Rapport hijack this

Résolu
Bonjour, mon uc et à 100% j'ai tout essayer les logicial ant-virus et tous sa...bref voici mon log :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:35:29, on 11/04/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\setup\avast.setup
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Documents and Settings\agueni marie\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\adslTV\adsltv.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\opera 9.52\opera.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\VideoLAN\VLC\vlc.exe
C:\Documents and Settings\agueni marie\Bureau\test.exe.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.imesh.com/sidebar.html?src=ssb
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = https://support.microsoft.com/en-US/topic/internet-explorer-downloads-d49e1f0d-571c-9a7b-d97e-be248806ca70
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - (no file)
R3 - URLSearchHook: koopa.fr Toolbar - {636db2e4-0180-4809-a8bc-5b5a639fca6a} - C:\Program Files\koopa.fr\tbkoo1.dll
R3 - URLSearchHook: Eazel-FR Toolbar - {a8f9752d-e2b8-4e7a-86b5-499f4330e2fe} - C:\Program Files\Eazel-FR\tbEaze.dll
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.3.1.15.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: koopa.fr Toolbar - {636db2e4-0180-4809-a8bc-5b5a639fca6a} - C:\Program Files\koopa.fr\tbkoo1.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - (no file)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: XBTP01621 - {C66AF7F0-2CF6-48cb-9F94-04EC2504B4FC} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll
O3 - Toolbar: koopa.fr Toolbar - {636db2e4-0180-4809-a8bc-5b5a639fca6a} - C:\Program Files\koopa.fr\tbkoo1.dll
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe"
O4 - HKLM\..\Run: [avast!] "C:\Program Files\Alwil Software\Avast4\ashDisp.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Notification de cadeaux MSN.lnk = C:\Documents and Settings\agueni marie\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 3.79\AMVConverter\grab.html
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 3.79\MediaManager\grab.html
O8 - Extra context menu item: Tout télécharger avec BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Télécharger avec BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: Télécharger toutes les vidéos avec BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.3.1.15.dll/206 (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: Justin.tv Publisher - https://www.twitch.tv/plugins/justintv_publisher.CAB
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www3.snapfish.fr/SnapfishActivia.cab
O16 - DPF: {47CEF84E-92D8-4C4A-86D7-CB982889DCC0} (Oberon Media Network Optimizer) - http://mp1.mplay.oberon-media.com/client/flashnet.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://copainsdavant.linternaute.com/...
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://messenger.zone.msn.com/EN-US/a-LUXR/mjolauncher.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {C45B1500-7B63-47C2-AB25-C28CB46AFDEE} (MusicManagerPlugin.MediaBar) - http://sib1.od2.com/common/musicmanager/installation/MusicManagerPlugin.CAB
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} -
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft - C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: BitDefender Arrakis Server (Arrakis3) - BitDefender S.R.L. https://www.bitdefender.fr/ - C:\Program Files\Fichiers communs\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: Service Google Update (gupdate1c99d426c86a256) (gupdate1c99d426c86a256) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: RdnaoFlSvc - Unknown owner - C:\Program Files\rnamfler\naofsvc.exe (file missing)
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

--
End of file - 13950 bytes
si vous pouvez m'aidez je vous en serais eternellement reconnaissant

Merci
Configuration: Windows XP
Opera 9.63

34 réponses

Résumé de la discussion

Question : Ce fil traite d'une infection informatique sous Windows XP où l'utilisateur transmet des rapports détaillés (HiJackThis et Ad-Remover) et demande de l'aide pour nettoyer un système apparemment compromis. Les rapports montrent des logiciels publicitaires et des barres d'outils indésirables (SweetIM, Boonty, Eorezo, It’s TV), des moteurs de recherche redirigeant vers Conduit et Live Search, ainsi que des démarrages multiples. La réponse principale décrit l’usage d’Ad-Remover, qui a identifié et supprimé des adwares comme Boonty, Eorezo et SweetIM, puis réinitialisé les pages d’accueil et les moteurs des navigateurs. En cas de persistance, il est conseillé de relancer d’autres outils et de vérifier les paramètres des navigateurs pour éviter de futures redirections et protéger les données.

Bobot (l’IA à votre service)
  1. Hello dylem29
    Télécharges AD-Remover ( de Cyrildu17 / C_XX ) sur ton bureau :
    http://sd-1.archive-host.com/membres/up/16506160323759868/AD-R.exe
    ! Déconnectes toi et fermes toutes applications en cours !

    * Double clique sur le programme d'installation , et installe le dans son emplacement par défaut. ( le bureau )
    * Ouvre le dossier Ad-remover présent sur ton bureau, et double clique sur Ad-remover.bat.
    * Au menu principal choisi l'option "A"
    --> Postes le rapport qui apparait à la fin .

    ( le rapport est sauvegardé aussi sous C:\Ad-report.log

    Note :

    "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
    Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
    Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.

    a+
    0
    1. B'soir,

      le lien sa ira mieux ....

      ▶ Télécharges AD-Remover ( de Cyrildu17 / C_XX ) sur ton bureau :
      0
      1. le message a été édité
        merci
        a+
        0
        1. Je le fais en mode sans echec ?
          0
          1. Non pas necessaire...Le mode normal suffira sous le controle de VX et INFFERNO-...
            a+
            0
            1. et ensuite je vais quoi aprés avoir poster le rapport ?
              0
              1. Et ensuite je vais quoi aprés avoir poster le rapport ?

                DSL je n'ai vu aucun rappport....

                a+
                --
                Si c'est ton seul problème !° !°!°... sois heureux !².....
                0
                1. ------- LOGFILE OF AD-REMOVER 1.1.2.7 | ONLY XP/VISTA -------

                  Updated by C_XX on 11/04/2009 at 19:30
                  Contact: AdRemover.contact@gmail.com
                  Website: http://pagesperso-orange.fr/FindyKill.Ad.Remover/

                  Start at: 23:10:55, 11/04/2009 | Boot mode: Normal Boot
                  Option: SCAN | Executed from: C:\Documents and Settings\agueni marie\Bureau\Ad-remover\Ad-remover.bat
                  Operating System: Microsoft® Windows XP™ Service Pack 3 (version 5.1.2600)
                  Computer Name: AGUENI
                  Current User: agueni marie - Administrator
                  Drive(s):
                  - C:\ (File System: NTFS)
                  System Drive: C:\
                  Windows Directory: C:\WINDOWS\
                  System Directory: C:\WINDOWS\System32\

                  --- Running Processes: 54

                  ============ Known Adwares Found ============

                  .
                  HKCU\Software\MGS\Thumper\Casino\RubyFortune
                  HKCU\Software\MicroGaming\Thumper\Casino\RubyFortune
                  HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
                  HKCU\Software\pacificpoker
                  HKCU\Software\pokerinstaller
                  HKCU\Software\VB and VBA Program Settings\eurobarre
                  .
                  C:\Program Files\Conduit
                  C:\Program Files\PacificPoker
                  C:\Documents and Settings\agueni marie\Application Data\Mozilla\Firefox\Profiles\lx2ia3hc.default\EBSuggestHistory
                  C:\Documents and Settings\agueni marie\Cookies\agueni_marie@search.conduit[2].txt
                  C:\Documents and Settings\agueni marie\Cookies\agueni_marie@search.conduit[3].txt

                  +-----------------| Boonty/Boonty Games Elements Found:

                  Service: Boonty Games
                  .
                  HKCR\boontybox
                  HKLM\Software\Boonty
                  HKLM\Software\Classes\boontybox
                  HKLM\System\ControlSet001\Services\Boonty Games
                  HKLM\System\CurrentControlSet\Services\Boonty Games
                  HKLM\System\ControlSet003\Services\Boonty Games
                  .
                  C:\Program Files\Fichiers communs\BOONTY Shared
                  C:\Documents and Settings\All Users\Application Data\BOONTY
                  C:\Documents and Settings\All Users\Menudm~1\Progra~1\BoontyGames

                  +-----------------| Eorezo Elements Found:

                  HKCR\Interface\{B0D071A1-36B3-4757-A126-14C89C56013A}
                  HKCR\Typelib\{B4C656C9-F2E9-4E77-B3F4-443DF2BD778F}
                  HKCU\Software\EoRezo
                  HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{64F56FC1-1272-44CD-BA6E-39723696E350}
                  HKLM\Software\Classes\TypeLib\{B4C656C9-F2E9-4E77-B3F4-443DF2BD778F}
                  HKLM\Software\Classes\Interface\{B0D071A1-36B3-4757-A126-14C89C56013A}
                  HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64F56FC1-1272-44CD-BA6E-39723696E350}
                  .
                  C:\Program Files\EoRezo
                  C:\Documents and Settings\agueni marie\Application Data\EoRezo

                  +-----------------| It's TV Elements Found:

                  .

                  +-----------------| Sweetim Elements Found:

                  HKCU\Software\SWEETIE
                  HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1A0AADCD-3A72-4B5F-900F-E3BB5A838E2A}
                  HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BC4FFE41-DE9F-46fa-B455-AAD49B9F9938}
                  HKLM\Software\Microsoft\ESENT\Process\SweetIM
                  HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{BC4FFE41-DE9F-46FA-B455-AAD49B9F9938}
                  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\980289C22F80A7C4BB9323DC61255E4E
                  HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\FA96423FE2B98E248A3B23548D1E22D9
                  .
                  C:\Program Files\Macrogaming

                  +-----------------| Added Scan:

                  ---- Mozilla FireFox Version 3.0.8 ----

                  ProfilePath: lx2ia3hc.default (agueni marie)
                  .
                  Prefs.js: Browser.Search.DefaultEngineName: "MyStart Rechercher"
                  Prefs.js: Browser.Search.SelectedEngine: "Live Search"
                  Prefs.js: Browser.Search.DefaultUrl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1721964&SearchSource=3&q="
                  .
                  (Prefs.js) FOUND: user_pref("CT2095689.AboutPrivacyUrl", "http://www.conduit.com");
                  (Prefs.js) FOUND: user_pref("CT2095689.CTPBaseServerUrl", "http://grouping.services.conduit.com/");
                  (Prefs.js) FOUND: user_pref("CT2095689.SearchFromAddressBarUrl", "http://search.conduit.com/ResultsExt.aspx?ctid=CT2095689&SearchSource=2&q=");
                  (Prefs.js) FOUND: user_pref("CT2095689.Server", "http://users.conduit.com");
                  (Prefs.js) FOUND: user_pref("browser.search.defaulturl", "http://search.conduit.com/ResultsExt.aspx?ctid=CT1721964&SearchSource=3&q=");
                  .
                  .
                  .
                  .

                  ---- Internet Explorer Version 8.0.6001.18702 ----

                  +-[HKEY_CURRENT_USER\..\Internet Explorer\Main]

                  Default_Page_URL: hxxp://go.microsoft.com/fwlink/?LinkId=69157
                  Default_Search_URL: hxxp://www.google.com/ie
                  SearchAssistant: hxxp://search.imesh.com/sidebar.html?src=ssb
                  Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                  Start page: hxxp://fr.msn.com/
                  First Home Page: hxxp://www.windows.fr/ie8/msn/bienvenue

                  +-[HKEY_USERS\S-1-5-21-3100136441-148518496-416991214-1005\..\Internet Explorer\Main]

                  Default_Page_URL: hxxp://go.microsoft.com/fwlink/?LinkId=69157
                  Default_Search_URL: hxxp://www.google.com/ie
                  SearchAssistant: hxxp://search.imesh.com/sidebar.html?src=ssb
                  Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                  Start page: hxxp://fr.msn.com/
                  First Home Page: hxxp://www.windows.fr/ie8/msn/bienvenue

                  +-[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

                  Default_Page_URL: hxxp://go.microsoft.com/fwlink/?LinkId=69157
                  Default_Search_URL: hxxp://go.microsoft.com/fwlink/?LinkId=54896
                  Search bar: hxxp://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
                  Search Page: hxxp://go.microsoft.com/fwlink/?LinkId=54896
                  Start page: hxxp://www.msn.com/

                  +-[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

                  Tabs: hxxp://ieframe.dll/tabswelcome.htm

                  +---------------------------------------------------------------------------+

                  5587 Byte(s) - C:\Ad-Report-Scan-11.04.2009.log

                  0 File(s) - C:\Documents and Settings\agueni marie\Bureau\Ad-remover\TOOLS\BACKUP
                  0 File(s) - C:\Documents and Settings\agueni marie\Bureau\Ad-remover\TOOLS\QUARANTINE

                  End at: 0:32:17 | 12/04/2009
                  .
                  +-----------------| E.O.F - 106 Lines
                  .
                  voila le rapport merci
                  0
                  1. ! Déconnectes toi et fermes toutes applications en cours !

                    * Relances "Ad-remover" : au menu principal choisi l'option "B" .Coches les cases suivantes:
                    1
                    2
                    6
                    7
                    Puis: S


                    --> le programme va travailler ...

                    * Postes le rapport qui apparait à la fin + un nouvel Hijackthis pour analyse ...

                    ( le rapport est sauvegardé aussi sous C:\Ad-report.log )

                    /!\ Si le Bureau ne réapparait pas presse Ctrl + Alt + Suppr , Onglet "Fichier" , "Nouvelle tâche" , tapes explorer.exe et valides) /!\

                    A+
                    0
                    1. voila le rapport de ad remover :

                      ------- LOGFILE OF AD-REMOVER 1.1.2.7 | ONLY XP/VISTA -------

                      Updated by C_XX on 11/04/2009 at 19:30
                      Contact: AdRemover.contact@gmail.com
                      Website: http://pagesperso-orange.fr/FindyKill.Ad.Remover/

                      **** LIMITED TO ****

                      Known Adwares
                      Boonty/BoontyGames
                      Eorezo
                      It's TV
                      Sweetim

                      ********************

                      Start at: 13:20:05, 12/04/2009 | Boot mode: Normal Boot
                      Option: CLEAN | Executed from: C:\Documents and Settings\agueni marie\Bureau\Ad-remover\Ad-remover.bat
                      Operating System: Microsoft® Windows XP™ Service Pack 3 (version 5.1.2600)
                      Computer Name: AGUENI
                      Current User: agueni marie - Administrator
                      Drive(s):
                      - C:\ (File System: NTFS)
                      System Drive: C:\
                      Windows Directory: C:\WINDOWS\
                      System Directory: C:\WINDOWS\System32\

                      --- Running Processes: 57

                      (!) ---- IE start pages/Tabs reset

                      ============ Known Adwares Deleted ============

                      .
                      HKCU\Software\MGS\Thumper\Casino\RubyFortune
                      HKCU\Software\MicroGaming\Thumper\Casino\RubyFortune
                      HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
                      HKCU\Software\pacificpoker
                      HKCU\Software\pokerinstaller
                      HKCU\Software\VB and VBA Program Settings\eurobarre
                      .
                      C:\Program Files\Conduit
                      C:\Program Files\PacificPoker
                      C:\Documents and Settings\agueni marie\Application Data\Mozilla\Firefox\Profiles\lx2ia3hc.default\EBSuggestHistory

                      +-----------------| Boonty/Boonty Games Elements Deleted :

                      Service: "Boonty Games"
                      .
                      HKCR\boontybox
                      HKLM\Software\Boonty
                      HKLM\System\ControlSet001\Services\Boonty Games
                      .
                      C:\Program Files\Fichiers communs\BOONTY Shared
                      C:\Documents and Settings\All Users\Application Data\BOONTY
                      C:\Documents and Settings\All Users\Menudm~1\Progra~1\BoontyGames

                      +-----------------| Eorezo Elements Deleted :

                      HKCR\Interface\{B0D071A1-36B3-4757-A126-14C89C56013A}
                      HKCR\Typelib\{B4C656C9-F2E9-4E77-B3F4-443DF2BD778F}
                      HKCU\Software\EoRezo
                      HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{64F56FC1-1272-44CD-BA6E-39723696E350}
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64F56FC1-1272-44CD-BA6E-39723696E350}
                      .
                      C:\Program Files\EoRezo
                      C:\Documents and Settings\agueni marie\Application Data\EoRezo

                      +-----------------| It's TV Elements Deleted :

                      .

                      +-----------------| Sweetim Elements Deleted :

                      HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{BC4FFE41-DE9F-46FA-B455-AAD49B9F9938}
                      HKCU\Software\SWEETIE
                      HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1A0AADCD-3A72-4B5F-900F-E3BB5A838E2A}
                      HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BC4FFE41-DE9F-46fa-B455-AAD49B9F9938}
                      HKLM\Software\Microsoft\ESENT\Process\SweetIM
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\980289C22F80A7C4BB9323DC61255E4E
                      HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Components\FA96423FE2B98E248A3B23548D1E22D9
                      .
                      C:\Program Files\Macrogaming

                      (!) ---- Temp files deleted.
                      (!) ---- Recycle bin emptied in all drives.

                      +-----------------| Added Scan :

                      ---- Mozilla FireFox Version 3.0.8 ----

                      ProfilePath: lx2ia3hc.default (agueni marie)
                      .
                      Prefs.js: Browser.Search.DefaultEngineName: "MyStart Rechercher"
                      Prefs.js: Browser.Search.SelectedEngine: "Live Search"
                      Prefs.js: Browser.Search.DefaultUrl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1721964&SearchSource=3&q="
                      .
                      .
                      .
                      .
                      .

                      ---- Internet Explorer Version 8.0.6001.18702 ----

                      +-[HKEY_CURRENT_USER\..\Internet Explorer\Main]

                      Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
                      Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                      SearchAssistant: hxxp://search.imesh.com/sidebar.html?src=ssb
                      Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
                      Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                      Start page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

                      +-[HKEY_USERS\S-1-5-21-3100136441-148518496-416991214-1005\..\Internet Explorer\Main]

                      Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
                      Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                      SearchAssistant: hxxp://search.imesh.com/sidebar.html?src=ssb
                      Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
                      Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                      Start page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

                      +-[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

                      Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
                      Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                      Search bar: hxxp://search.msn.com/spbasic.htm
                      Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                      Start page: hxxp://fr.msn.com/

                      +-[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

                      Tabs: hxxp://ieframe.dll/tabswelcome.htm

                      +---------------------------------------------------------------------------+

                      5052 Byte(s) - C:\Ad-Report-Clean-12.04.2009.log
                      5886 Byte(s) - C:\Ad-Report-Scan-11.04.2009.log

                      2 File(s) - C:\Documents and Settings\agueni marie\Bureau\Ad-remover\TOOLS\BACKUP
                      0 File(s) - C:\Documents and Settings\agueni marie\Bureau\Ad-remover\TOOLS\QUARANTINE

                      End at: 14:36:38 | 12/04/2009
                      .
                      +-----------------| E.O.F - 104 Lines
                      .
                      0
                      1. et voici le log hijackthis :

                        Logfile of Trend Micro HijackThis v2.0.2
                        Scan saved at 14:39:45, on 12/04/2009
                        Platform: Windows XP SP3 (WinNT 5.01.2600)
                        MSIE: Internet Explorer v7.00 (7.00.6000.16791)
                        Boot mode: Normal

                        Running processes:
                        C:\WINDOWS\System32\smss.exe
                        C:\WINDOWS\system32\winlogon.exe
                        C:\WINDOWS\system32\services.exe
                        C:\WINDOWS\system32\lsass.exe
                        C:\WINDOWS\system32\Ati2evxx.exe
                        C:\WINDOWS\system32\svchost.exe
                        C:\WINDOWS\System32\svchost.exe
                        C:\WINDOWS\system32\Ati2evxx.exe
                        C:\WINDOWS\system32\svchost.exe
                        C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                        C:\Program Files\Alwil Software\Avast4\ashServ.exe
                        C:\WINDOWS\system32\spoolsv.exe
                        C:\Program Files\Google\Update\GoogleUpdate.exe
                        C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
                        C:\Program Files\Bonjour\mDNSResponder.exe
                        C:\WINDOWS\system32\cisvc.exe
                        C:\WINDOWS\eHome\ehRecvr.exe
                        C:\WINDOWS\eHome\ehSched.exe
                        C:\Program Files\Java\jre6\bin\jqs.exe
                        C:\Program Files\CyberLink\Shared Files\RichVideo.exe
                        C:\WINDOWS\system32\svchost.exe
                        C:\WINDOWS\system32\SearchIndexer.exe
                        C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                        C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                        C:\WINDOWS\system32\dllhost.exe
                        C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
                        C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe
                        C:\Program Files\Java\jre6\bin\jusched.exe
                        C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
                        C:\Program Files\Alwil Software\Avast4\ashDisp.exe
                        C:\WINDOWS\system32\ctfmon.exe
                        C:\Program Files\Windows Desktop Search\WindowsSearch.exe
                        C:\Documents and Settings\agueni marie\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe
                        C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
                        C:\WINDOWS\system32\cidaemon.exe
                        C:\WINDOWS\system32\wbem\wmiapsrv.exe
                        C:\Program Files\Messenger\msmsgs.exe
                        C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpSvc.exe
                        C:\WINDOWS\system32\SearchProtocolHost.exe
                        C:\WINDOWS\explorer.exe
                        C:\WINDOWS\system32\notepad.exe
                        C:\WINDOWS\system32\taskmgr.exe
                        C:\Program Files\opera 9.52\opera.exe
                        C:\Documents and Settings\agueni marie\Bureau\test.exe.exe

                        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.imesh.com/sidebar.html?src=ssb
                        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                        R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
                        R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
                        R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
                        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                        R3 - URLSearchHook: (no name) - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - (no file)
                        R3 - URLSearchHook: (no name) - {636db2e4-0180-4809-a8bc-5b5a639fca6a} - (no file)
                        R3 - URLSearchHook: Eazel-FR Toolbar - {a8f9752d-e2b8-4e7a-86b5-499f4330e2fe} - C:\Program Files\Eazel-FR\tbEaze.dll
                        O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
                        O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
                        O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
                        O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
                        O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.3.1.15.dll
                        O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
                        O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                        O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
                        O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                        O2 - BHO: (no name) - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - (no file)
                        O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
                        O2 - BHO: XBTP01621 - {C66AF7F0-2CF6-48cb-9F94-04EC2504B4FC} - (no file)
                        O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
                        O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
                        O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
                        O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll
                        O3 - Toolbar: (no name) - {636db2e4-0180-4809-a8bc-5b5a639fca6a} - (no file)
                        O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe"
                        O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
                        O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                        O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
                        O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                        O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe
                        O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
                        O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe"
                        O4 - HKLM\..\Run: [avast!] "C:\Program Files\Alwil Software\Avast4\ashDisp.exe"
                        O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                        O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
                        O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
                        O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                        O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                        O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                        O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                        O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                        O4 - Startup: Notification de cadeaux MSN.lnk = C:\Documents and Settings\agueni marie\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe
                        O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
                        O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
                        O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 3.79\AMVConverter\grab.html
                        O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 3.79\MediaManager\grab.html
                        O8 - Extra context menu item: Tout télécharger avec BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
                        O8 - Extra context menu item: Télécharger avec BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
                        O8 - Extra context menu item: Télécharger toutes les vidéos avec BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
                        O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll
                        O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
                        O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.3.1.15.dll/206 (file missing)
                        O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                        O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                        O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                        O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
                        O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
                        O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
                        O16 - DPF: Justin.tv Publisher - https://www.twitch.tv/plugins/justintv_publisher.CAB
                        O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
                        O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www3.snapfish.fr/SnapfishActivia.cab
                        O16 - DPF: {47CEF84E-92D8-4C4A-86D7-CB982889DCC0} (Oberon Media Network Optimizer) - http://mp1.mplay.oberon-media.com/client/flashnet.cab
                        O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
                        O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
                        O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://copainsdavant.linternaute.com/...
                        O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
                        O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
                        O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://messenger.zone.msn.com/EN-US/a-LUXR/mjolauncher.cab
                        O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
                        O16 - DPF: {C45B1500-7B63-47C2-AB25-C28CB46AFDEE} (MusicManagerPlugin.MediaBar) - http://sib1.od2.com/common/musicmanager/installation/MusicManagerPlugin.CAB
                        O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} -
                        O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
                        O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
                        O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft - C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
                        O23 - Service: BitDefender Arrakis Server (Arrakis3) - BitDefender S.R.L. https://www.bitdefender.fr/ - C:\Program Files\Fichiers communs\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe
                        O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                        O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
                        O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
                        O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                        O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                        O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                        O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
                        O23 - Service: Service Google Update (gupdate1c99d426c86a256) (gupdate1c99d426c86a256) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
                        O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                        O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
                        O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
                        O23 - Service: RdnaoFlSvc - Unknown owner - C:\Program Files\rnamfler\naofsvc.exe (file missing)
                        O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
                        0
                        1. et voici le log hijackthis :

                          Logfile of Trend Micro HijackThis v2.0.2
                          Scan saved at 14:39:45, on 12/04/2009
                          Platform: Windows XP SP3 (WinNT 5.01.2600)
                          MSIE: Internet Explorer v7.00 (7.00.6000.16791)
                          Boot mode: Normal

                          Running processes:
                          C:\WINDOWS\System32\smss.exe
                          C:\WINDOWS\system32\winlogon.exe
                          C:\WINDOWS\system32\services.exe
                          C:\WINDOWS\system32\lsass.exe
                          C:\WINDOWS\system32\Ati2evxx.exe
                          C:\WINDOWS\system32\svchost.exe
                          C:\WINDOWS\System32\svchost.exe
                          C:\WINDOWS\system32\Ati2evxx.exe
                          C:\WINDOWS\system32\svchost.exe
                          C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                          C:\Program Files\Alwil Software\Avast4\ashServ.exe
                          C:\WINDOWS\system32\spoolsv.exe
                          C:\Program Files\Google\Update\GoogleUpdate.exe
                          C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
                          C:\Program Files\Bonjour\mDNSResponder.exe
                          C:\WINDOWS\system32\cisvc.exe
                          C:\WINDOWS\eHome\ehRecvr.exe
                          C:\WINDOWS\eHome\ehSched.exe
                          C:\Program Files\Java\jre6\bin\jqs.exe
                          C:\Program Files\CyberLink\Shared Files\RichVideo.exe
                          C:\WINDOWS\system32\svchost.exe
                          C:\WINDOWS\system32\SearchIndexer.exe
                          C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                          C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                          C:\WINDOWS\system32\dllhost.exe
                          C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
                          C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe
                          C:\Program Files\Java\jre6\bin\jusched.exe
                          C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
                          C:\Program Files\Alwil Software\Avast4\ashDisp.exe
                          C:\WINDOWS\system32\ctfmon.exe
                          C:\Program Files\Windows Desktop Search\WindowsSearch.exe
                          C:\Documents and Settings\agueni marie\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe
                          C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
                          C:\WINDOWS\system32\cidaemon.exe
                          C:\WINDOWS\system32\wbem\wmiapsrv.exe
                          C:\Program Files\Messenger\msmsgs.exe
                          C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpSvc.exe
                          C:\WINDOWS\system32\SearchProtocolHost.exe
                          C:\WINDOWS\explorer.exe
                          C:\WINDOWS\system32\notepad.exe
                          C:\WINDOWS\system32\taskmgr.exe
                          C:\Program Files\opera 9.52\opera.exe
                          C:\Documents and Settings\agueni marie\Bureau\test.exe.exe

                          R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.imesh.com/sidebar.html?src=ssb
                          R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                          R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
                          R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
                          R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
                          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                          R3 - URLSearchHook: (no name) - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - (no file)
                          R3 - URLSearchHook: (no name) - {636db2e4-0180-4809-a8bc-5b5a639fca6a} - (no file)
                          R3 - URLSearchHook: Eazel-FR Toolbar - {a8f9752d-e2b8-4e7a-86b5-499f4330e2fe} - C:\Program Files\Eazel-FR\tbEaze.dll
                          O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
                          O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
                          O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
                          O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
                          O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.3.1.15.dll
                          O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
                          O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                          O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
                          O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                          O2 - BHO: (no name) - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - (no file)
                          O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
                          O2 - BHO: XBTP01621 - {C66AF7F0-2CF6-48cb-9F94-04EC2504B4FC} - (no file)
                          O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
                          O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
                          O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
                          O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll
                          O3 - Toolbar: (no name) - {636db2e4-0180-4809-a8bc-5b5a639fca6a} - (no file)
                          O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe"
                          O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
                          O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                          O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
                          O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                          O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe
                          O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
                          O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe"
                          O4 - HKLM\..\Run: [avast!] "C:\Program Files\Alwil Software\Avast4\ashDisp.exe"
                          O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                          O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
                          O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
                          O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                          O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                          O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                          O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                          O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                          O4 - Startup: Notification de cadeaux MSN.lnk = C:\Documents and Settings\agueni marie\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe
                          O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
                          O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
                          O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 3.79\AMVConverter\grab.html
                          O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 3.79\MediaManager\grab.html
                          O8 - Extra context menu item: Tout télécharger avec BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
                          O8 - Extra context menu item: Télécharger avec BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
                          O8 - Extra context menu item: Télécharger toutes les vidéos avec BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
                          O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll
                          O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
                          O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.3.1.15.dll/206 (file missing)
                          O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                          O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                          O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                          O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                          O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
                          O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
                          O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
                          O16 - DPF: Justin.tv Publisher - https://www.twitch.tv/plugins/justintv_publisher.CAB
                          O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
                          O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www3.snapfish.fr/SnapfishActivia.cab
                          O16 - DPF: {47CEF84E-92D8-4C4A-86D7-CB982889DCC0} (Oberon Media Network Optimizer) - http://mp1.mplay.oberon-media.com/client/flashnet.cab
                          O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
                          O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
                          O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://copainsdavant.linternaute.com/...
                          O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
                          O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
                          O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://messenger.zone.msn.com/EN-US/a-LUXR/mjolauncher.cab
                          O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
                          O16 - DPF: {C45B1500-7B63-47C2-AB25-C28CB46AFDEE} (MusicManagerPlugin.MediaBar) - http://sib1.od2.com/common/musicmanager/installation/MusicManagerPlugin.CAB
                          O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} -
                          O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
                          O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
                          O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft - C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
                          O23 - Service: BitDefender Arrakis Server (Arrakis3) - BitDefender S.R.L. https://www.bitdefender.fr/ - C:\Program Files\Fichiers communs\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe
                          O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                          O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
                          O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
                          O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                          O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                          O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                          O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
                          O23 - Service: Service Google Update (gupdate1c99d426c86a256) (gupdate1c99d426c86a256) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
                          O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                          O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
                          O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
                          O23 - Service: RdnaoFlSvc - Unknown owner - C:\Program Files\rnamfler\naofsvc.exe (file missing)
                          O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
                          0
                          1. Mon UC est toujours à 100% et il beug toujours autant
                            0
                            1. Télécharge Toolbar-S&D (Team IDN) sur ton Bureau.
                              https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2

                              * Lance l'installation du programme en exécutant le fichier téléchargé.
                              * Double-clique maintenant sur le raccourci de Toolbar-S&D.
                              * Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.
                              * Choisis maintenant l'option 2. Patiente jusqu'à la fin de la recherche.
                              * Poste le rapport généré. (C:\TB.txt)
                              ENSUITE:
                              Fais un scan avec cet antispyware :
                              Telecharge malwarebytes + tutoriel :

                              -> https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

                              Tu l´installes; mets le a jour...(onglet mise a jour)

                              Une fois a jour, le programme va se lancer; click sur l´onglet parametre, et coche la case : "Arreter internet explorer pendant la suppression".

                              Click maintenant sur l´onglet recherche et coche la case : "executer un examen rapide".
                              Puis click sur "rechercher".

                              Laisse le scanner le pc...

                              Si des elements on ete trouvés > click sur supprimer la selection.

                              si il t´es demandé de redemarrer > click sur "yes".

                              A la fin un rapport va s´ouvrir; sauvegarde le de maniere a le retrouver en vu de le poster sur le forum.

                              Copie et colle le rapport stp.

                              a+

                              0
                              1. voila le toobar :

                                -----------\\ ToolBar S&D 1.2.8 XP/Vista

                                Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
                                X86-based PC ( Multiprocessor Free : Intel(R) Celeron(R) D CPU 3.33GHz )
                                BIOS : Default System BIOS
                                USER : agueni marie ( Administrator )
                                BOOT : Normal boot
                                Antivirus : avast! antivirus 4.8.1335 [VPS 090411-0] 4.8.1335 (Activated)
                                Firewall : Pare-feu BitDefender 12.0 (Not Activated)
                                C:\ (Local Disk) - NTFS - Total:144 Go (Free:103 Go)
                                D:\ (CD or DVD)
                                E:\ (CD or DVD)

                                "C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
                                Option : [2] ( 12/04/2009|18:05 )

                                -----------\\ Recherche de Fichiers / Dossiers ...

                                -----------\\ Extensions

                                (agueni marie) - {635abd67-4fe9-1b23-4f01-e679fa7484c1} => ytoolbar
                                (agueni marie) - {b9db16a4-6edc-47ec-a1f4-b86292ed211d} => dwhelper

                                -----------\\ [..\Internet Explorer\Main]

                                [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
                                "Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
                                "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
                                "SearchAssistant"="http://search.imesh.com/sidebar.html?src=ssb"
                                "Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
                                "SearchMigratedDefaultURL"="https://www.google.com/webhp?gws_rd=ssl{searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8"
                                "Default_Page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
                                "Search bar"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
                                "Window Title"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"

                                [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
                                "Default_Page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
                                "Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
                                "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
                                "Start Page"="https://www.msn.com/fr-fr/"
                                "Search Bar"="http://www.bing.com/spresults.aspx"

                                --------------------\\ Recherche d'autres infections

                                Aucune autre infection trouvée !

                                1 - "C:\ToolBar SD\TB_1.txt" - 11/04/2009|16:42 - Option : [2]
                                2 - "C:\ToolBar SD\TB_2.txt" - 12/04/2009|18:03 - Option : [1]
                                3 - "C:\ToolBar SD\TB_3.txt" - 12/04/2009|18:11 - Option : [2]

                                -----------\\ Fin du rapport a 18:11:37,62
                                0
                                1. et voila l'autre :

                                  Malwarebytes' Anti-Malware 1.36
                                  Version de la base de données: 1970
                                  Windows 5.1.2600 Service Pack 3

                                  13/04/2009 00:03:12
                                  mbam-log-2009-04-13 (00-03-12).txt

                                  Type de recherche: Examen complet (C:\|)
                                  Eléments examinés: 228930
                                  Temps écoulé: 5 hour(s), 19 minute(s), 6 second(s)

                                  Processus mémoire infecté(s): 0
                                  Module(s) mémoire infecté(s): 0
                                  Clé(s) du Registre infectée(s): 0
                                  Valeur(s) du Registre infectée(s): 0
                                  Elément(s) de données du Registre infecté(s): 0
                                  Dossier(s) infecté(s): 0
                                  Fichier(s) infecté(s): 0

                                  Processus mémoire infecté(s):
                                  (Aucun élément nuisible détecté)

                                  Module(s) mémoire infecté(s):
                                  (Aucun élément nuisible détecté)

                                  Clé(s) du Registre infectée(s):
                                  (Aucun élément nuisible détecté)

                                  Valeur(s) du Registre infectée(s):
                                  (Aucun élément nuisible détecté)

                                  Elément(s) de données du Registre infecté(s):
                                  (Aucun élément nuisible détecté)

                                  Dossier(s) infecté(s):
                                  (Aucun élément nuisible détecté)

                                  Fichier(s) infecté(s):
                                  (Aucun élément nuisible détecté)
                                  0
                                  1. GenProc 2.116 [1] 13/04/2009 - Windows XP : Aucune infection caractéristique trouvée .
                                    0
                                    1. Oui , je pense pas que se soit un virus , mais plutot un bleme avec ma carte mere ou un truc comme comme meme en mode sans echec mon UC est toujours a 100%
                                      0
                                      • 1
                                      • 2