14 248552]
"NvCplDaemon"=C:\windows\system32\NvCpl.dll [2006-10-22 7700480]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=C:\windows\system32\NvMcTray.dll [2006-10-22 86016]
"HPHmon05"=C:\windows\system32\hphmon05.exe [2003-08-21 483328]
"HPDJ Taskbar Utility"=C:\windows\system32\spool\drivers\w32x86\3\hpztsb09.exe [2003-07-25 188416]
"NPSStartup"= []
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2010-09-08 421888]
"AVP"=C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe [2010-11-02 365336]
"HNUPSOXRqth"=C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\omliuz.exe [2011-04-14 50000]
"HNUPSOXRqld"=C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\qqr7ziy.exe [2011-04-14 50000]
"HNUPSOXRoKY"=C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\ge0c3ej.exe [2011-04-14 50000]
"HNUPSOXRsre"=C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\wininst.exe [2011-04-14 100000]
"HNUPSOXRrvc"=C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\setup.exe [2011-04-14 100000]
"Uqurb"=C:\windows\taskmgr.exe [2011-04-14 100252]
"HNUPSOXRotc"=C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\hexdump.exe [2011-04-14 100000]
"UqqZ"=C:\windows\cmd.exe [2011-04-14 100000]
"Uqsuc"=C:\windows\lsass.exe [2011-04-14 100000]
"Uqqyc"=C:\windows\csrss.exe [2011-04-14 100000]
"HNUPSOXRouqc"=C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\iexplarer.exe [2011-04-14 100252]
"HNUPSOXRnyc"=C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\csrss.exe [2011-04-14 100000]
"HNUPSOXRspe"=C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\winamp.exe [2011-04-14 100000]
"HNUPSOXRpw+"=C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\nvsvc32.exe [2011-04-14 100000]
"HNUPSOXRrse"=C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\svchost.exe [2011-04-14 100000]
"HNUPSOXRnZ"=C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\cmd.exe [2011-04-14 100000]
"Uqqoc"=C:\windows\debug.exe [2011-04-14 100000]
"HNUPSOXRrxe"=C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\system.exe [2011-04-14 100000]
"HNUPSOXRptc"=C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\msmgm.exe [2011-04-14 100000]
"HNUPSOXRnoc"=C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\debug.exe [2011-04-14 100000]
"Uquta"=C:\windows\services.exe [2011-04-14 100000]
"HNUPSOXRrwe"=C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\sysmgm.exe [2011-04-14 100000]
"HNUPSOXRsPc"=C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\win32.exe [2011-04-14 100000]
"HNUPSOXRrrb"=C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\taskmgr.exe [2011-04-14 100252]
"HNUPSOXRre"=C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\user.exe [2011-04-14 100252]
"Uqvre"=C:\windows\wininst.exe [2011-04-14 100000]
"HNUPSOXRota"=C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\install.exe [2011-04-14 100000]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\windows\system32\ctfmon.exe [2008-04-14 15360]
"MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2008-04-13 1695232]
"0ESKOMO9JO"=C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\Xst.exe [2011-04-14 132608]
"Imehuwesebe"= C:\windows\kbdulf.dll,Startup []
"HNUPSOXRqth"=C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\omliuz.exe [2011-04-14 50000]
"HNUPSOXRqld"=C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\qqr7ziy.exe [2011-04-14 50000]
"HNUPSOXRoKY"=C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\ge0c3ej.exe [2011-04-14 50000]
"HNUPSOXRsre"=C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\wininst.exe [2011-04-14 100000]
"HNUPSOXRrvc"=C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\setup.exe [2011-04-14 100000]
"Uqurb"=C:\windows\taskmgr.exe [2011-04-14 100252]
"HNUPSOXRotc"=C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\hexdump.exe [2011-04-14 100000]
"UqqZ"=C:\windows\cmd.exe [2011-04-14 100000]
"Uqsuc"=C:\windows\lsass.exe [2011-04-14 100000]
"Uqqyc"=C:\windows\csrss.exe [2011-04-14 100000]
"HNUPSOXRouqc"=C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\iexplarer.exe [2011-04-14 100252]
"HNUPSOXRnyc"=C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\csrss.exe [2011-04-14 100000]
"HNUPSOXRspe"=C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\winamp.exe [2011-04-14 100000]
"HNUPSOXRpw+"=C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\nvsvc32.exe [2011-04-14 100000]
"HNUPSOXRrse"=C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\svchost.exe [2011-04-14 100000]
"HNUPSOXRnZ"=C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\cmd.exe [2011-04-14 100000]
"Uqqoc"=C:\windows\debug.exe [2011-04-14 100000]
"HNUPSOXRrxe"=C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\system.exe [2011-04-14 100000]
"HNUPSOXRptc"=C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\msmgm.exe [2011-04-14 100000]
"HNUPSOXRnoc"=C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\debug.exe [2011-04-14 100000]
"Uquta"=C:\windows\services.exe [2011-04-14 100000]
"HNUPSOXRrwe"=C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\sysmgm.exe [2011-04-14 100000]
"HNUPSOXRsPc"=C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\win32.exe [2011-04-14 100000]
"HNUPSOXRrrb"=C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\taskmgr.exe [2011-04-14 100252]
"HNUPSOXRre"=C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\user.exe [2011-04-14 100252]
"Uqvre"=C:\windows\wininst.exe [2011-04-14 100000]
"HNUPSOXRota"=C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\install.exe [2011-04-14 100000]
"TBXQRHV4KR"=C:\windows\Xvikyh.exe [2011-04-14 130048]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe [2003-06-25 49152]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
C:\Program Files\iTunes\iTunesHelper.exe [2010-09-24 421160]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe [2008-04-13 1695232]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
C:\Program Files\Windows Live\Messenger\msnmsgr.exe [2010-04-16 3872080]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe [2010-09-08 421888]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
C:\Program Files\Winamp\winampa.exe []

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
C:\windows\system32\klogon.dll [2010-10-05 228024]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayL oad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\windows\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\SharedTaskSched uler]
yshbef87w3hubdjnjksdf - {B9B220C2-A500-99BD-F120-04B53A2C8952} - C:\windows\system32\sy9f62gb.dll [2011-04-14 50000]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableRegistryTools"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"NoFolderOptions"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewall policy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\ma-config.com\maconfservice.exe"="C:\Program Files\ma-config.com\maconfservice.exe:LocalSubNet:Enabled:maconfservice"
"C:\Program Files\AVG\AVG10\avgmfapx.exe"="C:\Program Files\AVG\AVG10\avgmfapx.exe:*:Enabled:Programme d'installation AVG"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Service Bonjour"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\eMule\emule.exe"="C:\Program Files\eMule\emule.exe:*:Enabled:eMule"
"C:\Program Files\LimeWire\LimeWire.exe"="C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire"
"C:\Program Files\Google\Google Earth\client\googleearth.exe"="C:\Program Files\Google\Google Earth\client\googleearth.exe:*:Enabled:Google Earth"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"K:\fichier ordi\eMule\emule.exe"="K:\fichier ordi\eMule\emule.exe:*:Enabled:eMule"
"C:\Documents and Settings\Utilisateur\Mes documents\eMule\emule.exe"="C:\Documents and Settings\Utilisateur\Mes documents\eMule\emule.exe:*:Enabled:eMule"
"C:\Program Files\Samsung\Samsung New PC Studio\npsasvr.exe"="C:\Program Files\Samsung\Samsung New PC Studio\npsasvr.exe:*:Enabled:KTF MUSIC AoD Server"
"C:\Program Files\Samsung\Samsung New PC Studio\npsvsvr.exe"="C:\Program Files\Samsung\Samsung New PC Studio\npsvsvr.exe:*:Enabled:KTF MUSIC VoD Server"
"F:\fichier ordi\Skype\Phone\Skype.exe"="F:\fichier ordi\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewall policy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"

======List of files/folders created in the last 1 months======

2011-04-21 11:46:05 ----D---- C:\Program Files\trend micro
2011-04-21 11:45:51 ----D---- C:\rsit
2011-04-20 12:32:04 ----A---- C:\windows\Xvikyh.exe
2011-04-20 12:10:46 ----A---- C:\windows\Xvikyg.exe
2011-04-17 19:56:47 ----A---- C:\windows\Xvikyf.exe
2011-04-17 15:24:43 ----A---- C:\windows\Xvikye.exe
2011-04-17 15:23:16 ----A---- C:\windows\Xvikyd.exe
2011-04-17 14:01:41 ----HDC---- C:\windows\$NtUninstallKB2485663$
2011-04-17 13:34:07 ----HDC---- C:\windows\$NtUninstallKB2506223$
2011-04-17 13:05:57 ----HDC---- C:\windows\$NtUninstallKB2412687$
2011-04-17 13:04:38 ----HDC---- C:\windows\$NtUninstallKB2508272$
2011-04-17 13:02:46 ----HDC---- C:\windows\$NtUninstallKB2503658$
2011-04-17 13:00:45 ----HDC---- C:\windows\$NtUninstallKB2507618$
2011-04-17 13:00:33 ----HDC---- C:\windows\$NtUninstallKB2508429$
2011-04-17 13:00:25 ----HDC---- C:\windows\$NtUninstallKB2511455$
2011-04-17 13:00:09 ----HDC---- C:\windows\$NtUninstallKB2506212$
2011-04-17 12:59:39 ----A---- C:\windows\system32\MRT.INI
2011-04-17 12:50:57 ----HDC---- C:\windows\$NtUninstallKB2509553$
2011-04-14 20:06:35 ----A---- C:\windows\Xvikyc.exe
2011-04-14 20:04:52 ----A---- C:\windows\Xvikyb.exe
2011-04-14 18:14:28 ----A---- C:\windows\system32\gsczaiip.dll
2011-04-14 17:39:28 ----H---- C:\windows\wininst.exe
2011-04-14 17:38:53 ----H---- C:\windows\services.exe
2011-04-14 17:38:19 ----H---- C:\windows\debug.exe
2011-04-14 17:37:48 ----H---- C:\windows\lsass.exe
2011-04-14 17:37:48 ----H---- C:\windows\csrss.exe
2011-04-14 17:37:46 ----H---- C:\windows\taskmgr.exe
2011-04-14 17:37:46 ----H---- C:\windows\cmd.exe
2011-04-14 17:36:55 ----A---- C:\windows\system32\ysdm7evq.dll
2011-04-14 17:36:55 ----A---- C:\windows\system32\ticxhu.dll
2011-04-14 17:36:55 ----A---- C:\windows\system32\sy9f62gb.dll
2011-04-14 17:30:08 ----D---- C:\Documents and Settings\Utilisateur\Application Data\OfferBox
2011-04-14 17:29:42 ----D---- C:\Program Files\OfferBox
2011-04-14 17:25:55 ----A---- C:\windows\Xvikya.exe
2011-04-14 17:25:02 ----A---- C:\windows\system32\sshnas21.dll
2011-04-10 19:39:33 ----D---- C:\Documents and Settings\Utilisateur\Application Data\Skype
2011-03-24 21:07:58 ----HDC---- C:\windows\$NtUninstallKB2524375$

======List of files/folders modified in the last 1 months======

2011-04-21 11:46:13 ----D---- C:\windows\Temp
2011-04-21 11:46:05 ----D---- C:\Program Files
2011-04-21 11:44:22 ----SD---- C:\windows\Tasks
2011-04-21 11:43:52 ----SHD---- C:\System Volume Information
2011-04-21 11:38:18 ----D---- C:\Program Files\Mozilla Firefox
2011-04-21 11:08:53 ----D---- C:\windows\system32\Restore
2011-04-21 11:07:20 ----D---- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2011-04-20 19:51:39 ----A---- C:\windows\SchedLgU.Txt
2011-04-20 13:03:52 ----D---- C:\windows\Prefetch
2011-04-20 12:32:04 ----D---- C:\WINDOWS
2011-04-19 21:27:36 ----D---- C:\windows\system32
2011-04-19 14:53:05 ----D---- C:\windows\system32\CatRoot2
2011-04-17 23:36:21 ----D---- C:\windows\system32\CatRoot
2011-04-17 22:24:31 ----SHD---- C:\windows\Installer
2011-04-17 15:21:04 ----D---- C:\windows\system32\Samsung_USB_Drivers
2011-04-17 14:00:07 ----HD---- C:\windows\inf
2011-04-17 13:59:05 ----HD---- C:\windows\$hf_mig$
2011-04-17 13:47:48 ----D---- C:\windows\system32\drivers
2011-04-17 13:37:22 ----A---- C:\windows\imsins.BAK
2011-04-17 13:34:51 ----RSHDC---- C:\windows\system32\dllcache
2011-04-17 13:23:21 ----D---- C:\Program Files\Internet Explorer
2011-04-17 13:14:55 ----D---- C:\windows\ie8updates
2011-04-17 13:05:59 ----D---- C:\windows\WinSxS
2011-04-17 12:54:37 ----A---- C:\windows\system32\MRT.exe
2011-04-12 22:20:58 ----D---- C:\Program Files\Windows Live
2011-03-27 15:49:31 ----A---- C:\windows\system32\PerfStringBackup.INI

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 KL1;kl1; C:\windows\system32\DRIVERS\kl1.sys [2010-06-09 132184]
R0 uagp35;Filtre AGP version 3.5 Microsoft; C:\windows\system32\DRIVERS\uagp35.sys [2008-04-13 44672]
R0 viamraid;viamraid; C:\windows\system32\DRIVERS\viamraid.sys [2010-09-10 117248]
R0 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\windows\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
R1 AFS2K;AFS2k; C:\windows\system32\drivers\AFS2K.sys [2010-10-02 82380]
R1 AmdK7;Pilote de processeur AMD K7; C:\windows\System32\drivers\amdk7.sys [2010-09-10 41856]
R1 kl2;kl2; C:\windows\system32\DRIVERS\kl2.sys [2010-06-09 11352]
R1 KLIF;Kaspersky Lab Driver; C:\windows\system32\DRIVERS\klif.sys [2011-01-15 475736]
R2 mdmxsdk;mdmxsdk; C:\windows\system32\DRIVERS\mdmxsdk.sys [2008-04-13 11868]
R3 ctljystk;Creative SBLive! Port de jeux; C:\windows\system32\DRIVERS\ctljystk.sys [2001-08-17 3712]
R3 emu10k;Creative SB Live! (WDM); C:\windows\system32\drivers\emu10k1m.sys [2001-08-17 283904]
R3 emu10k1;Pilote du Gestionnaire d'interface Creative (WDM); C:\windows\system32\drivers\ctlfacem.sys [2001-08-17 6912]
R3 FETNDIS;Pilote NT de carte VIA PCI 10/100Mo Fast Ethernet; C:\windows\system32\DRIVERS\fetnd5.sys [2001-08-17 27165]
R3 FsUsbExDisk;FsUsbExDisk; \??\C:\windows\system32\FsUsbExDisk.SYS []
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\windows\system32\DRIVERS\GEARAspiWDM.sys [2009-05-18 26600]
R3 HSF_DP;HSF_DP; C:\windows\system32\DRIVERS\HSFDPSP2.sys [2008-04-13 1041536]
R3 HSFHWBS2;HSFHWBS2; C:\windows\system32\DRIVERS\HSFBS2S2.sys [2008-04-13 220032]
R3 klim5;Kaspersky Anti-Virus NDIS Filter; C:\windows\system32\DRIVERS\klim5.sys [2010-05-07 32856]
R3 klmouflt;Kaspersky Lab KLMOUFLT; C:\windows\system32\DRIVERS\klmouflt.sys [2009-11-02 19472]
R3 nv;nv; C:\windows\system32\DRIVERS\nv4_mini.sys [2006-10-22 3994624]
R3 sfman;Pilote du Gestionnaire SoundFont Creative (WDM); C:\windows\system32\drivers\sfmanm.sys [2001-08-17 36480]
R3 USBSTOR;Pilote de stockage de masse USB; C:\windows\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
R3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; C:\windows\system32\DRIVERS\usbuhci.sys [2008-04-14 20608]
R3 winachsf;winachsf; C:\windows\system32\DRIVERS\HSFCXTS2.sys [2008-04-13 685056]
S3 driverhardwarev2;driverhardwarev2; \??\C:\Program Files\ma-config.com\Drivers\driverhardwarev2.sys []
S3 HidUsb;Pilote de classe HID Microsoft; C:\windows\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\windows\system32\DRIVERS\HPZid412.sys [2003-05-14 51056]
S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\windows\system32\DRIVERS\HPZipr12.sys [2003-05-14 16496]
S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\windows\system32\DRIVERS\HPZius12.sys [2003-05-14 21488]
S3 mouhid;Pilote HID de souris; C:\windows\system32\DRIVERS\mouhid.sys [2001-08-23 12288]
S3 ms_mpu401;Pilote UART MIDI MPU-401 Microsoft; C:\windows\system32\drivers\msmpu401.sys [2001-08-18 2944]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\windows\system32\DRIVERS\pccsmcfd.sys [2007-09-17 21632]
S3 USBAAPL;Apple Mobile USB Driver; C:\windows\System32\Drivers\usbaapl.sys [2010-04-19 41984]
S3 usbccgp;Pilote parent générique USB Microsoft; C:\windows\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbprint;Classe d'imprimantes USB Microsoft; C:\windows\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;Pilote de scanneur USB; C:\windows\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 WpdUsb;WpdUsb; C:\windows\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\windows\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 P3;Pilote processeur Intel Pentium III; C:\windows\system32\DRIVERS\p3.sys [2008-04-14 46848]
S4 rtl8139;Pilote NT de carte Realtek PCI Fast Ethernet à base RTL8139(A/B/C); C:\windows\system32\DRIVERS\RTL8139.SYS [2008-04-13 20992]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe [2010-08-13 144672]
R2 AVP;Kaspersky Anti-Virus Service; C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe [2010-11-02 365336]
R2 Bonjour Service;Service Bonjour; C:\Program Files\Bonjour\mDNSResponder.exe [2010-07-27 345376]
R2 FsUsbExService;FsUsbExService; C:\windows\system32\FsUsbExService.Exe [2009-04-07 233472]
R2 iucqncau;PCCS Mode Change Filter Helper; C:\windows\System32\svchost.exe [2008-04-14 14336]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2010-09-15 153376]
R2 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0; C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe [2009-07-20 935208]
R2 NVSvc;NVIDIA Display Driver Service; C:\windows\system32\nvsvc32.exe [2006-10-22 159810]
R2 SSHNAS;SSHNAS; C:\windows\system32\svchost.exe [2008-04-14 14336]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\windows\system32\svchost.exe [2008-04-14 14336]
R3 Pml Driver HPZ12;Pml Driver HPZ12; C:\windows\system32\HPZipm12.exe [2003-05-14 65795]
S2 gupdate;Service Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2010-12-01 136176]
S3 iPod Service;Service de l’iPod; C:\Program Files\iPod\bin\iPodService.exe [2010-09-24 820008]
S3 maconfservice;Ma-Config Service; C:\Program Files\ma-config.com\maconfservice.exe [2010-08-13 259440]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2008-04-07 430592]
S3 WMPNetworkSvc;Service Partage réseau du Lecteur Windows Media; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-11-03 918016]

-----------------EOF-----------------

re,
effectivement pas mal d'infections visibles dans cette machine
attention toutefois tu as écris ceci:

un petit rappel ici

Si nous sommes d'accord fais ceci:

Fais ceci,

* Désactive ton Antivirus pour le moment.
* Télécharge Ad-Remover (de C_XX) sur le bureau.

* /!\ Déconnecte-toi et ferme toutes les applications en cours /!\
* Double clic sur le programme pour le lancer...
* Pour Vista et Seven toujours faire un clic droit, et choisir lancer comme administrateur
* Au menu principal choisis l'option "Scanner"

* /!\ Laisse travailler l'outil /!\
* Patiente jusqu'à la fin du scan sans rien faire d'autre sur ton PC.
* Un rapport apparaitra à la fin, poste le sur le forum dans ta réponse.
Si tu ne trouve pas !
(Le rapport est aussi sauvegardé sous C:\Ad-Report-SCAN.log)

============================================

ensuite passes à ceci:

Passons à la suppression:
-----------------------------------------------------------
* Double clic sur le programme Ad-Remover pour le lancer...
* Pour Vista et Seven toujours faire un clic droit, et choisir lancer comme administrateur
* Au menu principal choisis l'option "Nettoyer"

* /!\ Laisse travailler l'outil /!\
* Patiente jusqu'à la fin du scan sans rien faire d'autre sur ton PC.

* Un rapport apparaitra à la fin, poste le sur le forum dans ta réponse.
Si tu ne trouve pas !
(Le rapport est aussi sauvegardé sous C:\Ad-Report-SCAN.log)

j'ai uniquement regardé sur les autres forum, j'ai poster que sur celui ci.

Hop le lien :
http://www.cijoint.fr/cjlink.php?file=cj201104/cijlm9CA9a.txt

======= RAPPORT D'AD-REMOVER 2.0.0.2,G | UNIQUEMENT XP/VISTA/7 =======

Mis à jour par TeamXscript le 12/04/11
Contact: AdRemover[DOT]contact[AT]gmail[DOT]com
Site web: http://www.teamxscript.org

C:\Program Files\Ad-Remover\main.exe (SCAN [1]) -> Lancé à 15:53:38 le 21/04/2011, Mode normal

Microsoft Windows XP Édition familiale Service Pack 3 (X86)
Utilisateur@ORDINATE-70A523 ( )

============== RECHERCHE ==============


Fichier trouvé: C:\Documents and Settings\Utilisateur\Application Data\Mozilla\FireFox\Profiles\29g1uc7e.default\searchplugins\askcom.xml
Dossier trouvé: C:\Program Files\Ask.com
Dossier trouvé: C:\Documents and Settings\Utilisateur\Application Data\OfferBox
Dossier trouvé: C:\Program Files\OfferBox

Clé trouvée: HKLM\Software\Classes\CLSID\{A7E8C343-7860-4A95-9AA8-AAF30D0F6D1E}
Clé trouvée: HKLM\Software\Classes\CLSID\{FC0D62C2-9640-4AEB-A5D5-CF25DF11FA8C}
Clé trouvée: HKLM\Software\Classes\Interface\{6612AFDD-34AD-4B89-A236-7E6D07C3FDCD}
Clé trouvée: HKLM\Software\Classes\TypeLib\{ED85AEBE-F834-4088-B5D3-97EB2478A6CD}
Clé trouvée: HKLM\Software\Classes\OfferBox.OfferBoxServer
Clé trouvée: HKLM\Software\Classes\OfferBox.OfferBoxServer.1
Clé trouvée: HKLM\Software\OfferBox
Clé trouvée: HKCU\Software\OfferBox
Clé trouvée: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{37F4A335-D085-423e-A425-0370799166FB}
Clé trouvée: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\OfferBox Browser
Clé trouvée: HKLM\Software\Google\Chrome\Extensions\bjeikeheijdjdfjbmknpefojickbkmom

Valeur trouvée: HKLM\Software\Mozilla\Firefox\Extensions|offerboxffx@offerbox.com


============== SCAN ADDITIONNEL ==============

**** Mozilla Firefox Version [3.5.3 (fr)] ****

Components\aboutCertError.js
Components\aboutPrivateBrowsing.js
Components\aboutRights.js
Components\aboutRobots.js
Components\aboutSessionRestore.js
Components\nsPostUpdateWin.js
HKLM_Extensions|offerboxffx@offerbox.com - C:\Program Files\OfferBox\offerboxffx@offerbox.com

-- C:\Documents and Settings\Utilisateur\Application Data\Mozilla\FireFox\Profiles\29g1uc7e.default --
Searchplugins\askcom.xml (?)
User.js - keyword.URL, hxxp://redirecterror.sfr.fr/?q=
Prefs.js - browser.download.lastDir, C:\\Documents and Settings\\Margaux\\Mes documents\\Mes images
Prefs.js - browser.startup.homepage, hxxp://www.foozir.com/
Prefs.js - browser.startup.homepage_override.mstone, rv:1.9.1.18
Prefs.js - keyword.URL, hxxp://redirecterror.sfr.fr/?q=

========================================

**** Internet Explorer Version [8.0.6001.18702] ****

HKCU_Main|Search bar - hxxp://g.msn.fr/0SEFRFR/SAOS02
HKCU_Main|Search Page - hxxp://home.microsoft.com/access/allinone.asp
HKCU_Main|Start Page - hxxp://www.google.fr/
HKLM_Main|Default_Page_URL - hxxp://go.microsoft.com/fwlink/?LinkId=69157
HKLM_Main|Default_Search_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM_Main|Search Page - hxxp://go.microsoft.com/fwlink/?LinkId=54896
HKLM_Main|Start Page - hxxp://www.foozir.com/
HKCU_SearchScopes\{EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C} - "?" (?)
HKLM_ElevationPolicy\{37F4A335-D085-423e-A425-0370799166FB} - C:\Program Files\OfferBox\OfferBox.exe (Secure Digital Services Limited)
HKLM_ElevationPolicy\{B2321D2F-1154-4d97-AD3E-2FE0BAE2897B} - C:\Program Files\SFR\Kit\9launch.exe (SFR)
HKLM_Extensions\{DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - "?" (?)
HKLM_Extensions\{e2e2dd38-d088-4134-82b7-f2ba38496583} - "?" (?)
BHO\{B9B220C2-A500-99BD-F120-04B53A2C8952} - "C:\windows\system32\sy9f62gb.dll" (C:\windows\system32\sy9f62gb.dll)

========================================

C:\Program Files\Ad-Remover\Quarantine: 0 Fichier(s)
C:\Program Files\Ad-Remover\Backup: 1 Fichier(s)

C:\Ad-Report-SCAN[1].txt - 21/04/2011 15:54:54 (3789 Octet(s))

Fin à: 15:59:07, 21/04/2011

============== E.O.F ==============

Et voila le rapport après supression :
http://www.cijoint.fr/cjlink.php?file=cj201104/cij4FqM1IV.txt

======= RAPPORT D'AD-REMOVER 2.0.0.2,G | UNIQUEMENT XP/VISTA/7 =======

Mis à jour par TeamXscript le 12/04/11
Contact: AdRemover[DOT]contact[AT]gmail[DOT]com
Site web: http://www.teamxscript.org

C:\Program Files\Ad-Remover\main.exe (CLEAN [2]) -> Lancé à 16:55:40 le 21/04/2011, Mode normal

Microsoft Windows XP Édition familiale Service Pack 3 (X86)
Utilisateur@ORDINATE-70A523 ( )

============== ACTION(S) ==============



(!) -- Fichiers temporaires supprimés.




============== SCAN ADDITIONNEL ==============

**** Mozilla Firefox Version [3.5.3 (fr)] ****

Components\aboutCertError.js
Components\aboutPrivateBrowsing.js
Components\aboutRights.js
Components\aboutRobots.js
Components\aboutSessionRestore.js
Components\nsPostUpdateWin.js

-- C:\Documents and Settings\Utilisateur\Application Data\Mozilla\FireFox\Profiles\29g1uc7e.default --
User.js - keyword.URL, hxxp://redirecterror.sfr.fr/?q=
Prefs.js - browser.download.lastDir, C:\\Documents and Settings\\Margaux\\Mes documents\\Mes images
Prefs.js - browser.startup.homepage, hxxp://www.foozir.com/
Prefs.js - browser.startup.homepage_override.mstone, rv:1.9.1.18
Prefs.js - keyword.URL, hxxp://redirecterror.sfr.fr/?q=

========================================

**** Internet Explorer Version [8.0.6001.18702] ****

HKCU_Main|Default_Page_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKCU_Main|Default_Search_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU_Main|Search bar - hxxp://go.microsoft.com/fwlink/?linkid=54896
HKCU_Main|Start Page - hxxp://fr.msn.com/
HKLM_Main|Default_Page_URL - hxxp://go.microsoft.com/fwlink/?LinkId=54896
HKLM_Main|Default_Search_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM_Main|Search bar - hxxp://search.msn.com/spbasic.htm
HKLM_Main|Search Page - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM_Main|Start Page - hxxp://fr.msn.com/
HKCU_SearchScopes\{EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C} - "?" (?)
HKLM_ElevationPolicy\{B2321D2F-1154-4d97-AD3E-2FE0BAE2897B} - C:\Program Files\SFR\Kit\9launch.exe (SFR)
HKLM_Extensions\{DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - "?" (?)
HKLM_Extensions\{e2e2dd38-d088-4134-82b7-f2ba38496583} - "?" (?)
BHO\{B9B220C2-A500-99BD-F120-04B53A2C8952} - "C:\windows\system32\sy9f62gb.dll" (C:\windows\system32\sy9f62gb.dll)

========================================

C:\Program Files\Ad-Remover\Quarantine: 19 Fichier(s)
C:\Program Files\Ad-Remover\Backup: 15 Fichier(s)

C:\Ad-Report-CLEAN[1].txt - 21/04/2011 16:31:01 (4008 Octet(s))
C:\Ad-Report-CLEAN[2].txt - 21/04/2011 16:56:00 (2626 Octet(s))
C:\Ad-Report-SCAN[1].txt - 21/04/2011 15:54:54 (3927 Octet(s))

Fin à: 17:03:15, 21/04/2011

============== E.O.F ==============

re,

Ensuite fais ceci:
Télécharge Malwarebytes' Anti-Malware (MBAM)

[*] Double clique sur le fichier téléchargé pour lancer le processus d'installation.
[*] Dans l'onglet "Mise à jour", clique sur le bouton "Recherche de mise à jour": si le pare-feu demande l'autorisation à MBAM de se connecter, accepte.
[*] Une fois la mise à jour terminée, rends-toi dans l'onglet "Recherche".
[*] Sélectionne "Exécuter un examen rapide"
[*] Clique sur "Rechercher"
[*] L'analyse démarre, le scan est relativement long, c'est normal.
[*] A la fin de l'analyse, un message s'affiche :


Citation

L'examen s'est terminé normalement. Clique sur 'Afficher les résultats' pour afficher tous les objets trouvés.


Clique sur "Ok" pour poursuivre. Si MBAM n'a rien trouvé, il te le dira aussi.
[*] Ferme tes navigateurs.
[*] Si des malwares ont été détectés, clique sur Afficher les résultats.
Sélectionne tout (ou laisse coché) et clique sur Supprimer la sélection, MBAM va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.
[*] MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Copie-colle ce rapport et poste-le dans ta prochaine réponse.

ps:
--->aide visuelle sur Mbam ici


met le rapport en clair

Voila le petit rapport

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Version de la base de données: 6415

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

21/04/2011 22:17:39
mbam-log-2011-04-21 (22-17-39).txt

Type d'examen: Examen rapide
Elément(s) analysé(s): 173482
Temps écoulé: 59 minute(s), 50 seconde(s)

Processus mémoire infecté(s): 1
Module(s) mémoire infecté(s): 3
Clé(s) du Registre infectée(s): 9
Valeur(s) du Registre infectée(s): 61
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 52

Processus mémoire infecté(s):
c:\WINDOWS\Xvikyh.exe (Trojan.Downloader) -> 2044 -> Unloaded process successfully.

Module(s) mémoire infecté(s):
c:\WINDOWS\system32\sshnas21.dll (Trojan.Downloader) -> Delete on reboot.
c:\WINDOWS\system32\sy9f62gb.dll (Spyware.Agent) -> Delete on reboot.
c:\WINDOWS\kbdulf.dll (Trojan.Hiloti) -> Delete on reboot.

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\CLSID\{B9B220C2-A500-99BD-F120-04B53A2C8952} (Spyware.Agent) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B9B220C2-A500-99BD-F120-04B53A2C8952} (Spyware.Agent) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{B9B220C2-A500-99BD-F120-04B53A2C8952} (Spyware.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SETUP.EXE (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\INSTALL.EXE (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\0ESKOMO9JO (Trojan.FakeAlert.SA) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\TBXQRHV4KR (Trojan.FakeAlert.SA) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ (Hijack.Zones) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SSHNAS (Trojan.Renos) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0ESKOMO9JO (Trojan.Downloader) -> Value: 0ESKOMO9JO -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskSched uler\{B9B220C2-A500-99BD-F120-04B53A2C8952} (Spyware.Agent) -> Value: {B9B220C2-A500-99BD-F120-04B53A2C8952} -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Imehuwesebe (Trojan.Hiloti) -> Value: Imehuwesebe -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HNUPSOXRqth (Malware.Packer.Gen) -> Value: HNUPSOXRqth -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HNUPSOXRqth (Malware.Packer.Gen) -> Value: HNUPSOXRqth -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HNUPSOXRqld (Malware.Packer.Gen) -> Value: HNUPSOXRqld -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HNUPSOXRqld (Malware.Packer.Gen) -> Value: HNUPSOXRqld -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HNUPSOXRoKY (Malware.Packer.Gen) -> Value: HNUPSOXRoKY -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HNUPSOXRoKY (Malware.Packer.Gen) -> Value: HNUPSOXRoKY -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TBXQRHV4KR (Trojan.Downloader) -> Value: TBXQRHV4KR -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HNUPSOXRsre (Malware.Packer.Gen) -> Value: HNUPSOXRsre -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HNUPSOXRsre (Malware.Packer.Gen) -> Value: HNUPSOXRsre -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HNUPSOXRrvc (Malware.Packer.Gen) -> Value: HNUPSOXRrvc -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HNUPSOXRrvc (Malware.Packer.Gen) -> Value: HNUPSOXRrvc -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Uqurb (Malware.Packer.Gen) -> Value: Uqurb -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Uqurb (Malware.Packer.Gen) -> Value: Uqurb -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HNUPSOXRotc (Malware.Packer.Gen) -> Value: HNUPSOXRotc -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HNUPSOXRotc (Malware.Packer.Gen) -> Value: HNUPSOXRotc -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UqqZ (Malware.Packer.Gen) -> Value: UqqZ -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UqqZ (Malware.Packer.Gen) -> Value: UqqZ -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Uqsuc (Malware.Packer.Gen) -> Value: Uqsuc -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Uqsuc (Malware.Packer.Gen) -> Value: Uqsuc -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Uqqyc (Malware.Packer.Gen) -> Value: Uqqyc -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Uqqyc (Malware.Packer.Gen) -> Value: Uqqyc -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HNUPSOXRouqc (Malware.Packer.Gen) -> Value: HNUPSOXRouqc -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HNUPSOXRouqc (Malware.Packer.Gen) -> Value: HNUPSOXRouqc -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HNUPSOXRspe (Malware.Packer.Gen) -> Value: HNUPSOXRspe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HNUPSOXRspe (Malware.Packer.Gen) -> Value: HNUPSOXRspe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HNUPSOXRpw+ (Malware.Packer.Gen) -> Value: HNUPSOXRpw+ -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HNUPSOXRpw+ (Malware.Packer.Gen) -> Value: HNUPSOXRpw+ -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HNUPSOXRrse (Malware.Packer.Gen) -> Value: HNUPSOXRrse -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HNUPSOXRrse (Malware.Packer.Gen) -> Value: HNUPSOXRrse -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Uqqoc (Malware.Packer.Gen) -> Value: Uqqoc -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Uqqoc (Malware.Packer.Gen) -> Value: Uqqoc -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HNUPSOXRrxe (Malware.Packer.Gen) -> Value: HNUPSOXRrxe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HNUPSOXRrxe (Malware.Packer.Gen) -> Value: HNUPSOXRrxe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HNUPSOXRptc (Malware.Packer.Gen) -> Value: HNUPSOXRptc -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HNUPSOXRptc (Malware.Packer.Gen) -> Value: HNUPSOXRptc -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Uquta (Malware.Packer.Gen) -> Value: Uquta -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Uquta (Malware.Packer.Gen) -> Value: Uquta -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HNUPSOXRrwe (Malware.Packer.Gen) -> Value: HNUPSOXRrwe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HNUPSOXRrwe (Malware.Packer.Gen) -> Value: HNUPSOXRrwe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HNUPSOXRsPc (Malware.Packer.Gen) -> Value: HNUPSOXRsPc -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HNUPSOXRsPc (Malware.Packer.Gen) -> Value: HNUPSOXRsPc -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HNUPSOXRrrb (Malware.Packer.Gen) -> Value: HNUPSOXRrrb -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HNUPSOXRrrb (Malware.Packer.Gen) -> Value: HNUPSOXRrrb -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HNUPSOXRre (Malware.Packer.Gen) -> Value: HNUPSOXRre -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HNUPSOXRre (Malware.Packer.Gen) -> Value: HNUPSOXRre -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Uqvre (Malware.Packer.Gen) -> Value: Uqvre -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Uqvre (Malware.Packer.Gen) -> Value: Uqvre -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HNUPSOXRota (Malware.Packer.Gen) -> Value: HNUPSOXRota -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HNUPSOXRota (Malware.Packer.Gen) -> Value: HNUPSOXRota -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\WINID (Malware.Trace) -> Value: WINID -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\idstrf (Malware.Trace) -> Value: idstrf -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolde rOptions (Hijack.FolderOptions) -> Value: NoFolderOptions -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HNUPSOXRnyc (Trojan.Agent) -> Value: HNUPSOXRnyc -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HNUPSOXRnZ (Trojan.Downloader.Gen) -> Value: HNUPSOXRnZ -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HNUPSOXRnoc (Trojan.Downloader.Gen) -> Value: HNUPSOXRnoc -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HNUPSOXRnyc (Trojan.Agent) -> Value: HNUPSOXRnyc -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HNUPSOXRnZ (Trojan.Downloader.Gen) -> Value: HNUPSOXRnZ -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HNUPSOXRnoc (Trojan.Downloader.Gen) -> Value: HNUPSOXRnoc -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRe gistryTools (PUM.Hijack.Regedit) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
c:\WINDOWS\system32\sshnas21.dll (Trojan.Downloader) -> Delete on reboot.
c:\Documents and Settings\Utilisateur\Local Settings\Temp\Xst.exe (Trojan.Downloader) -> Delete on reboot.
c:\WINDOWS\system32\sy9f62gb.dll (Spyware.Agent) -> Delete on reboot.
c:\WINDOWS\kbdulf.dll (Trojan.Hiloti) -> Delete on reboot.
c:\Documents and Settings\Utilisateur\Local Settings\Temp\omliuz.exe (Malware.Packer.Gen) -> Delete on reboot.
c:\Documents and Settings\Utilisateur\Local Settings\Temp\qqr7ziy.exe (Malware.Packer.Gen) -> Delete on reboot.
c:\Documents and Settings\Utilisateur\Local Settings\Temp\ge0c3ej.exe (Malware.Packer.Gen) -> Delete on reboot.
c:\WINDOWS\Xvikyh.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\Temp\wininst.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\Temp\setup.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
c:\WINDOWS\taskmgr.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\Temp\hexdump.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
c:\WINDOWS\cmd.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
c:\WINDOWS\lsass.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
c:\WINDOWS\csrss.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\Temp\iexplarer.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\Temp\winamp.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\Temp\nvsvc32.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\Temp\svchost.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
c:\WINDOWS\debug.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\Temp\system.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\Temp\msmgm.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
c:\WINDOWS\services.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\Temp\sysmgm.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\Temp\win32.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\Temp\taskmgr.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\Temp\user.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
c:\WINDOWS\wininst.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\Temp\install.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\ticxhu.dll (Spyware.Agent) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\ysdm7evq.dll (Spyware.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\Temp\osnmaerwxc.tmp (Adware.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\Temp\rcnxasoewm.tmp (Trojan.Hiloti) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\Temp\sshnas21.dll (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\Temp\Xsu.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\Temp\uw9yloljxi4p.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\Temp\Xsp.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\Temp\Xsq.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\Temp\Xsr.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\Temp\Xss.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\Temp\ivfm49uhuiild31.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\Temp\ytdnx4lhbltvg74j.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
c:\documents and settings\utilisateur\local settings\temporary internet files\Content.IE5\UMUJXI76\aressetup[1].exe (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\WINDOWS\Xvikya.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\WINDOWS\Xvikyb.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\WINDOWS\Xvikyc.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\WINDOWS\Xvikyd.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\WINDOWS\Xvikye.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\WINDOWS\Xvikyf.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\WINDOWS\Xvikyg.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\WINDOWS\Tasks\{22116563-108c-42c0-a7ce-60161b75e508}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\WINDOWS\Tasks\{810401e2-dde0-454e-b0e2-aa89c9e5967c}.job (Trojan.FraudPack) -> Quarantined and deleted successfully.

re,
bien on avance....

fais un scan en ligne avec Eset online
rends toi sur ce lien
clic sur ce bouton:

poste moi le rapport généré en fin de scan.

le rapport en fin de scan s'appel log ?
parce que je n'ai rien qui c'est ouvert

re,
regarde ici

C:\Program Files\ESET Online Scanner\log.txt ou C:\Program Files (x86) \ESET Online Scanner\log.txt

ok merci.
voila le rapport :

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6427
# api_version=3.0.2
# EOSSerial=7100a1a5a5ced94590578b0425412049
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-04-22 03:18:01
# local_time=2011-04-22 05:18:01 (+0100, Paris, Madrid (heure d'été))
# country="France"
# lang=1036
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=freeze
# scanned=64420
# found=2
# cleaned=1
# scan_time=6147
C:\WINDOWS\system32\gsczaiip.dll une variante de Win32/Boaxxe.B cheval de troie (nettoyé par suppression (après le prochain redémarrage) - mis en quarantaine) 00000000000000000000000000000000 C
${Memory} une variante de Win32/Boaxxe.B cheval de troie 00000000000000000000000000000000 I

re,


le nettoyage a du se faire au redémarrage.

On va utiliser Ccleaner de Piriform Ltd.
Télécharger CCleaner sur le bureau:
Ne le télécharge pas si tu l'as déjà !


-->source ici
Une fois sur le bureau, clic sur l'install de CCleaner.
-Mais avant de cliquer > sur le bouton "installer", décoche toutes les "options supplémentaires".
Ensuite, clique sur "Options", "Avancé" et décoche la case--->
"Effacer uniquement les fichiers, du dossier Temp de Windows, plus vieux que 24 heures".
Clique sur l'onglet "Nettoyeur" puis sur "Lancer le Nettoyage".
-> Ensuite clique sur l'icone Registre, à droite, clique sur "Chercher des erreurs" puis sur "Réparer les erreurs sélectionnées".

Accepte la sauvegarde, de la BDR (base de registre )qu'il propose .
Je te conseille de le repasser au moins deux fois,Refais le nettoyage de la base de registre, jusqu'à ce qu'il n'y ai plus aucune erreur de détectée.

--->aide visuelle, clic ici


Comment se comporte le PC actuellement?