Rapport Hijackthis (help please)

Merci pour ton aide !


[b]SDFix: Version 1.240 [/b]
Run by Administrateur on 25/01/2009 at 16:16

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:

[b]Name [/b]:
CbEvtSvc
psyche
PsycheEnqueue

[b]Path [/b]:
%SystemRoot%\System32\CbEvtSvc.exe -k netsvcs
%SystemRoot%\System32\psyche.exe -k netsvcs
%SystemRoot%\System32\PsycheEnqueue.exe -k netsvcs

CbEvtSvc - Deleted
psyche - Deleted
PsycheEnqueue - Deleted



Restoring Default Security Values
Restoring Default Hosts File
Restoring Default Desktop Wallpaper
Restoring Default ScreenSaver value

Rebooting


[b]Checking Files [/b]:

Trojan Files Found:

C:\WINDOWS\system32\lphctduj0epf5.exe - Deleted
C:\WINDOWS\system32\rightonadz-uninst.exe - Deleted
C:\WINDOWS\system32\phctduj0epf5.bmp - Deleted
C:\WINDOWS\system32\blphctduj0epf5.scr - Deleted
C:\DOCUME~1\LOCALS~1\APPLIC~1\111491~1.EXE - Deleted
C:\DOCUME~1\LOCALS~1\APPLIC~1\114715~1.EXE - Deleted
C:\DOCUME~1\LOCALS~1\APPLIC~1\115338~1.EXE - Deleted
C:\DOCUME~1\LOCALS~1\APPLIC~1\115836~1.EXE - Deleted
C:\DOCUME~1\LOCALS~1\APPLIC~1\115967~1.EXE - Deleted
C:\DOCUME~1\LOCALS~1\APPLIC~1\116845~1.EXE - Deleted
C:\DOCUME~1\LOCALS~1\APPLIC~1\120057~1.EXE - Deleted
C:\WINDOWS\system32\CbEvtSvc.exe - Deleted
C:\WINDOWS\system32\psyche.exe - Deleted
C:\WINDOWS\system32\PsycheEnqueue.exe - Deleted
C:\WINDOWS\system32\rightonadz-uninst.exe - Deleted





Removing Temp Files

[b]ADS Check [/b]:



[b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-25 16:26:48
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services [/b]:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Yahoo!\\Messenger\\YPager.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YPager.exe:*:Enabled:Yahoo! Messenger"
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe:*:Enabled:Yahoo! FT Server"
"C:\\Program Files\\HP\\HP Software Update\\HPWUCli.exe"="C:\\Program Files\\HP\\HP Software Update\\HPWUCli.exe:*:Enabled:HP Software Update Client"
"C:\\Program Files\\IncrediMail\\bin\\IMApp.exe"="C:\\Program Files\\IncrediMail\\bin\\IMApp.exe:*:Enabled:IncrediMail"
"C:\\Program Files\\IncrediMail\\bin\\IncMail.exe"="C:\\Program Files\\IncrediMail\\bin\\IncMail.exe:*:Enabled:IncrediMail"
"C:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"="C:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe:*:Enabled:IncrediMail"
"C:\\Program Files\\Poker3d\\underware.exe"="C:\\Program Files\\Poker3d\\underware.exe:*:Enabled:underware"
"C:\\Program Files\\Poker3d\\example\\poker\\poker3d_xwnc.exe"="C:\\Program Files\\Poker3d\\example\\poker\\poker3d_xwnc.exe:*:Enabled:poker3d_xwnc"
"C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Disabled:eMule"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\Documents and Settings\\campiond\\Mes documents\\incredimail_install.exe"="C:\\Documents and Settings\\campiond\\Mes documents\\incredimail_install.exe:*:Enabled:IncrediMail Installer"
"C:\\Program Files\\Ares\\Ares.exe"="C:\\Program Files\\Ares\\Ares.exe:*:Enabled:Ares p2p for windows"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[b]Remaining Files [/b]:


File Backups: - C:\SDFix\backups\backups.zip

[b]Files with Hidden Attributes [/b]:

Tue 23 Sep 2008 1,111,368 ...H. --- "C:\Program Files\Ancient Wonderland\Ancient Wonderland.exe"
Wed 24 Sep 2008 4,580,680 ...H. --- "C:\Program Files\Sherlock Holmes - Le Mystere du Tapis Persan\casual.exe"
Mon 15 Sep 2008 2,700,616 ...H. --- "C:\Program Files\Snow Queen Mahjong\snowqueen.exe"
Mon 7 Jul 2008 1,429,840 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe"
Mon 7 Jul 2008 4,891,472 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
Mon 7 Jul 2008 2,156,368 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
Wed 15 Mar 2006 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Wed 20 Dec 2006 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp"
Wed 17 Sep 2008 5,538 ...HR --- "C:\Documents and Settings\campiond\Application Data\SecuROM\UserData\securom_v7_01.bak"
Wed 15 Mar 2006 4,348 A..H. --- "C:\Documents and Settings\campiond\Mes documents\Ma musique\Sauvegarde de la licence\drmv1key.bak"
Thu 8 Jun 2006 20 A..H. --- "C:\Documents and Settings\campiond\Mes documents\Ma musique\Sauvegarde de la licence\drmv1lic.bak"
Sat 18 Mar 2006 400 A.SH. --- "C:\Documents and Settings\campiond\Mes documents\Ma musique\Sauvegarde de la licence\drmv2key.bak"

[b]Finished![/b]

------- LOGFILE OF AD-REMOVER 1.0.9.3 | ONLY XP/VISTA -------

Updated by C_XX on 17/01/2009 at 12:00

Start at: 16:42:19 | Dim 25/01/2009 | Microsoft® Windows XP™ SP2 (V5.1.2600)
Boot mode: MSE
Option: SCAN | Executed from: C:\Program Files\Ad-remover\Ad-remover.bat
Pc: CAMPION | User: Administrateur ( Current user is an administrator)
Drive(s):
- C:\ (File System: NTFS)
- D:\ (File System: CDFS)
- E:\ (File System: FAT)
System Drive: C:\
Windows Directory: C:\WINDOWS\
System Directory: C:\WINDOWS\System32\

--- Running Processes: 12

+--------------------| Boonty/Boonty Games Elements Found :

.
HKCR\boontybox
HKCR\Typelib\{BB8AC401-701B-4ED1-96BB-B84A0FCF5874}
HKLM\Software\Boonty
HKLM\Software\Classes\boontybox
HKLM\SYSTEM\ControlSet001\Services\Boonty Games
HKLM\SYSTEM\ControlSet002\Enum\Root\LEGACY_BOONTY_GAMES
HKLM\SYSTEM\ControlSet002\Services\Boonty Games
HKLM\SYSTEM\CurrentControlSet\Services\Boonty Games
HKLM\SYSTEM\ControlSet003\Services\Boonty Games
.
C:\Program Files\Fichiers communs\BOONTY Shared
C:\Program Files\Fichiers communs\BOONTY Shared\Service
C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
C:\Documents and Settings\All Users\Application Data\BOONTY
C:\Documents and Settings\All Users\Application Data\BOONTY\Bookworm - NS BB - French
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses
C:\Documents and Settings\All Users\Application Data\BOONTY\Bookworm - NS BB - French\MeSN.ini
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B3186000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B35A1000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B35DE000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B3601000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B362B000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B3697000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B36D8000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B36EC000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B36EF000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B3749000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B375B000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B382E000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B38B9000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B38C2000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B392B000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B393C000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B39E0000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B39E5000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B3A4F000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B3A94000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B3AC8000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B3B26000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B3B96000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B3BA0000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B3BE9000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B3C21000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B3C31000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B3CBC000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B3CDF000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B3D6A000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B3DB5000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B3DB8000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B3DD0000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B410F000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B4138000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B4172000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B41B3000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B41BF000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B41C7000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B41CE000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B4231000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B42F5000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B435B000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B43BA000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B4410000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B4422000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B4505000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B4543000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B4629000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B46B4000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B4785000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B482C000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B487E000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B4892000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B4898000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B48AC000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B48B9000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B48C5000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B48F3000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B4939000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B494E000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B4984000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B498E000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B4991000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B4998000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B49E7000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B4A5D000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B4A87000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B4B19000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B4BF5000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B4C2E000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B4C9B000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B4D4A000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B4D64000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B4D6D000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B4D72000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B4DB6000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B4DBA000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B4DD1000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B4E55000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B4EA8000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B4EB6000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B4F53000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B4F59000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B4F89000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B50F4000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B50FB000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B511B000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B5147000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B518A000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B5210000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B5277000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B52BD000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B5316000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B5482000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B5529000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B5690000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B56AF000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B5753000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B58D2000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B597B000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B59F4000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B5A5B000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B5A92000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B5AFD000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B5B11000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B5C61000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B5F8A000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B6CE0000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B70DA000.dat
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B7EDF000.dat
C:\Documents and Settings\All Users\Menudm~1\Progra~1\BoontyGames
C:\Documents and Settings\All Users\Menudm~1\Progra~1\BoontyGames\ Downloadable games.url
C:\Documents and Settings\All Users\Menudm~1\Progra~1\BoontyGames\ Jeux … t‚l‚charger.url

+--------------------| Eorezo Elements Found :

.
.

+--------------------| Everest Casino/Everest Poker Elements Found :

.
.

+--------------------| Funwebproducts/Myway/Mywebsearch/Myglobalsearch Elements Found :

.
.

+--------------------| It's TV Elements Found :

.

+--------------------| Sweetim Elements Found :

.
.

+--------------------| Added Scan :

~~~~ INTERNET EXPLORER VERSION 7.0.5730.11 ~~~~

+--[HKEY_CURRENT_USER\..\INTERNET EXPLORER\MAIN]

Start page : hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

+--[HKEY_LOCAL_MACHINE\..\INTERNET EXPLORER\MAIN]

Start page : hxxp://www.google.com

+---------------------------------------------------------------------------+

[~11717 BYTES] - "C:\AD-REPORT-SCAN-25.01.2009.LOG"

End at: 16:43:46 | 25/01/2009 - Time elapsed: 86.7 seconds

+---------------------------------------------------------------------------+
+------------------------------- [ E.O.F - 168 Lines ]
+---------------------------------------------------------------------------+

------- LOGFILE OF AD-REMOVER 1.0.9.3 | ONLY XP/VISTA -------

Updated by C_XX on 17/01/2009 at 12:00

*** LIMITED TO ***

Boonty/Boontygames
Eorezo
Everest casino/Everest poker
Funwebproduct/Myway/Mywebsearch
It's TV
Sweetim

******************

Start at: 16:49:20 | Dim 25/01/2009 | Microsoft® Windows XP™ SP2 (V5.1.2600)
Boot mode: MSE
Option: CLEAN | Executed from: C:\Program Files\Ad-remover\Ad-remover.bat
Pc: CAMPION | User: Administrateur ( Current user is an administrator)
Drive(s):
- C:\ (File System: NTFS)
- D:\ (File System: CDFS)
System Drive: C:\
Windows Directory: C:\WINDOWS\
System Directory: C:\WINDOWS\System32\

--- Running Processes: 12

(!) ---- IE start pages reset

+--------------------| Boonty/Boonty Games Elements Deleted :

.
HKCR\boontybox
HKCR\Typelib\{BB8AC401-701B-4ED1-96BB-B84A0FCF5874}
HKLM\Software\Boonty
HKLM\SYSTEM\ControlSet001\Services\Boonty Games
HKLM\SYSTEM\ControlSet002\Enum\Root\LEGACY_BOONTY_GAMES
HKLM\SYSTEM\ControlSet002\Services\Boonty Games
HKLM\SYSTEM\ControlSet003\Services\Boonty Games
.
C:\Program Files\Fichiers communs\BOONTY Shared
C:\Documents and Settings\All Users\Application Data\BOONTY
C:\Documents and Settings\All Users\Menudm~1\Progra~1\BoontyGames

+--------------------| Eorezo Elements Deleted :

.
.

+--------------------| Everest Casino/Everest Poker Elements Deleted :

.
.

+--------------------| Funwebproducts/Myway/Mywebsearch/Myglobalsearch Elements Deleted :

.
.

+--------------------| It's TV Elements Deleted :

.

+--------------------| Sweetim Elements Deleted :

.
.

(!) ---- Temp files deleted.
(!) ---- Recycle bin emptied in all drives.


+--------------------| Added Scan :

+---------------------------------------------------------------------------+


~~~~ INTERNET EXPLORER VERSION 7.0.5730.11 ~~~~

+--[HKEY_CURRENT_USER\..\INTERNET EXPLORER\MAIN]

Start page : hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

+--[HKEY_LOCAL_MACHINE\..\INTERNET EXPLORER\MAIN]

Start page : hxxp://fr.msn.com/

+---------------------------------------------------------------------------+

[~2191 BYTES] - "C:\AD-REPORT-CLEAN-25.01.2009.LOG"
[~12051 BYTES] - "C:\AD-REPORT-SCAN-25.01.2009.LOG"

End at: 16:51:14 | 25/01/2009 - Time elapsed: 1 minute, 54 seconds

+---------------------------------------------------------------------------+
+------------------------------- [ E.O.F - 59 Lines ]
+---------------------------------------------------------------------------+

info.txt :

info.txt logfile of random's system information tool 1.05 2009-01-25 16:57:59

======Uninstall list======

-->C:\Program Files\Ahead\nero\uninstall\UNNERO.exe /UNINSTALL
-->C:\WINDOWS\IsUn040c.exe -fC:\WINDOWS\orun32.isu
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{63A317D0-60A6-43FC-848A-9FE4A53B29CE}\setup.exe" -l0x40c
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{88B1984E-36F0-47B8-B8DC-728966807A9C}\SETUP.EXE" -l0x40c
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A82F10CB-18B5-4EAC-AEF2-FA49CD565626}\setup.exe" -l0x40c
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E5ABA5FD-EE3D-4F15-895D-B32321E6C96B}\setup.exe" -l0x40c
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
3 petites souris-->C:\Program Files\InstallShield Installation Information\{C1A67C8C-EEE6-4997-A470-547DE718FA85}\setup.exe -runfromtemp -l0x040c -removeonly
50 jeux pour enfants-->MsiExec.exe /I{6810018A-5A92-42E8-9901-B60A28D7AC0F}
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)-->MsiExec.exe /X{6846389C-BAC0-4374-808E-B120F86AF5D7}
Adobe Flash Player ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Reader 8.1.2 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A81200000003}
Adobe Shockwave Player-->C:\WINDOWS\system32\Adobe\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Adobe\SHOCKW~1\Install.log
Adssite Advanced Toolbar-->C:\Program Files\Adssite Advanced Toolbar\uninstall.exe
Ancient Wonderland-->"C:\Program Files\Ancient Wonderland\Uninstall.exe"
Assistant de connexion Windows Live-->MsiExec.exe /I{AFA4E5FD-ED70-4D92-99D0-162FD56DC986}
avast! Antivirus-->C:\Program Files\Alwil Software\Avast4\aswRunDll.exe "C:\Program Files\Alwil Software\Avast4\Setup\setiface.dll",RunSetup
Big Fish Games Client-->C:\Program Files\bfgclient\Uninstall.exe
Bookworm Deluxe-->"C:\Program Files\Zylom Games\Bookworm Deluxe\GameInstaller.exe" --uninstall UnInstall.log
Canon Camera Support Core Library-->C:\Program Files\Fichiers communs\InstallShield\Driver\8\Intel 32\IDriver.exe /M{26BDE7D8-93F0-4A07-AD47-1707DB417941} /l1036
Canon Camera Window for ZoomBrowser EX-->C:\Program Files\Fichiers communs\InstallShield\Driver\8\Intel 32\IDriver.exe /M{B34BE30D-A759-4EC2-B58F-19FE2DEBF651}
Canon Internet Library for ZoomBrowser EX-->C:\Program Files\Fichiers communs\InstallShield\Driver\8\Intel 32\IDriver.exe /M{2F81FBFC-9A37-431F-9050-14B55485DF5A}
Canon MovieEdit Task for ZoomBrowser EX-->C:\Program Files\Fichiers communs\InstallShield\Driver\8\Intel 32\IDriver.exe /M{DE286975-ACF1-45B8-9EF7-34E162B2C817}
Canon PhotoRecord-->MsiExec.exe /X{BEF56F2D-56ED-4176-BF72-7B68D4A3B98D}
Canon RAW Image Task for ZoomBrowser EX-->C:\Program Files\Fichiers communs\InstallShield\Driver\8\Intel 32\IDriver.exe /M{68E7E8BD-2233-49BE-81D6-1A1FAF1B5196}
Canon RemoteCapture Task for ZoomBrowser EX-->C:\Program Files\Fichiers communs\InstallShield\Driver\8\Intel 32\IDriver.exe /M{CF2C1A86-5A98-4862-A3AE-9992E3A6427D}
Canon Utilities PhotoStitch 3.1-->C:\Program Files\Fichiers communs\InstallShield\Driver\8\Intel 32\IDriver.exe /M{EF4C7EB0-D71B-43A3-9552-8053DE4B0401}
Canon Utilities ZoomBrowser EX-->MsiExec.exe /X{C1D76D7A-F3BB-47EA-A746-5B1E2FFC1DF2}
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
C-Media High Definition Audio Driver-->C:\WINDOWS\system32\cmirmdrv.exe
Commandos Strike Force-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{544DB849-AB59-4C12-A333-2F214E24870F}\Setup.exe" -l0x40c -removeonly
Creative Live! Cam Vista IM Driver (1.01.03.1104)-->C:\WINDOWS\CtDrvIns.exe -uninstall -script VF0260.uns -unsext NT -plugin V0260Pin.dll -pluginres CtCamPin.crl
Creative Modem Blaster V.92 DI5733-->agrsmdel
Creative Modem Blaster V.92 DI5733-1-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C1C0717C-546A-11D7-9963-00A0C92C4EC3}\setup.exe" -l0x40c /remove
Creative Software AutoUpdate-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{88B1984E-36F0-47B8-B8DC-728966807A9C}\SETUP.EXE" -l0x40c /remove
Creative System Information-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{63A317D0-60A6-43FC-848A-9FE4A53B29CE}\setup.exe" -l0x40c /remove
Creative WebCam Center-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E5ABA5FD-EE3D-4F15-895D-B32321E6C96B}\setup.exe" -l0x40c /remove
DataCastComponent-->C:\Program Files\InstallShield Installation Information\{0354C0B5-AA35-49D8-B7B7-1CF3412465DD}\setup.exe -runfromtemp -l0x040c -removeonly
Emperor's Mahjong pour Windows-->C:\WINDOWS\unvise32.exe C:\Program Files\Mindscape\Mahjong Windows\uninstal.log
Extension de Windows Live Toolbar (Windows Live Toolbar)-->MsiExec.exe /X{0CA6047C-D28B-4295-834A-07C52BA20C2D}
Extension HighMAT pour l'Assistant Graver un CD de Microsoft Windows XP-->MsiExec.exe /X{FCE65C4E-B0E8-4FBD-AD16-EDCBE6CD591F}
Favorit-->"c:\documents and settings\campiond\local settings\application data\eiioq.exe" -uninstall
Galerie de photos Windows Live-->MsiExec.exe /X{A70FA218-6598-4AC9-813D-63597C5DD068}
GameShadow-->MsiExec.exe /I{141FBF87-4FB4-41E1-80B4-E1389268D541}
GdiplusUpgrade-->MsiExec.exe /I{5421155F-B033-49DB-9B33-8F80F233D4D5}
Google Toolbar for Internet Explorer-->MsiExec.exe /I{DBEA1034-5882-4A88-8033-81C4EF0CFA29}
Google Toolbar for Internet Explorer-->regsvr32 /u /s "c:\program files\google\googletoolbar1.dll"
HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
HP Extended Capabilities 4.7-->C:\Program Files\HP\Digital Imaging\ExtCapUninstall\hpzscr01.exe -datfile hpqhsc01.dat
HP Image Zone 4.7-->C:\Program Files\HP\Digital Imaging\uninstall\hpzscr01.exe -datfile hpqscr01.dat
HP PSC & OfficeJet 4.7-->"C:\Program Files\HP\Digital Imaging\{342C7C88-D335-4bc2-8CF1-281857629CE2}\setup\hpzscr01.exe" -datfile hposcr05.dat
HP Software Update-->MsiExec.exe /X{15EE79F4-4ED1-4267-9B0F-351009325D7D}
InterVideo WinDVD-->"C:\Program Files\InstallShield Installation Information\{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}\setup.exe" REMOVEALL
J2SE Runtime Environment 5.0 Update 10-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150100}
J2SE Runtime Environment 5.0 Update 11-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150110}
J2SE Runtime Environment 5.0 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150070}
J2SE Runtime Environment 5.0 Update 8-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150080}
J2SE Runtime Environment 5.0 Update 9-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150090}
Java(TM) 6 Update 2-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160020}
Java(TM) 6 Update 3-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030}
Java(TM) 6 Update 5-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}
Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
Java(TM) SE Runtime Environment 6 Update 1-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160010}
Jeu de Tarot-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{23A32D12-5C71-46F3-801D-A2896C2B6792}\SETUP.EXE" -l0x40c
La Quete au Tresor-->"C:\Program Files\Anuman Interactive\La Quete au Tresor\unins000.exe"
Lapin Malin Initiation à l'anglais v2-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E13AE282-1E35-412D-9D4B-9FE3B81D3813}\setup.exe"
Lapin Malin Maternelle GS-CP-->C:\WINDOWS\unin040c.exe -fC:\TLCWIN\RRK\uninstal\DeIsL1.isu
Lecteur Windows Media 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
Ma Ferme 3D-->C:\Program Files\SDLL\Ma Ferme 3D\Uninstal.exe
Mega Pixel Camera (8101 SXGA)-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{1D0A3306-4E5E-4B3C-BAC1-62D8C2D03521}\Setup.exe" -l0x9
Menus intelligents (Windows Live Toolbar)-->MsiExec.exe /X{0CC70FEF-5068-4CD5-B4DE-86FFD98EC929}
Micro Application - Belote et Coinche/Contrée-->C:\WINDOWS\IsUn040c.exe -f"C:\Program Files\Micro Application\Belote et Coinche Contrée\Uninst.isu"
Microsoft .NET Framework 1.1 French Language Pack-->MsiExec.exe /X{9A394342-4A68-4EBA-85A6-55B559F4E700}
Microsoft .NET Framework 1.1 Hotfix (KB928366)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Office FrontPage 2003-->MsiExec.exe /I{9017040C-6000-11D3-8CFE-0150048383C9}
Microsoft Office OneNote 2003-->MsiExec.exe /I{90A1040C-6000-11D3-8CFE-0150048383C9}
Microsoft Office PowerPoint Viewer 2003-->MsiExec.exe /X{90AF040C-6000-11D3-8CFE-0150048383C9}
Microsoft Office Professional Edition 2003-->MsiExec.exe /I{9011040C-6000-11D3-8CFE-0150048383C9}
Microsoft Office Project Professional 2003-->MsiExec.exe /I{903B040C-6000-11D3-8CFE-0150048383C9}
Microsoft Office Visio Professional 2003-->MsiExec.exe /I{9051040C-6000-11D3-8CFE-0150048383C9}
Microsoft SQL Server 2005 Compact Edition [ENU]-->MsiExec.exe /I{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}
Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Works 2000-->MsiExec.exe /I{A3088CD2-612B-11D3-AF43-00C04F443448}
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB938127)-->"C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB942615)-->"C:\WINDOWS\ie7updates\KB942615-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB944533)-->"C:\WINDOWS\ie7updates\KB944533-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB950759)-->"C:\WINDOWS\ie7updates\KB950759-IE7\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows Internet Explorer 7 (KB953838)-->"C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\spuninst.exe"
MSXML 4.0 SP2 (KB927978)-->MsiExec.exe /I{37477865-A3F1-4772-AD43-AAFC6BCFF99F}
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
Mysteryville Deluxe-->"C:\Program Files\Zylom Games\Mysteryville Deluxe\GameInstlr.exe" --uninstall UnInstall.log
Nero Suite-->C:\Program Files\Fichiers communs\Ahead\Uninstall\Setup.exe /uninstall
Neuf - Kit de connexion-->C:\Program Files\Neuf\Kit\uninstall.exe
NVIDIA Drivers-->C:\WINDOWS\system32\nvudisp.exe UninstallGUI
QuickTime-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\11\INTEL3~1\IDriver.exe /M{929408E6-D265-4174-805F-81D1D914E2A4} /l1036
REALTEK Gigabit and Fast Ethernet NIC Driver-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{94FB906A-CF42-4128-A509-D353026A607E}\setup.exe" -l0x40c REMOVE
Recover Pro-->C:\Program Files\Phoenix Technologies Ltd\RecoverPro_XP\un_vback.exe
SafeCast Shared Components-->C:\Program Files\Fichiers communs\Macrovision Shared\SafeCast\Install\CDAC13BA.EXE /uninstall
SAMSUNG CDMA Modem Driver Set-->C:\WINDOWS\system32\Samsung_USB_Drivers\3\SSCDUninstall.exe
Samsung Media Studio-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C20CE592-B0F8-4D20-BF31-0151CA6331A6}\Setup.exe" -l0x40c
SAMSUNG Mobile USB Modem 1.0 Software-->C:\WINDOWS\system32\Samsung_USB_Drivers\1\SS_Uninstall.exe
SAMSUNG Mobile USB Modem Software-->C:\WINDOWS\system32\Samsung_USB_Drivers\2\SSM_Uninstall.exe
Samsung PC Studio-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C4A4722E-79F9-417C-BD72-8D359A090C97}\setup.exe" -l0x40c -removeonly
Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Sherlock Holmes: Le Mystère du Tapis Persan-->"C:\Program Files\Sherlock Holmes - Le Mystere du Tapis Persan\Uninstall.exe"
Snow Queen Mahjong-->"C:\Program Files\Snow Queen Mahjong\Uninstall.exe"
Soldner-->C:\WINDOWS\unvise32.exe C:\Program Files\SoldnerSecretWars\uninstal.log
Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins001.exe"
Surligneur (Windows Live Toolbar)-->MsiExec.exe /X{81B5F83F-2291-48B0-8375-36B63A9BF5B0}
Téléchargeur de Singles 2 fr-->"C:\Program Files\Téléchargeur de Singles 2\unins000.exe"
Visionneuse Journal Windows Microsoft-->MsiExec.exe /X{43DCF766-6838-4F9A-8C91-D92DA586DFA7}
Windows Imaging Component-->"C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
Windows Internet Explorer 7-->"C:\WINDOWS\ie7\spuninst\spuninst.exe"
Windows Live installer-->MsiExec.exe /X{FD44E544-E7D0-4DBA-9FA0-8AE1A1300390}
Windows Live Messenger-->MsiExec.exe /X{BADF6744-3787-48F6-B8C9-4C4995401D65}
Windows Live Toolbar-->MsiExec.exe /X{0A8C97AD-DEED-4894-B446-3ABA95A77D0D}
Windows Live Writer-->MsiExec.exe /X{3DFF4274-EBB0-4356-9692-972965018954}
Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
Yahoo! Messenger Explorer Bar-->C:\WINDOWS\system32\regsvr32 /u /s C:\PROGRA~1\Yahoo!\COMPAN~1\Modules\messmod4\v6\yhexbmes.dll

======Hosts File======

127.0.0.1 localhost

======Security center information======

AV: avast! antivirus 4.8.1229 [VPS 080930-0]

System event log

Computer Name: CAMPION
Event Code: 7036
Message: Le service Pml Driver HPZ12 est entré dans l'état : en cours d'exécution.

Record Number: 631792
Source Name: Service Control Manager
Time Written: 20080927192118.000000+120
Event Type: Informations
User:

Computer Name: CAMPION
Event Code: 7036
Message: Le service Pml Driver HPZ12 est entré dans l'état : arrêté.

Record Number: 631791
Source Name: Service Control Manager
Time Written: 20080927191918.000000+120
Event Type: Informations
User:

Computer Name: CAMPION
Event Code: 7035
Message: Un contrôle Démarrer a correctement été envoyé au service Pml Driver HPZ12.

Record Number: 631790
Source Name: Service Control Manager
Time Written: 20080927191918.000000+120
Event Type: Informations
User: CAMPION\campiond

Computer Name: CAMPION
Event Code: 7036
Message: Le service Pml Driver HPZ12 est entré dans l'état : en cours d'exécution.

Record Number: 631789
Source Name: Service Control Manager
Time Written: 20080927191918.000000+120
Event Type: Informations
User:

Computer Name: CAMPION
Event Code: 7036
Message: Le service Pml Driver HPZ12 est entré dans l'état : arrêté.

Record Number: 631788
Source Name: Service Control Manager
Time Written: 20080927191718.000000+120
Event Type: Informations
User:

Application event log

Computer Name: CAMPION
Event Code: 1000
Message: Application défaillante iexplore.exe, version 7.0.6000.16574, module défaillant flash9b.ocx, version 9.0.28.0, adresse de défaillance 0x00099589.

Record Number: 2138
Source Name: Application Error
Time Written: 20080129182455.000000+060
Event Type: erreur
User:

Computer Name: CAMPION
Event Code: 1800
Message: Le service Centre de sécurité Windows a démarré.

Record Number: 2137
Source Name: SecurityCenter
Time Written: 20080129112402.000000+060
Event Type: Informations
User:

Computer Name: CAMPION
Event Code: 0
Message:
Record Number: 2136
Source Name: gusvc
Time Written: 20080129112247.000000+060
Event Type: Informations
User:

Computer Name: CAMPION
Event Code: 101
Message: MsnMsgr (124) Le moteur de base de données est arrêté.

Record Number: 2135
Source Name: ESENT
Time Written: 20080128124300.000000+060
Event Type: Informations
User:

Computer Name: CAMPION
Event Code: 103
Message: MsnMsgr (124) \\.\C:\Documents and Settings\campiond\Local Settings\Application Data\Microsoft\Messenger\isacampion@hotmail.fr\SharingMetadata\Working\database_E6C8_FCAB_C8FC_7ADF\dfsr.db: Le moteur de base de données a arrêté une instance (0).

Record Number: 2134
Source Name: ESENT
Time Written: 20080128124300.000000+060
Event Type: Informations
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\QuickTime\QTSystem\
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 4 Stepping 1, GenuineIntel
"PROCESSOR_REVISION"=0401
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"CLASSPATH"=C:\Program Files\Java\jre1.5.0_08\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files\Java\jre1.5.0_08\lib\ext\QTJava.zip
"SAFEBOOT_OPTION"=MINIMAL

-----------------EOF-----------------






log.txt :
Logfile of random's system information tool 1.05 (written by random/random)
Run by Administrateur at 2009-01-25 16:57:37
Microsoft Windows XP Édition familiale Service Pack 2
System drive C: has 12 GB (9%) free of 133 GB
Total RAM: 511 MB (59% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:57:56, on 25/01/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Safe mode

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
E:\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Administrateur.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://actus.sfr.fr
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://runonce.msn.com/runonce3.aspx
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {971C3384-F75E-4562-95B3-CBE7417529BC} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O2 - BHO: (no name) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: (no name) - {41C29B07-6F91-4966-91BE-2E2841643C83} - (no file)
O3 - Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [RestoreIT!] "C:\Program Files\Phoenix Technologies Ltd\RecoverPro_XP\VBPTASK.EXE" VBStart
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SMSTray] C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Lancement rapide de Microsoft Office OneNote 2003.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
O4 - Global Startup: Rappels du Calendrier Microsoft Works.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PacificPoker4 - {94EDF7B4-4272-4af3-8F8B-4E2F68E225B7} - C:\PROGRA~1\PACIFI~1\pacificpoker.exe (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {86EEF11E-FF16-48CE-B1A2-474B663041A9} - http://kit.carpediem.fr/22226/CD/ParisFetish.exe
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} -
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://gamenextfr.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PsShutdown (PsShutdownSvc) - Systems Internals - C:\WINDOWS\System32\PSSDNSVC.EXE

Faut le faire ne mode sans échec ou pas ?

Malwarebytes' Anti-Malware 1.33
Version de la base de données: 1654
Windows 5.1.2600 Service Pack 2

25/01/2009 18:41:03
mbam-log-2009-01-25 (18-40-57).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 149914
Temps écoulé: 1 hour(s), 17 minute(s), 17 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 15
Valeur(s) du Registre infectée(s): 5
Elément(s) de données du Registre infecté(s): 2
Dossier(s) infecté(s): 11
Fichier(s) infecté(s): 21

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9c8a568e-4201-478a-8536-526cf371d2e2} (Adware.BHO) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{df780f87-ff2b-4df8-92d0-73db16a1543a} (Adware.PopCap) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{36a91cec-6c71-4758-b492-397bfc8e96a2} (Adware.Rightonadz) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{5929cd6e-2062-44a4-b2c5-2c7e78fbab38} (Fake.Dropped.Malware) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{ed8525ea-2bfc-4440-bd8a-20efb9d5e541} (Adware.Hotbar) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b64f4a7c-97c9-11da-8bde-f66bad1e3f3a} (Rogue.WinAntivirus) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{2d2bee6e-3c9a-4d58-b9ec-458edb28d0f6} (Rogue.DriveCleaner) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1a93c934-025b-4c3a-b38e-9654a7003239} (Adware.Gamesbar) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6f282b65-56bf-4bd1-a8b2-a4449a05863d} (Adware.Gamesbar) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c80b7ff6-ce60-4079-935e-520c045c30a6} (Adware.EGDAccess) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6fd31ed6-7c94-4bbc-8e95-f927f4d3a949} (Adware.180Solutions) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{8fcdf9d9-a28b-480f-8c3d-581f119a8ab8} (Adware.180Solutions) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{deceaaa2-370a-49bb-9362-68c3a58ddc62} (Adware.180Solutions) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Trymedia Systems (Adware.Trymedia) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\HID_Layer (Malware.Trace) -> No action taken.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\eiioq (Adware.Navipromo.H) -> No action taken.
HKEY_CURRENT_USER\Control Panel\Desktop\wallpaper (Hijack.Wallpaper) -> No action taken.
HKEY_CURRENT_USER\Control Panel\Desktop\originalwallpaper (Hijack.Wallpaper) -> No action taken.
HKEY_CURRENT_USER\Control Panel\Desktop\convertedwallpaper (Hijack.Wallpaper) -> No action taken.
HKEY_CURRENT_USER\Control Panel\Desktop\scrnsave.exe (Hijack.Wallpaper) -> No action taken.

Elément(s) de données du Registre infecté(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispBackgroundPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispScrSavPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> No action taken.

Dossier(s) infecté(s):
C:\Documents and Settings\campiond\Application Data\rhcpduj0epf5 (Rogue.Multiple) -> No action taken.
C:\Documents and Settings\campiond\Application Data\rhcpduj0epf5\Quarantine (Rogue.Multiple) -> No action taken.
C:\Documents and Settings\campiond\Application Data\rhcpduj0epf5\Quarantine\Autorun (Rogue.Multiple) -> No action taken.
C:\Documents and Settings\campiond\Application Data\rhcpduj0epf5\Quarantine\Autorun\HKCU (Rogue.Multiple) -> No action taken.
C:\Documents and Settings\campiond\Application Data\rhcpduj0epf5\Quarantine\Autorun\HKCU\RunOnce (Rogue.Multiple) -> No action taken.
C:\Documents and Settings\campiond\Application Data\rhcpduj0epf5\Quarantine\Autorun\HKLM (Rogue.Multiple) -> No action taken.
C:\Documents and Settings\campiond\Application Data\rhcpduj0epf5\Quarantine\Autorun\HKLM\RunOnce (Rogue.Multiple) -> No action taken.
C:\Documents and Settings\campiond\Application Data\rhcpduj0epf5\Quarantine\Autorun\StartMenuAllUsers (Rogue.Multiple) -> No action taken.
C:\Documents and Settings\campiond\Application Data\rhcpduj0epf5\Quarantine\Autorun\StartMenuCurrentUser (Rogue.Multiple) -> No action taken.
C:\Documents and Settings\campiond\Application Data\rhcpduj0epf5\Quarantine\BrowserObjects (Rogue.Multiple) -> No action taken.
C:\Documents and Settings\campiond\Application Data\rhcpduj0epf5\Quarantine\Packages (Rogue.Multiple) -> No action taken.

Fichier(s) infecté(s):
C:\Documents and Settings\campiond\Local Settings\Application Data\eiioq_navps.dat (Adware.Navipromo.H) -> No action taken.
C:\Documents and Settings\campiond\Local Settings\Application Data\eiioq_nav.dat (Adware.Navipromo.H) -> No action taken.
C:\Documents and Settings\campiond\Local Settings\Application Data\eiioq.dat (Adware.Navipromo.H) -> No action taken.
C:\Documents and Settings\campiond\Local Settings\Application Data\eiioq.exe (Adware.Navipromo.H) -> No action taken.
C:\System Volume Information\_restore{C66B14E1-5ABF-47FA-9084-8A92337F62F1}\RP708\A0333930.dll (Trojan.Agent) -> No action taken.
C:\System Volume Information\_restore{C66B14E1-5ABF-47FA-9084-8A92337F62F1}\RP754\A0344989.exe (Spyware.Festeal) -> No action taken.
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\824DLUO4\cctr[1].exe (Spyware.Festeal) -> No action taken.
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\UXHTMCG5\cctr[1].exe (Spyware.Festeal) -> No action taken.
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\VJCCE16N\inst602[1].exe (Trojan.Srizbi) -> No action taken.
C:\WINDOWS\system32\dabfgapf_navps.dat (Adware.NaviPromo) -> No action taken.
C:\WINDOWS\system32\ttbgax_navps.dat (Adware.NaviPromo) -> No action taken.
C:\WINDOWS\system32\uvxwapb_navps.dat (Adware.NaviPromo) -> No action taken.
C:\WINDOWS\system32\xtbwlr_navps.dat (Adware.NaviPromo) -> No action taken.
C:\WINDOWS\system32\zdzwjbu_navps.dat (Adware.NaviPromo) -> No action taken.
C:\WINDOWS\system32\dabfgapf_nav.dat (Adware.NaviPromo) -> No action taken.
C:\WINDOWS\system32\ttbgax_nav.dat (Adware.NaviPromo) -> No action taken.
C:\WINDOWS\system32\uvxwapb_nav.dat (Adware.NaviPromo) -> No action taken.
C:\WINDOWS\system32\xtbwlr_nav.dat (Adware.NaviPromo) -> No action taken.
C:\WINDOWS\system32\zdzwjbu_nav.dat (Adware.NaviPromo) -> No action taken.
C:\Documents and Settings\campiond\Local Settings\Temp\.tt1.tmp (Trojan.Downloader) -> No action taken.
C:\Documents and Settings\campiond\Local Settings\Temp\.tt2.tmp (Trojan.Downloader) -> No action taken.

oui

Search Navipromo version 3.7.1 commencé le 25/01/2009 à 18:58:08,31

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files\navilog1

Mise à jour le 02.01.2009 à 19h00 par IL-MAFIOSO

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 2
X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) 4 CPU 3.20GHz )
BIOS : Phoenix - AwardBIOS v6.00PG
USER : campiond ( Administrator )
BOOT : Normal boot

Antivirus : avast! antivirus 4.8.1229 [VPS 080930-0] 4.8.1229 (Activated)


A:\ (USB)
C:\ (Local Disk) - NTFS - Total:129 Go (Free:11 Go)
D:\ (CD or DVD) - CDFS - Total:0 Go (Free:0 Go)
E:\ (USB) - FAT - Total:497 Mo (Free:0 Go)


Recherche executé en mode normal

*** Recherche Programmes installés ***

Favorit

*** Recherche dossiers dans "C:\WINDOWS" ***


*** Recherche dossiers dans "C:\Program Files" ***


*** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1" ***


*** Recherche dossiers dans "c:\docume~1\alluse~1\applic~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\campiond\applic~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1\applic~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\campiond\locals~1\applic~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\campiond\menudm~1\progra~1" ***


*** Recherche dossiers dans "C:\DOCUME~1\ADMINI~1\menudm~1\progra~1" ***


*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net



*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans "C:\WINDOWS\system32" *

* Recherche dans "C:\Documents and Settings\campiond\locals~1\applic~1" *

* Recherche dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" *



*** Recherche fichiers ***


C:\WINDOWS\pack.epk trouvé !

*** Recherche clés spécifiques dans le Registre ***
!! Les clés trouvées ne sont pas forcément infectées !!

HKEY_CURRENT_USER\Software\Lanconfig

*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :


2)Recherche Heuristique :

* Dans "C:\WINDOWS\system32" :

dabfgapf.dat trouvé !
ttbgax.dat trouvé !
uvxwapb.dat trouvé !
xtbwlr.dat trouvé !
zdzwjbu.dat trouvé !

* Dans "C:\Documents and Settings\campiond\locals~1\applic~1" :


* Dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" :


3)Recherche Certificats :

Certificat Egroup trouvé !
Certificat Electronic-Group trouvé !
Certificat Montorgueil absent !
Certificat OOO-Favorit trouvé !
Certificat Sunny-Day-Design-Ltd absent !

4)Recherche autres dossiers et fichiers connus :



*** Analyse terminée le 25/01/2009 à 19:03:52,21 ***

Clean Navipromo version 3.7.1 commencé le 25/01/2009 à 19:13:12,78

Outil exécuté depuis C:\Program Files\navilog1

Mise à jour le 02.01.2009 à 19h00 par IL-MAFIOSO

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 2
X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) 4 CPU 3.20GHz )
BIOS : Phoenix - AwardBIOS v6.00PG
USER : campiond ( Administrator )
BOOT : Normal boot

Antivirus : avast! antivirus 4.8.1229 [VPS 080930-0] 4.8.1229 (Activated)


A:\ (USB)
C:\ (Local Disk) - NTFS - Total:129 Go (Free:11 Go)
D:\ (CD or DVD) - CDFS - Total:0 Go (Free:0 Go)


Mode suppression automatique
avec prise en charge résultats Catchme et GNS


Nettoyage exécuté au redémarrage de l'ordinateur


*** fsbl1.txt non trouvé ***
(Assurez-vous que Catchme n'avait rien trouvé lors de la recherche)


*** Suppression avec sauvegardes résultats GenericNaviSearch ***

* Suppression dans "C:\WINDOWS\System32" *


* Suppression dans "C:\Documents and Settings\campiond\locals~1\applic~1" *


* Suppression dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" *


*** Suppression dossiers dans "C:\WINDOWS" ***


*** Suppression dossiers dans "C:\Program Files" ***


*** Suppression dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" ***


*** Suppression dossiers dans "C:\Documents and Settings\All Users\menudm~1" ***


*** Suppression dossiers dans "c:\docume~1\alluse~1\applic~1" ***


*** Suppression dossiers dans "C:\Documents and Settings\campiond\applic~1" ***


*** Suppression dossiers dans "C:\DOCUME~1\ADMINI~1\applic~1" ***


*** Suppression dossiers dans "C:\Documents and Settings\campiond\locals~1\applic~1" ***


*** Suppression dossiers dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" ***


*** Suppression dossiers dans "C:\Documents and Settings\campiond\menudm~1\progra~1" ***


*** Suppression dossiers dans "C:\DOCUME~1\ADMINI~1\menudm~1\progra~1" ***



*** Suppression fichiers ***

C:\WINDOWS\pack.epk supprimé !

*** Suppression fichiers temporaires ***

Nettoyage contenu C:\WINDOWS\Temp effectué !
Nettoyage contenu C:\Documents and Settings\campiond\locals~1\Temp effectué !

*** Traitement Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Suppression avec sauvegardes nouveaux fichiers Instant Access :

2)Recherche, création sauvegardes et suppression Heuristique :


* Dans "C:\WINDOWS\system32" *


dabfgapf.dat trouvé !
Copie dabfgapf.dat réalisée avec succès !
dabfgapf.dat supprimé !

ttbgax.dat trouvé !
Copie ttbgax.dat réalisée avec succès !
ttbgax.dat supprimé !

uvxwapb.dat trouvé !
Copie uvxwapb.dat réalisée avec succès !
uvxwapb.dat supprimé !

xtbwlr.dat trouvé !
Copie xtbwlr.dat réalisée avec succès !
xtbwlr.dat supprimé !

zdzwjbu.dat trouvé !
Copie zdzwjbu.dat réalisée avec succès !
zdzwjbu.dat supprimé !


* Dans "C:\Documents and Settings\campiond\locals~1\applic~1" *


* Dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" *


*** Sauvegarde du Registre vers dossier Safebackup ***

sauvegarde du Registre réalisée avec succès !

*** Nettoyage Registre ***

Nettoyage Registre Ok


*** Certificats ***

Certificat Egroup supprimé !
Certificat Electronic-Group supprimé !
Certificat Montorgueil absent !
Certificat OOO-Favorit supprimé !
Certificat Sunny-Day-Design-Ltdt absent !

*** Recherche autres dossiers et fichiers connus ***



*** Nettoyage terminé le 25/01/2009 à 19:17:02,32 ***

-------------------------------------------------------------------------------
KASPERSKY ON-LINE SCANNER REPORT
Monday, January 26, 2009 8:28:51 AM
Système d'exploitation : Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky On-line Scanner version : 5.0.84.2
Dernière mise à jour de la base antivirus Kaspersky : 25/01/2009
Enregistrements dans la base antivirus Kaspersky : 1695312
-------------------------------------------------------------------------------

Paramètres d'analyse:
Analyser avec la base antivirus suivante: étendue
Analyser les archives: vrai
Analyser les bases de messagerie: vrai

Cible de l'analyse - Poste de travail:
A:\
C:\
D:\
E:\

Statistiques de l'analyse:
Total d'objets analysés: 101321
Nombre de virus trouvés: 13
Nombre d'objets infectés: 73 / 0
Nombre d'objets suspects: 0
Durée de l'analyse: 04:33:57

Nom de l'objet infecté / Nom du virus / Dernière action
C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\DRM\drmstore.hds L'objet est verrouillé ignoré
C:\Documents and Settings\campiond\Cookies\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\campiond\Local Settings\Application Data\ApplicationHistory\hpqgalry.exe.cf8dd223.ini.inuse L'objet est verrouillé ignoré
C:\Documents and Settings\campiond\Local Settings\Application Data\HP\Digital Imaging\db\administrativeInfo.dbf L'objet est verrouillé ignoré
C:\Documents and Settings\campiond\Local Settings\Application Data\HP\Digital Imaging\db\albumImagesTable.cdx L'objet est verrouillé ignoré
C:\Documents and Settings\campiond\Local Settings\Application Data\HP\Digital Imaging\db\albumImagesTable.dbf L'objet est verrouillé ignoré
C:\Documents and Settings\campiond\Local Settings\Application Data\HP\Digital Imaging\db\albumTable.cdx L'objet est verrouillé ignoré
C:\Documents and Settings\campiond\Local Settings\Application Data\HP\Digital Imaging\db\albumTable.dbf L'objet est verrouillé ignoré
C:\Documents and Settings\campiond\Local Settings\Application Data\HP\Digital Imaging\db\CB_Server_Errors.txt L'objet est verrouillé ignoré
C:\Documents and Settings\campiond\Local Settings\Application Data\HP\Digital Imaging\db\EXIFTable.cdx L'objet est verrouillé ignoré
C:\Documents and Settings\campiond\Local Settings\Application Data\HP\Digital Imaging\db\EXIFTable.dbf L'objet est verrouillé ignoré
C:\Documents and Settings\campiond\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.cdx L'objet est verrouillé ignoré
C:\Documents and Settings\campiond\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.dbf L'objet est verrouillé ignoré
C:\Documents and Settings\campiond\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.fpt L'objet est verrouillé ignoré
C:\Documents and Settings\campiond\Local Settings\Application Data\HP\Digital Imaging\db\keywordImagesTable.cdx L'objet est verrouillé ignoré
C:\Documents and Settings\campiond\Local Settings\Application Data\HP\Digital Imaging\db\keywordImagesTable.dbf L'objet est verrouillé ignoré
C:\Documents and Settings\campiond\Local Settings\Application Data\HP\Digital Imaging\db\keywordTable.cdx L'objet est verrouillé ignoré
C:\Documents and Settings\campiond\Local Settings\Application Data\HP\Digital Imaging\db\keywordTable.dbf L'objet est verrouillé ignoré
C:\Documents and Settings\campiond\Local Settings\Application Data\HP\Digital Imaging\db\managedFolderTable.dbf L'objet est verrouillé ignoré
C:\Documents and Settings\campiond\Local Settings\Application Data\HP\Digital Imaging\db\pathnameTable.cdx L'objet est verrouillé ignoré
C:\Documents and Settings\campiond\Local Settings\Application Data\HP\Digital Imaging\db\pathnameTable.dbf L'objet est verrouillé ignoré
C:\Documents and Settings\campiond\Local Settings\Application Data\HP\Digital Imaging\db\ROFImagesTable.cdx L'objet est verrouillé ignoré
C:\Documents and Settings\campiond\Local Settings\Application Data\HP\Digital Imaging\db\ROFImagesTable.dbf L'objet est verrouillé ignoré
C:\Documents and Settings\campiond\Local Settings\Application Data\HP\Digital Imaging\db\ROFTable.cdx L'objet est verrouillé ignoré
C:\Documents and Settings\campiond\Local Settings\Application Data\HP\Digital Imaging\db\ROFTable.dbf L'objet est verrouillé ignoré
C:\Documents and Settings\campiond\Local Settings\Application Data\Microsoft\Media Player\CurrentDatabase_360.wmdb L'objet est verrouillé ignoré
C:\Documents and Settings\campiond\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré
C:\Documents and Settings\campiond\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\campiond\Local Settings\Historique\History.IE5\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\campiond\Local Settings\Temp\hpodvd09.log L'objet est verrouillé ignoré
C:\Documents and Settings\campiond\Local Settings\Temp\~DF832.tmp L'objet est verrouillé ignoré
C:\Documents and Settings\campiond\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat L'objet est verrouillé ignoré
C:\Documents and Settings\campiond\Local Settings\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\campiond\ntuser.dat L'objet est verrouillé ignoré
C:\Documents and Settings\campiond\ntuser.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\Cookies\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\Local Settings\Historique\History.IE5\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\5XZYPXHF\Crack_28091qw[1].exe Infecté : Trojan-Downloader.Win32.Small.aeaw ignoré
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\5XZYPXHF\Crack_2909qw[1].exe Infecté : Trojan-Downloader.Win32.Small.aedz ignoré
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\5XZYPXHF\psyc2709[1].exe Infecté : Trojan-Mailfinder.Win32.Mailbot.cm ignoré
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\5XZYPXHF\psyc2909[1].exe Infecté : Trojan-Mailfinder.Win32.Mailbot.cj ignoré
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\824DLUO4\Crack_30092qw[1].exe Infecté : Trojan-Downloader.Win32.Small.aeei ignoré
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\824DLUO4\psyc3009[1].exe Infecté : Trojan-Mailfinder.Win32.Mailbot.cp ignoré
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\UXHTMCG5\Crack_2809qw[1].exe Infecté : Trojan-Downloader.Win32.Small.aeaw ignoré
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\UXHTMCG5\Crack_30093qw[1].exe Infecté : Trojan-Downloader.Win32.Small.aeei ignoré
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\UXHTMCG5\psyc2909[1].exe Infecté : Trojan-Mailfinder.Win32.Mailbot.cj ignoré
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\VJCCE16N\Crack_28092qw[1].exe Infecté : Trojan-Downloader.Win32.Small.aeaw ignoré
C:\Documents and Settings\LocalService\NTUSER.DAT L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\ntuser.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\Cookies\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\Local Settings\Historique\History.IE5\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\NTUSER.DAT L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\ntuser.dat.LOG L'objet est verrouillé ignoré
C:\Program Files\Alwil Software\Avast4\DATA\aswResp.dat L'objet est verrouillé ignoré
C:\Program Files\Alwil Software\Avast4\DATA\Avast4.db L'objet est verrouillé ignoré
C:\Program Files\Alwil Software\Avast4\DATA\log\AshWebSv.ws L'objet est verrouillé ignoré
C:\Program Files\Alwil Software\Avast4\DATA\log\aswMaiSv.log L'objet est verrouillé ignoré
C:\Program Files\Alwil Software\Avast4\DATA\log\nshield.log L'objet est verrouillé ignoré
C:\Program Files\Alwil Software\Avast4\DATA\log\selfdef.log L'objet est verrouillé ignoré
C:\Program Files\Alwil Software\Avast4\DATA\moved\.tt17.tmp.vbs.vir Infecté : Backdoor.Win32.Frauder.eo ignoré
C:\Program Files\Alwil Software\Avast4\DATA\moved\.tt7.tmp.vbs.vir Infecté : Backdoor.Win32.Frauder.eo ignoré
C:\Program Files\Alwil Software\Avast4\DATA\report\Protection résidente.txt L'objet est verrouillé ignoré
C:\SDFix\backups\backups.zip/backups/1114911636.exe Infecté : Trojan-Downloader.Win32.Small.aedz ignoré
C:\SDFix\backups\backups.zip/backups/1147157316.exe Infecté : Trojan-Downloader.Win32.Small.aeaw ignoré
C:\SDFix\backups\backups.zip/backups/1153383619.exe Infecté : Trojan-Mailfinder.Win32.Mailbot.cj ignoré
C:\SDFix\backups\backups.zip/backups/1158364659.exe Infecté : Trojan-Mailfinder.Win32.Mailbot.cp ignoré
C:\SDFix\backups\backups.zip/backups/1159675459.exe Infecté : Trojan-Mailfinder.Win32.Mailbot.cm ignoré
C:\SDFix\backups\backups.zip/backups/1168457817.exe Infecté : Trojan-Downloader.Win32.Small.aeaw ignoré
C:\SDFix\backups\backups.zip/backups/1200572419.exe Infecté : Trojan-Downloader.Win32.Small.aeei ignoré
C:\SDFix\backups\backups.zip/backups/blphctduj0epf5.scr Infecté : Trojan.Win32.FraudPack.ijv ignoré
C:\SDFix\backups\backups.zip/backups/CbEvtSvc.exe Infecté : Trojan-Downloader.Win32.Exchanger.adp ignoré
C:\SDFix\backups\backups.zip/backups/lphctduj0epf5.exe Infecté : Trojan-Downloader.Win32.Small.aeei ignoré
C:\SDFix\backups\backups.zip/backups/psyche.exe Infecté : Trojan-Mailfinder.Win32.Mailbot.cj ignoré
C:\SDFix\backups\backups.zip ZIP: infecté - 11 ignoré
C:\System Volume Information\MountPointManagerRemoteDatabase L'objet est verrouillé ignoré
C:\System Volume Information\_restore{C66B14E1-5ABF-47FA-9084-8A92337F62F1}\RP730\A0336602.exe Infecté : not-a-virus:AdWare.Win32.Agent.emd ignoré
C:\System Volume Information\_restore{C66B14E1-5ABF-47FA-9084-8A92337F62F1}\RP734\A0336981.exe Infecté : not-a-virus:Downloader.NSIS.Agent.b ignoré
C:\System Volume Information\_restore{C66B14E1-5ABF-47FA-9084-8A92337F62F1}\RP734\A0336982.exe Infecté : not-a-virus:Downloader.NSIS.Agent.b ignoré
C:\System Volume Information\_restore{C66B14E1-5ABF-47FA-9084-8A92337F62F1}\RP734\A0336983.exe Infecté : not-a-virus:Downloader.NSIS.Agent.b ignoré
C:\System Volume Information\_restore{C66B14E1-5ABF-47FA-9084-8A92337F62F1}\RP734\A0336984.exe Infecté : not-a-virus:Downloader.NSIS.Agent.b ignoré
C:\System Volume Information\_restore{C66B14E1-5ABF-47FA-9084-8A92337F62F1}\RP734\A0336985.exe Infecté : not-a-virus:Downloader.NSIS.Agent.b ignoré
C:\System Volume Information\_restore{C66B14E1-5ABF-47FA-9084-8A92337F62F1}\RP734\A0336986.exe Infecté : not-a-virus:Downloader.NSIS.Agent.b ignoré
C:\System Volume Information\_restore{C66B14E1-5ABF-47FA-9084-8A92337F62F1}\RP734\A0336987.exe Infecté : not-a-virus:Downloader.NSIS.Agent.b ignoré
C:\System Volume Information\_restore{C66B14E1-5ABF-47FA-9084-8A92337F62F1}\RP734\A0336988.exe Infecté : not-a-virus:Downloader.NSIS.Agent.b ignoré
C:\System Volume Information\_restore{C66B14E1-5ABF-47FA-9084-8A92337F62F1}\RP734\A0336989.exe Infecté : not-a-virus:Downloader.NSIS.Agent.b ignoré
C:\System Volume Information\_restore{C66B14E1-5ABF-47FA-9084-8A92337F62F1}\RP734\A0336990.exe Infecté : not-a-virus:Downloader.NSIS.Agent.b ignoré
C:\System Volume Information\_restore{C66B14E1-5ABF-47FA-9084-8A92337F62F1}\RP735\A0337054.exe Infecté : not-a-virus:Downloader.NSIS.Agent.b ignoré
C:\System Volume Information\_restore{C66B14E1-5ABF-47FA-9084-8A92337F62F1}\RP735\A0337055.exe Infecté : not-a-virus:Downloader.NSIS.Agent.b ignoré
C:\System Volume Information\_restore{C66B14E1-5ABF-47FA-9084-8A92337F62F1}\RP735\A0337056.exe Infecté : not-a-virus:Downloader.NSIS.Agent.b ignoré
C:\System Volume Information\_restore{C66B14E1-5ABF-47FA-9084-8A92337F62F1}\RP735\A0337057.exe Infecté : not-a-virus:Downloader.NSIS.Agent.b ignoré
C:\System Volume Information\_restore{C66B14E1-5ABF-47FA-9084-8A92337F62F1}\RP736\A0337114.exe Infecté : not-a-virus:Downloader.NSIS.Agent.b ignoré
C:\System Volume Information\_restore{C66B14E1-5ABF-47FA-9084-8A92337F62F1}\RP737\A0337150.exe Infecté : not-a-virus:Downloader.NSIS.Agent.b ignoré
C:\System Volume Information\_restore{C66B14E1-5ABF-47FA-9084-8A92337F62F1}\RP737\A0337151.exe Infecté : not-a-virus:Downloader.NSIS.Agent.b ignoré
C:\System Volume Information\_restore{C66B14E1-5ABF-47FA-9084-8A92337F62F1}\RP745\A0339578.exe Infecté : not-a-virus:Downloader.NSIS.Agent.b ignoré
C:\System Volume Information\_restore{C66B14E1-5ABF-47FA-9084-8A92337F62F1}\RP746\A0339629.exe Infecté : not-a-virus:Downloader.NSIS.Agent.b ignoré
C:\System Volume Information\_restore{C66B14E1-5ABF-47FA-9084-8A92337F62F1}\RP752\A0344796.exe Infecté : not-a-virus:FraudTool.Win32.AntivirusXP2008.ca ignoré
C:\System Volume Information\_restore{C66B14E1-5ABF-47FA-9084-8A92337F62F1}\RP754\A0344990.exe Infecté : Trojan-Mailfinder.Win32.Mailbot.cj ignoré
C:\System Volume Information\_restore{C66B14E1-5ABF-47FA-9084-8A92337F62F1}\RP755\A0383147.exe Infecté : Trojan-Mailfinder.Win32.Mailbot.cp ignoré
C:\System Volume Information\_restore{C66B14E1-5ABF-47FA-9084-8A92337F62F1}\RP755\A0383148.exe Infecté : Trojan-Downloader.Win32.Small.aeei ignoré
C:\System Volume Information\_restore{C66B14E1-5ABF-47FA-9084-8A92337F62F1}\RP755\A0383151.exe Infecté : Trojan-Mailfinder.Win32.Mailbot.cj ignoré
C:\System Volume Information\_restore{C66B14E1-5ABF-47FA-9084-8A92337F62F1}\RP755\A0383152.exe Infecté : Trojan-Mailfinder.Win32.Mailbot.cj ignoré
C:\System Volume Information\_restore{C66B14E1-5ABF-47FA-9084-8A92337F62F1}\RP755\A0383153.exe Infecté : Trojan-Downloader.Win32.Small.aeei ignoré
C:\System Volume Information\_restore{C66B14E1-5ABF-47FA-9084-8A92337F62F1}\RP755\A0383306.exe Infecté : Trojan-Downloader.Win32.Small.aedz ignoré
C:\System Volume Information\_restore{C66B14E1-5ABF-47FA-9084-8A92337F62F1}\RP755\A0388309.exe Infecté : Trojan-Downloader.Win32.Small.aeei ignoré
C:\System Volume Information\_restore{C66B14E1-5ABF-47FA-9084-8A92337F62F1}\RP755\A0388312.exe Infecté : Trojan-Downloader.Win32.Small.aedz ignoré
C:\System Volume Information\_restore{C66B14E1-5ABF-47FA-9084-8A92337F62F1}\RP755\A0388313.exe Infecté : Trojan-Downloader.Win32.Small.aeaw ignoré
C:\System Volume Information\_restore{C66B14E1-5ABF-47FA-9084-8A92337F62F1}\RP755\A0388314.exe Infecté : Trojan-Mailfinder.Win32.Mailbot.cj ignoré
C:\System Volume Information\_restore{C66B14E1-5ABF-47FA-9084-8A92337F62F1}\RP755\A0388315.exe Infecté : Trojan-Mailfinder.Win32.Mailbot.cp ignoré
C:\System Volume Information\_restore{C66B14E1-5ABF-47FA-9084-8A92337F62F1}\RP755\A0388316.exe Infecté : Trojan-Mailfinder.Win32.Mailbot.cm ignoré
C:\System Volume Information\_restore{C66B14E1-5ABF-47FA-9084-8A92337F62F1}\RP755\A0388317.exe Infecté : Trojan-Downloader.Win32.Small.aeaw ignoré
C:\System Volume Information\_restore{C66B14E1-5ABF-47FA-9084-8A92337F62F1}\RP755\A0388318.exe Infecté : Trojan-Downloader.Win32.Small.aeei ignoré
C:\System Volume Information\_restore{C66B14E1-5ABF-47FA-9084-8A92337F62F1}\RP755\A0388320.exe Infecté : Trojan-Mailfinder.Win32.Mailbot.cj ignoré
C:\System Volume Information\_restore{C66B14E1-5ABF-47FA-9084-8A92337F62F1}\RP755\A0388324.exe Infecté : Trojan-Downloader.Win32.Small.aedz ignoré
C:\System Volume Information\_restore{C66B14E1-5ABF-47FA-9084-8A92337F62F1}\RP755\A0388325.exe Infecté : Trojan-Downloader.Win32.Small.aeaw ignoré
C:\System Volume Information\_restore{C66B14E1-5ABF-47FA-9084-8A92337F62F1}\RP755\A0388326.exe Infecté : Trojan-Mailfinder.Win32.Mailbot.cj ignoré
C:\System Volume Information\_restore{C66B14E1-5ABF-47FA-9084-8A92337F62F1}\RP755\A0388327.exe Infecté : Trojan-Mailfinder.Win32.Mailbot.cp ignoré
C:\System Volume Information\_restore{C66B14E1-5ABF-47FA-9084-8A92337F62F1}\RP755\A0388328.exe Infecté : Trojan-Mailfinder.Win32.Mailbot.cm ignoré
C:\System Volume Information\_restore{C66B14E1-5ABF-47FA-9084-8A92337F62F1}\RP755\A0388329.exe Infecté : Trojan-Downloader.Win32.Small.aeaw ignoré
C:\System Volume Information\_restore{C66B14E1-5ABF-47FA-9084-8A92337F62F1}\RP755\A0388330.exe Infecté : Trojan-Downloader.Win32.Small.aeei ignoré
C:\System Volume Information\_restore{C66B14E1-5ABF-47FA-9084-8A92337F62F1}\RP755\A0388334.exe Infecté : Trojan-Downloader.Win32.Small.aeei ignoré
C:\System Volume Information\_restore{C66B14E1-5ABF-47FA-9084-8A92337F62F1}\RP755\A0388335.exe Infecté : Trojan-Mailfinder.Win32.Mailbot.cj ignoré
C:\System Volume Information\_restore{C66B14E1-5ABF-47FA-9084-8A92337F62F1}\RP755\change.log L'objet est verrouillé ignoré
C:\WINDOWS\Debug\PASSWD.LOG L'objet est verrouillé ignoré
C:\WINDOWS\SchedLgU.Txt L'objet est verrouillé ignoré
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log L'objet est verrouillé ignoré
C:\WINDOWS\Sti_Trace.log L'objet est verrouillé ignoré
C:\WINDOWS\system32\CatRoot2\edb.log L'objet est verrouillé ignoré
C:\WINDOWS\system32\CatRoot2\tmp.edb L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\Antivirus.Evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\AppEvent.Evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\default L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\default.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\Internet.evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SAM L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SAM.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SecEvent.Evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SECURITY L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SECURITY.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\software L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\software.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SysEvent.Evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\system L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\system.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\h323log.txt L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP L'objet est verrouillé ignoré
C:\WINDOWS\Temp\Perflib_Perfdata_440.dat L'objet est verrouillé ignoré
C:\WINDOWS\Temp\_avast4_\Webshlock.txt L'objet est verrouillé ignoré
C:\WINDOWS\wiadebug.log L'objet est verrouillé ignoré
C:\WINDOWS\wiaservc.log L'objet est verrouillé ignoré
C:\WINDOWS\WindowsUpdate.log L'objet est verrouillé ignoré
E:\AD-R.exe/TOOLS\cmdow.exe Infecté : not-a-virus:RiskTool.Win32.HideWindows ignoré
E:\AD-R.exe InstallCreator: infecté - 1 ignoré
E:\AD-R.exe UPX: infecté - 1 ignoré

Analyse terminée.

Excuse moi de t'embêter mais peux-tu m'expliquer un peu ton cheminement (pourquoi t'utilises tel logiciel par exemple), ça me servira pour les prochaines fois. Je suis en train de creuser le site www.malekal.com pour apprendre.

Voici le rapport :

[ Rapport ToolsCleaner version 2.3.0 (par A.Rothstein & dj QUIOU) ]

-->- Recherche:

C:\fixnavi.txt: trouvé !
C:\cleannavi.txt: trouvé !
C:\SDFIX: trouvé !
C:\Rsit: trouvé !
C:\Documents and Settings\Administrateur\Bureau\HijackThis.lnk: trouvé !
C:\Documents and Settings\Administrateur\Recent\HijackThis.lnk: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: trouvé !


Fichiers temporaires nettoyés !
Corbeille vidée!
---------------------------------
-->- Suppression:
C:\Documents and Settings\Administrateur\Bureau\HijackThis.lnk: supprimé !
C:\Documents and Settings\Administrateur\Recent\HijackThis.lnk: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: supprimé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
C:\fixnavi.txt: supprimé !
C:\cleannavi.txt: supprimé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: supprimé !
C:\SDFIX: supprimé !
C:\Rsit: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: supprimé !
C:\Program Files\Trend Micro\HijackThis: supprimé !

Logfile of random's system information tool 1.05 (written by random/random)
Run by campiond at 2009-01-26 22:10:32
Microsoft Windows XP Édition familiale Service Pack 2
System drive C: has 11 GB (9%) free of 133 GB
Total RAM: 511 MB (19% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:11:36, on 26/01/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Phoenix Technologies Ltd\RecoverPro_XP\VBPTASK.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\RunDll32.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Creative\Shared Files\CamTray.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\campiond\Bureau\RSIT.exe
C:\Program Files\trend micro\campiond.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://recherche.neuf.fr/ie/default.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {971C3384-F75E-4562-95B3-CBE7417529BC} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O2 - BHO: (no name) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: (no name) - {41C29B07-6F91-4966-91BE-2E2841643C83} - (no file)
O3 - Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [RestoreIT!] "C:\Program Files\Phoenix Technologies Ltd\RecoverPro_XP\VBPTASK.EXE" VBStart
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SMSTray] C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Creative WebCam Tray] C:\Program Files\Creative\Shared Files\CamTray.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Lancement rapide de Microsoft Office OneNote 2003.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
O4 - Global Startup: Rappels du Calendrier Microsoft Works.lnk = ?
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PacificPoker4 - {94EDF7B4-4272-4af3-8F8B-4E2F68E225B7} - C:\PROGRA~1\PACIFI~1\pacificpoker.exe (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://webscanner.kaspersky.fr/kavwebscan_unicode.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) -
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {86EEF11E-FF16-48CE-B1A2-474B663041A9} - http://kit.carpediem.fr/22226/CD/ParisFetish.exe
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Plug-in 1.6.0_07) -
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA} (Java Plug-in 1.5.0_07) -
O16 - DPF: {CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA} (Java Plug-in 1.5.0_08) -
O16 - DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} (Java Plug-in 1.5.0_09) -
O16 - DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} (Java Plug-in 1.5.0_10) -
O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} (Java Plug-in 1.5.0_11) -
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} (Java Plug-in 1.6.0_01) -
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} (Java Plug-in 1.6.0_02) -
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} (Java Plug-in 1.6.0_03) -
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} (Java Plug-in 1.6.0_07) -
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} (Java Plug-in 1.6.0_07) -
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} -
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://gamenextfr.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} -
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PsShutdown (PsShutdownSvc) - Systems Internals - C:\WINDOWS\System32\PSSDNSVC.EXE

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== SERVICES/DRIVERS ==========
Service gsplittm stopped successfully.
Service gsplittm deleted successfully.
========== FILES ==========
C:\Program Files\Adssite Advanced Toolbar moved successfully.
File/Folder c:\documents and settings\campiond\local settings\application data\eiioq.exe not found.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\campiond\LOCALS~1\Temp\hpodvd09.log scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\campiond\LOCALS~1\Temp\~DF25AF.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\campiond\LOCALS~1\Temp\~DF32AF.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_430.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
Temp folders emptied.

OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 01262009_225430

Files moved on Reboot...
File C:\DOCUME~1\campiond\LOCALS~1\Temp\hpodvd09.log not found!
File C:\DOCUME~1\campiond\LOCALS~1\Temp\~DF25AF.tmp not found!
C:\DOCUME~1\campiond\LOCALS~1\Temp\~DF32AF.tmp moved successfully.
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat moved successfully.
File C:\WINDOWS\temp\Perflib_Perfdata_430.dat not found!

Ce n'était pas mon PC que je réparais. On me l'a confié mais là j'avoue que j'étais dépassé. Je m'y connais très moyennement en infections et je viens de découvrir les outils utilisés dans ce cas. J'espère un jour avoir ta maitrise de ces outils car je suis régulièrement sollicité dans mon entourage pour réparer les PCs (c'est ça quand on bosse dans l'info, le gens pensent qu'on sait tout faire sur un PC).
Personnellement, j'utilisais également Avast et Spybot+Ad-Aware avec Firfox, le tout toujours à jour (y compris Windows) et je n'ai jamais eu de problème, comme quoi les soucis viennent souvent des utilisateurs ;-))

Merci pour tout et voici le dernier rapport demandé !

[ Rapport ToolsCleaner version 2.3.0 (par A.Rothstein & dj QUIOU) ]

-->- Recherche:

C:\_OtMoveIt: trouvé !
C:\Rsit: trouvé !
C:\Documents and Settings\campiond\Bureau\OTMoveIt3.exe: trouvé !
C:\Documents and Settings\campiond\Bureau\Rsit.exe: trouvé !
C:\RECYCLER\S-1-5-21-2244075383-1293475189-763885450-1006\Dc3\HijackThis.exe: trouvé !
C:\RECYCLER\S-1-5-21-2244075383-1293475189-763885450-1006\Dc3\hijackthis.log: trouvé !


Corbeille vidée!
Fichiers temporaires nettoyés !
---------------------------------
-->- Suppression:
C:\Documents and Settings\campiond\Bureau\OTMoveIt3.exe: supprimé !
C:\Documents and Settings\campiond\Bureau\Rsit.exe: supprimé !
C:\_OtMoveIt: supprimé !
C:\Rsit: supprimé !

oui oui pas de souci même si tu ne réponds qu'en fin de semaine. C'est juste que je dois retourner chez quelqu'un qui était un peu infesté car vu que je viens de découvrir de nouveaux outils je sais que je vais pouvoir lui nettoyer ses 2 PCs complètement.

Je peux le suppr celui-là aussi : ATF-Cleaner.exe ?