Pc viruser... Jamais vu ça!

Bonjour tout le monde,

Une copine m' à prêter son pc pour que je lui enléve un virus (enfin un c' était au départ! :))En analysant avec "Antivir" j' en ai déja trouver 141 tout confondu (trojan virus...) Le problème c' est qu' il doit y en rester quelqu' uns que je ne peux enlever avec un simple antivirus.

J' ai aussi fait le ménage avec avg qui lui en à trouver pas mal aussi.

Au démmarage du pc deux fenetres apparaissent:

la 1er dit:"Erreur de chargement de C:Windows/system32/yAtMcBr.Dll Le module specifier est introuvable"

La 2éme dit: "Erreur de chargement de C:/User/Christ~1/AppData/Local/Temp/rqRHxyay.dll le module spécifier est introuvable."

Je précise que la demoiselle qui m' a prêter son pc n' avait pas d' antivirus est en plus elle avait désactiver le pare feu!

Si quelqu' un pourraît me depanner ca serait sympa.

Merci par avance.

J' ai oulier de préciser: Windows vista 32 bits

(Modifié par artkall le 19-09-2008 à 21:10)

salut,

Télécharger sur le bureau Malwarebyte's Anti-Malware

=> double-clic sur mbam-setup pour lancer l'installation
=> Installer simplement sans rien modifier
=> Quand le programme lancé ==> onglet Mise à jour cliquer sur => Recherche de mise à jour
Onglet Recherche => cocher Exécuter un examen complet
=> Clic Rechercher
=> Eventuellement décocher les disque à ne pas analyser
=> Clic Lancer l'examen
=> En fin de scan , si infection trouvée
==> Clic Afficher résultat
=> Fermer vos applications en cours
=> Vérifier si tout est coché et clic Supprimer la sélection

=> un rapport s'ouvre le copier et le coller dans la réponse

Salut Kasper,

Merci de ta réponse rapide. L' analyse vient de se terminer voici le rapport:

Malwarebytes' Anti-Malware 1.28
Version de la base de données: 1177
Windows 6.0.6001 Service Pack 1

20/09/2008 13:51:37
mbam-log-2008-09-20 (13-51-37).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 132782
Temps écoulé: 2 hour(s), 38 minute(s), 17 second(s)

Processus mémoire infecté(s): 1
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 38
Valeur(s) du Registre infectée(s): 6
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 6
Fichier(s) infecté(s): 29

Processus mémoire infecté(s):
C:\Program Files\Twain\Twain.exe (Trojan.Agent) -> Unloaded process successfully.

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9d98bd8d-b815-4a05-ba62-54202ba81988} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{9d98bd8d-b815-4a05-ba62-54202ba81988} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\bho_myjavacore.mjcore (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\bho_myjavacore.mjcore.1 (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\oberontb.band (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{ad76633e-e50d-4844-9e7f-4dfbc7c18467} (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{ec1a2105-5621-440f-987d-27ef428131d9} (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{6f282b65-56bf-4bd1-a8b2-a4449a05863d} (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6f282b65-56bf-4bd1-a8b2-a4449a05863d} (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\oberontb.band.1 (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\testcpv6.bho (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\testcpv6.bho.1 (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{17e44256-51e0-4d46-a0c8-44e80ab4ba5b} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{2e4a04a1-a24d-45ae-aca4-949778400813} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{e0f01490-dcf3-4357-95aa-169a8c2b2190} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{63334394-3da3-4b29-a041-03535909d361} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{80ef304a-b1c4-425c-8535-95ab6f1eefb8} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{ff46f4ab-a85f-487e-b399-3f191ac0fe23} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{1a93c934-025b-4c3a-b38e-9654a7003239} (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{f0d4b230-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{f0d4b23a-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{f0d4b23c-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{b15fd82e-85bc-430d-90cb-65db1b030510} (Adware.AskSBAR) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{f0d4b23b-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{f0d4b23b-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\BHO_MyJavaCore.DLL (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\testCPV6.DLL (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\MediaHoldings (Adware.PlayMP3Z) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Mirar (Adware.Mirar) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\PlayMP3 (Adware.PlayMP3Z) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\FBrowsingAdvisor (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\fbrowsingadvisor_is1 (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\MS Juan (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IProxyProvider (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\twain (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{6f282b65-56bf-4bd1-a8b2-a4449a05863d} (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSServer (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmds (Malware.Trace) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\Program Files\FBrowsingAdvisor (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
C:\Program Files\FBrowserAdvisor (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
C:\Program Files\Webtools (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\Twain (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\Mjcore (Trojan.BHO) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spyware-Secure (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Windows\system32\aepwmm.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\Users\christelle\Local Settings\Application Data\jfhlicf_navps.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
C:\Users\christelle\Local Settings\Application Data\jfhlicf_nav.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
C:\Users\christelle\Local Settings\Application Data\jfhlicf.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
C:\Users\christelle\Local Settings\Application Data\jfhlicf.exe (Adware.Navipromo.H) -> Delete on reboot.
C:\Program Files\Twain\Twain.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\GamesBar\oberontb.dll (Adware.Gamesbar) -> Quarantined and deleted successfully.
C:\Program Files\Webtools\webtools.dll (Trojan.BHO) -> Quarantined and deleted successfully.
C:\regxpcom.exe (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
C:\Program Files\AskSBar\bar\1.bin\A2HIGHIN.EXE (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\AskSBar\bar\1.bin\A2PLUGIN.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL (Adware.AskSBAR) -> Quarantined and deleted successfully.
C:\Program Files\AskSBar\bar\1.bin\NPASKSBR.DLL (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\FBrowsingAdvisor\XPCOMEvents.dll (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
C:\Users\christelle\AppData\Local\Temp\ide21201.vxd (Adware.Winad) -> Quarantined and deleted successfully.
C:\Users\christelle\AppData\Local\Temp\tem5256.tmp.exe (Adware.Agent) -> Quarantined and deleted successfully.
C:\Users\christelle\AppData\Local\Temp\tem7AAD.tmp.exe (Adware.Agent) -> Quarantined and deleted successfully.
C:\Users\christelle\AppData\Local\Temp\tem872B.tmp.exe (Adware.Agent) -> Quarantined and deleted successfully.
C:\Users\christelle\AppData\Local\Temp\tem9E53.tmp.exe (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files\FBrowsingAdvisor\IXPCOMEvents.xpt (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
C:\Program Files\FBrowsingAdvisor\Logo.png (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
C:\Program Files\FBrowsingAdvisor\main.db (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
C:\Program Files\FBrowsingAdvisor\unins000.dat (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
C:\Program Files\FBrowsingAdvisor\unins000.exe (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spyware-Secure\Spyware-Secure trial.lnk (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spyware-Secure\Spyware-Secure.lnk (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spyware-Secure\Uninstall.lnk (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spyware-Secure\Website.lnk (Rogue.Spyware-Secure) -> Quarantined and deleted successfully.
C:\Windows\System32\nvs2.inf (Adware.EGDAccess) -> Quarantined and deleted successfully.

T'a plein de types de malwares ..

Télécharger sur le bureau
SdFix
= Double-clic SDFix.
= Clic Install
------
= Redémarrer en mode Sans Échec (le démarrage peut prendre plusieurs minutes)
Attention, pas d’accès à internet dans ce mode. Enregistrer ou imprimer les consignes. Relancer le Pc et tapoter la touche F8 ( ou F5, 2 ou 4 pour certains) , jusqu’à l’apparition des inscriptions avec choix de démarrage
Avec les touches « flèches », sélectionner Mode sans échec ==> entrée ==>nom utilisateur habituel
--------
= Double-clic sur le nouveau dossier SDFix
= Double-clic RunThis
= Presser Y
= A l’invitation ==> appuyer sur une touche pour redémarrer
= Redémarrage ( qui sera plus long ,car nettoyage en cours )
Continuer si un message d’erreurs apparaît ,dans ce cas aller directement au rapport dans SDfix
= apparition de Finished
= Appuyer sur une touche
= Dans SDFix , un rapport Report.
= Copier/coller le rapport dans la réponse

______________

Télécharge sur le bureau Navilog1.exe
=> double-clic dessus pour l'installer et le lancer
Quand installé
=> Taper F
=> Appuyer sur une touche jusqu' arriver aux options
=> Choisir option 1 ( = taper 1 )
- ne pas utiliser les autres sans avis , il peut y avoir des processus légitimes
=> un rapport : fixnavi.txt dans ==> C:\
=> le copier/coller dans la réponse

Re,

Imposssible de faire apparaitre le dossier de SdFix. Quand je double clic sur sdfix un message du blocs notes apparait.

J' ai quand même essayer en mode sans echec, j' ai été chercher "Runthis" dans ordinateur-->C: --> SdFix--> runthis.Mais quand je double clic dessus rien ne se passe...

Si tu peux m' aiclairer ca serait cool. Merci.

Laisse tomber SDFIX et fais a la place et avant navilog.

Télécharge Toolbar-S&D (Team IDN) sur ton Bureau.

Ici


* Lance l'installation du programme en exécutant le fichier téléchargé.

* Double-clique maintenant sur le raccourci de Toolbar-S&D.

* Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.

* Choisis maintenant l'option 1 (Recherche).

Patiente jusqu'à la fin de la recherche.

* Poste le rapport généré. (C:\TB.txt)

Re,

Je te poste le rapport de ToolbarSD:


-----------\\ ToolBar S&D 1.2.0 XP/Vista

Microsoft® Windows Vista™ Édition Familiale Premium ( v6.0.6001 ) Service Pack 1
X86-based PC ( Multiprocessor Free : AMD Athlon(tm) 64 X2 Dual Core Processor 3800+ )
BIOS : Phoenix - AwardBIOS v6.00PG
USER : christelle ( Administrator )
BOOT : Normal boot
C:\ (Local Disk) - NTFS - Total : 143 Go Free : 104 Go
D:\ (Local Disk) - NTFS - Total : 5 Go Free : 0 Go
E:\ (CD or DVD)
F:\ (USB)
G:\ (USB)
H:\ (USB)
I:\ (USB)

"C:\ToolBar SD" ( MAJ : 14-09-2008|23:30 )
Option : [1] ( 21/09/2008| 0:09 )

[ UAC => 1 ]

-----------\\ Recherche de Fichiers / Dossiers ...

C:\Program Files\AskSBar
C:\Program Files\AskSBar\bar
C:\Program Files\AskSBar\SrchAstt
C:\ProgramData\GamesBar
C:\ProgramData\GamesBar\07-09-10-22-02-43
C:\ProgramData\GamesBar\07-09-10-22-02-43.xm_
C:\ProgramData\GamesBar\07-09-12-09-35-33
C:\ProgramData\GamesBar\07-09-12-09-35-33.xm_
C:\ProgramData\GamesBar\07-09-13-13-02-32
C:\ProgramData\GamesBar\07-09-13-13-02-32.xm_
C:\ProgramData\GamesBar\07-09-14-21-15-47
C:\ProgramData\GamesBar\07-09-14-21-15-47.xm_
C:\ProgramData\GamesBar\07-09-17-10-06-45
C:\ProgramData\GamesBar\07-09-17-10-06-45.xm_
C:\ProgramData\GamesBar\07-09-18-10-50-52
C:\ProgramData\GamesBar\07-09-18-10-50-52.xm_
C:\ProgramData\GamesBar\07-09-25-09-19-25
C:\ProgramData\GamesBar\07-09-25-09-19-25.xm_
C:\ProgramData\GamesBar\07-09-28-09-37-56
C:\ProgramData\GamesBar\07-09-28-09-37-56.xm_
C:\ProgramData\GamesBar\07-10-04-12-36-11
C:\ProgramData\GamesBar\07-10-04-12-36-11.xm_
C:\ProgramData\GamesBar\07-10-06-09-05-41
C:\ProgramData\GamesBar\07-10-06-09-05-41.xm_
C:\ProgramData\GamesBar\07-10-10-09-19-33
C:\ProgramData\GamesBar\07-10-10-09-19-33.xm_
C:\ProgramData\GamesBar\7_wonders_216x16.gif
C:\ProgramData\GamesBar\about.gif
C:\ProgramData\GamesBar\action.gif
C:\ProgramData\GamesBar\AliceGreenfingers16x16.gif
C:\ProgramData\GamesBar\arcade.gif
C:\ProgramData\GamesBar\Azada16x16.gif
C:\ProgramData\GamesBar\battleship16x16.gif
C:\ProgramData\GamesBar\buy.gif
C:\ProgramData\GamesBar\cards.gif
C:\ProgramData\GamesBar\caution.gif
C:\ProgramData\GamesBar\ChickRush_deluxe16x16.gif
C:\ProgramData\GamesBar\Chromadrome_216x16.gif
C:\ProgramData\GamesBar\chroma_crash16x16.gif
C:\ProgramData\GamesBar\deals.gif
C:\ProgramData\GamesBar\death_nile16x16.gif
C:\ProgramData\GamesBar\download.gif
C:\ProgramData\GamesBar\feedback.gif
C:\ProgramData\GamesBar\feyruna16x16.gif
C:\ProgramData\GamesBar\gemsweeper16x16.gif
C:\ProgramData\GamesBar\help.gif
C:\ProgramData\GamesBar\highlight.gif
C:\ProgramData\GamesBar\jigsaw.gif
C:\ProgramData\GamesBar\kids.gif
C:\ProgramData\GamesBar\mahjong.gif
C:\ProgramData\GamesBar\mahjong_quest_216x16.gif
C:\ProgramData\GamesBar\MCF_raven16x16.gif
C:\ProgramData\GamesBar\multiplayer.gif
C:\ProgramData\GamesBar\mygames.gif
C:\ProgramData\GamesBar\newGames.gif
C:\ProgramData\GamesBar\oberonconfig.xm_
C:\ProgramData\GamesBar\obSearchHistory.dat
C:\ProgramData\GamesBar\partner.gif
C:\ProgramData\GamesBar\pathstorm16x16.gif
C:\ProgramData\GamesBar\popup_off.gif
C:\ProgramData\GamesBar\popup_on.gif
C:\ProgramData\GamesBar\puzzle.gif
C:\ProgramData\GamesBar\search.gif
C:\ProgramData\GamesBar\sendafriend.gif
C:\ProgramData\GamesBar\snapshot_adventures16x16.gif
C:\ProgramData\GamesBar\sports.gif
C:\ProgramData\GamesBar\sudoku_kakuro_and_friends16x16.gif
C:\ProgramData\GamesBar\the_apprentice_LA16x16.gif
C:\ProgramData\GamesBar\trial.gif
C:\ProgramData\GamesBar\turbo_pizza16x16.gif
C:\ProgramData\GamesBar\uninstall.gif
C:\ProgramData\GamesBar\update.gif
C:\ProgramData\GamesBar\webgame.gif
C:\ProgramData\GamesBar\zengems16x16.gif
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\GamesBar
C:\Program Files\GamesBar
C:\Program Files\GamesBar\Localization-French.ini
C:\Program Files\GamesBar\OBGet.exe
C:\Program Files\GamesBar\uninst.exe
C:\Users\CHRIST~1\AppData\Roaming\MICROS~1\Windows\Cookies\christelle@kazaa[1].txt
C:\Users\CHRIST~1\AppData\Roaming\MICROS~1\Windows\Cookies\christelle@surfaccuracy[1].txt
C:\Users\CHRIST~1\AppData\Local\Temp\ICD1.tmp
C:\Users\CHRIST~1\AppData\Local\Temp\tem90DC.tmp.exe
C:\Users\CHRIST~1\AppData\Local\Temp\temAC87.tmp.exe
C:\Users\CHRIST~1\AppData\Local\Temp\temB7DD.tmp.exe
C:\Users\CHRIST~1\AppData\Local\Temp\nsa70F1.tmp
C:\Users\CHRIST~1\AppData\Local\Temp\nsaD125.tmp
C:\Users\CHRIST~1\AppData\Local\Temp\nsb18FF.tmp
C:\Users\CHRIST~1\AppData\Local\Temp\nsb6B36.tmp
C:\Users\CHRIST~1\AppData\Local\Temp\nsc45EF.tmp
C:\Users\CHRIST~1\AppData\Local\Temp\nsc45F0.tmp
C:\Users\CHRIST~1\AppData\Local\Temp\nsc9F5E.tmp
C:\Users\CHRIST~1\AppData\Local\Temp\nscA663.tmp
C:\Users\CHRIST~1\AppData\Local\Temp\nscE6E7.tmp
C:\Users\CHRIST~1\AppData\Local\Temp\nscF895.tmp
C:\Users\CHRIST~1\AppData\Local\Temp\nsd6CAC.tmp
C:\Users\CHRIST~1\AppData\Local\Temp\nsd9265.tmp
C:\Users\CHRIST~1\AppData\Local\Temp\nseC4C9.tmp
C:\Users\CHRIST~1\AppData\Local\Temp\nsfAF24.tmp
C:\Users\CHRIST~1\AppData\Local\Temp\nsg651D.tmp
C:\Users\CHRIST~1\AppData\Local\Temp\nsgB98F.tmp
C:\Users\CHRIST~1\AppData\Local\Temp\nsgD8D.tmp
C:\Users\CHRIST~1\AppData\Local\Temp\nsh706.tmp
C:\Users\CHRIST~1\AppData\Local\Temp\nshE99C.tmp
C:\Users\CHRIST~1\AppData\Local\Temp\nsi5DAD.tmp
C:\Users\CHRIST~1\AppData\Local\Temp\nsj68B6.tmp
C:\Users\CHRIST~1\AppData\Local\Temp\nsj6E83.tmp
C:\Users\CHRIST~1\AppData\Local\Temp\nsk57A5.tmp
C:\Users\CHRIST~1\AppData\Local\Temp\nsk932B.tmp
C:\Users\CHRIST~1\AppData\Local\Temp\nskA797.tmp
C:\Users\CHRIST~1\AppData\Local\Temp\nskDF79.tmp
C:\Users\CHRIST~1\AppData\Local\Temp\nslF5E8.tmp
C:\Users\CHRIST~1\AppData\Local\Temp\nsmD2B0.tmp
C:\Users\CHRIST~1\AppData\Local\Temp\nsn3E6C.tmp
C:\Users\CHRIST~1\AppData\Local\Temp\nsn4439.tmp
C:\Users\CHRIST~1\AppData\Local\Temp\nsn50D6.tmp
C:\Users\CHRIST~1\AppData\Local\Temp\nsn8C88.tmp
C:\Users\CHRIST~1\AppData\Local\Temp\nsnEE0A.tmp
C:\Users\CHRIST~1\AppData\Local\Temp\nsoAC7B.tmp
C:\Users\CHRIST~1\AppData\Local\Temp\nsr3F47.tmp
C:\Users\CHRIST~1\AppData\Local\Temp\nsrA673.tmp
C:\Users\CHRIST~1\AppData\Local\Temp\nsrF71.tmp
C:\Users\CHRIST~1\AppData\Local\Temp\nss237D.tmp
C:\Users\CHRIST~1\AppData\Local\Temp\nssB109.tmp
C:\Users\CHRIST~1\AppData\Local\Temp\nstB2C0.tmp
C:\Users\CHRIST~1\AppData\Local\Temp\nsuAB83.tmp
C:\Users\CHRIST~1\AppData\Local\Temp\nsv86EE.tmp
C:\Users\CHRIST~1\AppData\Local\Temp\nsw7096.tmp
C:\Users\CHRIST~1\AppData\Local\Temp\nswB87.tmp
C:\Users\CHRIST~1\AppData\Local\Temp\nswCCD3.tmp
C:\Users\CHRIST~1\AppData\Local\Temp\nswEA91.tmp
C:\Users\CHRIST~1\AppData\Local\Temp\nsx8D08.tmp
C:\Users\CHRIST~1\AppData\Local\Temp\nszD37A.tmp
C:\Users\CHRIST~1\AppData\Local\Temp\nszE555.tmp
C:\Users\CHRIST~1\AppData\Local\Temp\nszF422.tmp

-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\Windows\\system32\\blank.htm"
"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Start Page"="http://orange.fr/"
"Url"="http://go.microsoft.com/fwlink/?LinkID=68928"
"Url"="http://go.microsoft.com/fwlink/?LinkID=44406"
"Url"="http://go.microsoft.com/fwlink/?LinkID=68929"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=71&bd=Pavilion&pf=desktop"
"Default_Page_URL"="http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=71&bd=Pavilion&pf=desktop"
"Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"


--------------------\\ Recherche d'autres infections

C:\Windows\Pack.epk
==> EGDACCESS <==

C:\Windows\system32\rBcMTtAy.ini
C:\Windows\system32\rBcMTtAy.ini2
==> VUNDO <==

--------------------\\ Cracks & Keygens ..

C:\PROGRA~2\Fugazo\Cooking Academy\cached\sounds\eggcrack.wav


[ UAC => 1 ]


1 - "C:\ToolBar SD\TB_1.txt" - 21/09/2008| 0:10 - Option : [1]

-----------\\ Fin du rapport a 0:10:28,07

Relance Toolbar SD en option 2

Merci de tes réponses c' est bien sympa!

Le rapport en option 2:


-----------\\ ToolBar S&D 1.2.0 XP/Vista

Microsoft® Windows Vista™ Édition Familiale Premium ( v6.0.6001 ) Service Pack 1
X86-based PC ( Multiprocessor Free : AMD Athlon(tm) 64 X2 Dual Core Processor 3800+ )
BIOS : Phoenix - AwardBIOS v6.00PG
USER : christelle ( Administrator )
BOOT : Normal boot
C:\ (Local Disk) - NTFS - Total : 143 Go Free : 104 Go
D:\ (Local Disk) - NTFS - Total : 5 Go Free : 0 Go
E:\ (CD or DVD)
F:\ (USB)
G:\ (USB)
H:\ (USB)
I:\ (USB)

"C:\ToolBar SD" ( MAJ : 14-09-2008|23:30 )
Option : [2] ( 21/09/2008| 0:19 )

[ UAC => 1 ]

-----------\\ SUPPRESSION

Supprime! - C:\Program Files\AskSBar\bar
Supprime! - C:\Program Files\AskSBar\SrchAstt
Supprime! - C:\ProgramData\GamesBar\07-09-10-22-02-43
Supprime! - C:\ProgramData\GamesBar\07-09-10-22-02-43.xm_
Supprime! - C:\ProgramData\GamesBar\07-09-12-09-35-33
Supprime! - C:\ProgramData\GamesBar\07-09-12-09-35-33.xm_
Supprime! - C:\ProgramData\GamesBar\07-09-13-13-02-32
Supprime! - C:\ProgramData\GamesBar\07-09-13-13-02-32.xm_
Supprime! - C:\ProgramData\GamesBar\07-09-14-21-15-47
Supprime! - C:\ProgramData\GamesBar\07-09-14-21-15-47.xm_
Supprime! - C:\ProgramData\GamesBar\07-09-17-10-06-45
Supprime! - C:\ProgramData\GamesBar\07-09-17-10-06-45.xm_
Supprime! - C:\ProgramData\GamesBar\07-09-18-10-50-52
Supprime! - C:\ProgramData\GamesBar\07-09-18-10-50-52.xm_
Supprime! - C:\ProgramData\GamesBar\07-09-25-09-19-25
Supprime! - C:\ProgramData\GamesBar\07-09-25-09-19-25.xm_
Supprime! - C:\ProgramData\GamesBar\07-09-28-09-37-56
Supprime! - C:\ProgramData\GamesBar\07-09-28-09-37-56.xm_
Supprime! - C:\ProgramData\GamesBar\07-10-04-12-36-11
Supprime! - C:\ProgramData\GamesBar\07-10-04-12-36-11.xm_
Supprime! - C:\ProgramData\GamesBar\07-10-06-09-05-41
Supprime! - C:\ProgramData\GamesBar\07-10-06-09-05-41.xm_
Supprime! - C:\ProgramData\GamesBar\07-10-10-09-19-33
Supprime! - C:\ProgramData\GamesBar\07-10-10-09-19-33.xm_
Supprime! - C:\ProgramData\GamesBar\7_wonders_216x16.gif
Supprime! - C:\ProgramData\GamesBar\about.gif
Supprime! - C:\ProgramData\GamesBar\action.gif
Supprime! - C:\ProgramData\GamesBar\AliceGreenfingers16x16.gif
Supprime! - C:\ProgramData\GamesBar\arcade.gif
Supprime! - C:\ProgramData\GamesBar\Azada16x16.gif
Supprime! - C:\ProgramData\GamesBar\battleship16x16.gif
Supprime! - C:\ProgramData\GamesBar\buy.gif
Supprime! - C:\ProgramData\GamesBar\cards.gif
Supprime! - C:\ProgramData\GamesBar\caution.gif
Supprime! - C:\ProgramData\GamesBar\ChickRush_deluxe16x16.gif
Supprime! - C:\ProgramData\GamesBar\Chromadrome_216x16.gif
Supprime! - C:\ProgramData\GamesBar\chroma_crash16x16.gif
Supprime! - C:\ProgramData\GamesBar\deals.gif
Supprime! - C:\ProgramData\GamesBar\death_nile16x16.gif
Supprime! - C:\ProgramData\GamesBar\download.gif
Supprime! - C:\ProgramData\GamesBar\feedback.gif
Supprime! - C:\ProgramData\GamesBar\feyruna16x16.gif
Supprime! - C:\ProgramData\GamesBar\gemsweeper16x16.gif
Supprime! - C:\ProgramData\GamesBar\help.gif
Supprime! - C:\ProgramData\GamesBar\highlight.gif
Supprime! - C:\ProgramData\GamesBar\jigsaw.gif
Supprime! - C:\ProgramData\GamesBar\kids.gif
Supprime! - C:\ProgramData\GamesBar\mahjong.gif
Supprime! - C:\ProgramData\GamesBar\mahjong_quest_216x16.gif
Supprime! - C:\ProgramData\GamesBar\MCF_raven16x16.gif
Supprime! - C:\ProgramData\GamesBar\multiplayer.gif
Supprime! - C:\ProgramData\GamesBar\mygames.gif
Supprime! - C:\ProgramData\GamesBar\newGames.gif
Supprime! - C:\ProgramData\GamesBar\oberonconfig.xm_
Supprime! - C:\ProgramData\GamesBar\obSearchHistory.dat
Supprime! - C:\ProgramData\GamesBar\partner.gif
Supprime! - C:\ProgramData\GamesBar\pathstorm16x16.gif
Supprime! - C:\ProgramData\GamesBar\popup_off.gif
Supprime! - C:\ProgramData\GamesBar\popup_on.gif
Supprime! - C:\ProgramData\GamesBar\puzzle.gif
Supprime! - C:\ProgramData\GamesBar\search.gif
Supprime! - C:\ProgramData\GamesBar\sendafriend.gif
Supprime! - C:\ProgramData\GamesBar\snapshot_adventures16x16.gif
Supprime! - C:\ProgramData\GamesBar\sports.gif
Supprime! - C:\ProgramData\GamesBar\sudoku_kakuro_and_friends16x16.gif
Supprime! - C:\ProgramData\GamesBar\the_apprentice_LA16x16.gif
Supprime! - C:\ProgramData\GamesBar\trial.gif
Supprime! - C:\ProgramData\GamesBar\turbo_pizza16x16.gif
Supprime! - C:\ProgramData\GamesBar\uninstall.gif
Supprime! - C:\ProgramData\GamesBar\update.gif
Supprime! - C:\ProgramData\GamesBar\webgame.gif
Supprime! - C:\ProgramData\GamesBar\zengems16x16.gif
Supprime! - C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\GamesBar
Supprime! - C:\Program Files\GamesBar\Localization-French.ini
Supprime! - C:\Program Files\GamesBar\OBGet.exe
Supprime! - C:\Program Files\GamesBar\uninst.exe
Supprime! - C:\Users\CHRIST~1\AppData\Roaming\MICROS~1\Windows\Cookies\christelle@kazaa[1].txt
Supprime! - C:\Users\CHRIST~1\AppData\Roaming\MICROS~1\Windows\Cookies\christelle@surfaccuracy[1].txt
Supprime! - C:\Users\CHRIST~1\AppData\Local\Temp\ICD1.tmp
Supprime! - C:\Users\CHRIST~1\AppData\Local\Temp\tem90DC.tmp.exe
Supprime! - C:\Users\CHRIST~1\AppData\Local\Temp\temAC87.tmp.exe
Supprime! - C:\Users\CHRIST~1\AppData\Local\Temp\temB7DD.tmp.exe
Supprime! - C:\Users\CHRIST~1\AppData\Local\Temp\nsa70F1.tmp
Supprime! - C:\Users\CHRIST~1\AppData\Local\Temp\nsaD125.tmp
Supprime! - C:\Users\CHRIST~1\AppData\Local\Temp\nsb18FF.tmp
Supprime! - C:\Users\CHRIST~1\AppData\Local\Temp\nsb6B36.tmp
Supprime! - C:\Users\CHRIST~1\AppData\Local\Temp\nsc45EF.tmp
Supprime! - C:\Users\CHRIST~1\AppData\Local\Temp\nsc45F0.tmp
Supprime! - C:\Users\CHRIST~1\AppData\Local\Temp\nsc9F5E.tmp
Supprime! - C:\Users\CHRIST~1\AppData\Local\Temp\nscA663.tmp
Supprime! - C:\Users\CHRIST~1\AppData\Local\Temp\nscE6E7.tmp
Supprime! - C:\Users\CHRIST~1\AppData\Local\Temp\nscF895.tmp
Supprime! - C:\Users\CHRIST~1\AppData\Local\Temp\nsd6CAC.tmp
Supprime! - C:\Users\CHRIST~1\AppData\Local\Temp\nsd9265.tmp
Supprime! - C:\Users\CHRIST~1\AppData\Local\Temp\nseC4C9.tmp
Supprime! - C:\Users\CHRIST~1\AppData\Local\Temp\nsfAF24.tmp
Supprime! - C:\Users\CHRIST~1\AppData\Local\Temp\nsg651D.tmp
Supprime! - C:\Users\CHRIST~1\AppData\Local\Temp\nsgB98F.tmp
Supprime! - C:\Users\CHRIST~1\AppData\Local\Temp\nsgD8D.tmp
Supprime! - C:\Users\CHRIST~1\AppData\Local\Temp\nsh706.tmp
Supprime! - C:\Users\CHRIST~1\AppData\Local\Temp\nshE99C.tmp
Supprime! - C:\Users\CHRIST~1\AppData\Local\Temp\nsi5DAD.tmp
Supprime! - C:\Users\CHRIST~1\AppData\Local\Temp\nsj68B6.tmp
Supprime! - C:\Users\CHRIST~1\AppData\Local\Temp\nsj6E83.tmp
Supprime! - C:\Users\CHRIST~1\AppData\Local\Temp\nsk57A5.tmp
Supprime! - C:\Users\CHRIST~1\AppData\Local\Temp\nsk932B.tmp
Supprime! - C:\Users\CHRIST~1\AppData\Local\Temp\nskA797.tmp
Supprime! - C:\Users\CHRIST~1\AppData\Local\Temp\nskDF79.tmp
Supprime! - C:\Users\CHRIST~1\AppData\Local\Temp\nslF5E8.tmp
Supprime! - C:\Users\CHRIST~1\AppData\Local\Temp\nsmD2B0.tmp
Supprime! - C:\Users\CHRIST~1\AppData\Local\Temp\nsn3E6C.tmp
Supprime! - C:\Users\CHRIST~1\AppData\Local\Temp\nsn4439.tmp
Supprime! - C:\Users\CHRIST~1\AppData\Local\Temp\nsn50D6.tmp
Supprime! - C:\Users\CHRIST~1\AppData\Local\Temp\nsn8C88.tmp
Supprime! - C:\Users\CHRIST~1\AppData\Local\Temp\nsnEE0A.tmp
Supprime! - C:\Users\CHRIST~1\AppData\Local\Temp\nsoAC7B.tmp
Supprime! - C:\Users\CHRIST~1\AppData\Local\Temp\nsr3F47.tmp
Supprime! - C:\Users\CHRIST~1\AppData\Local\Temp\nsrA673.tmp
Supprime! - C:\Users\CHRIST~1\AppData\Local\Temp\nsrF71.tmp
Supprime! - C:\Users\CHRIST~1\AppData\Local\Temp\nss237D.tmp
Supprime! - C:\Users\CHRIST~1\AppData\Local\Temp\nssB109.tmp
Supprime! - C:\Users\CHRIST~1\AppData\Local\Temp\nstB2C0.tmp
Supprime! - C:\Users\CHRIST~1\AppData\Local\Temp\nsuAB83.tmp
Supprime! - C:\Users\CHRIST~1\AppData\Local\Temp\nsv86EE.tmp
Supprime! - C:\Users\CHRIST~1\AppData\Local\Temp\nsw7096.tmp
Supprime! - C:\Users\CHRIST~1\AppData\Local\Temp\nswB87.tmp
Supprime! - C:\Users\CHRIST~1\AppData\Local\Temp\nswCCD3.tmp
Supprime! - C:\Users\CHRIST~1\AppData\Local\Temp\nswEA91.tmp
Supprime! - C:\Users\CHRIST~1\AppData\Local\Temp\nsx8D08.tmp
Supprime! - C:\Users\CHRIST~1\AppData\Local\Temp\nszD37A.tmp
Supprime! - C:\Users\CHRIST~1\AppData\Local\Temp\nszE555.tmp
Supprime! - C:\Users\CHRIST~1\AppData\Local\Temp\nszF422.tmp
Supprime! - C:\Program Files\AskSBar
Supprime! - C:\ProgramData\GamesBar
Supprime! - C:\Program Files\GamesBar

-----------\\ Recherche de Fichiers / Dossiers ...


-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\Windows\\system32\\blank.htm"
"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Start Page"="http://orange.fr/"
"Url"="http://go.microsoft.com/fwlink/?LinkID=68928"
"Url"="http://go.microsoft.com/fwlink/?LinkID=44406"
"Url"="http://go.microsoft.com/fwlink/?LinkID=68929"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.msn.com/"
"Default_Page_URL"="http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=71&bd=Pavilion&pf=desktop"
"Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"


--------------------\\ Recherche d'autres infections

C:\Windows\Pack.epk
==> EGDACCESS <==

C:\Windows\system32\rBcMTtAy.ini
C:\Windows\system32\rBcMTtAy.ini2
==> VUNDO <==

--------------------\\ Cracks & Keygens ..

C:\PROGRA~2\Fugazo\Cooking Academy\cached\sounds\eggcrack.wav


[ UAC => 1 ]


1 - "C:\ToolBar SD\TB_1.txt" - 21/09/2008| 0:10 - Option : [1]
2 - "C:\ToolBar SD\TB_2.txt" - 21/09/2008| 0:23 - Option : [2]

-----------\\ Fin du rapport a 0:23:00,84

Par contre impossible de lancer "navilog" il me dit qu' il y a un fichier manquant. C 'est louche ça.

Ok, refais un hijackthis s'il te plait