Pc infecté

Résolu
nicos03 -  
Bonjour,

J'ai des gros ennuis avec internet explorer qui m'ouvre des tas de pages ; s'eteint tout seul et me lance des dicours audio de Obama . . .

Mon pc a été infecté par un virus il y a 2,3 jours :

-Gestionnaire de tache desactivé.
-Restauration systéme effacé.
-Fond d'ecran bleu.

J'ai réussi à me depanner grâce à vos différents posts pour les problémes ci-dessus;mais là pour le fonctionnement de internet explorer je cale et fais donc appel à votre aide.
Configuration: Windows XP Internet Explorer 8.0

29 réponses

Résumé de la discussion

Des symptômes inquiétants sur un PC Windows XP avec Internet Explorer 8 : le navigateur ouvre de nombreuses pages, s’éteint brutalement et émet des discours audio, indicateurs d’une infection malware. Le contexte relate des symptômes graves (gestionnaire de tâches désactivé, restauration système effacée, fond d’écran bleu), et ouvre à des solutions agressives comme ComboFix, avec instructions de déconnexion, désactivation des protections et génération d’un rapport. Des suggestions complémentaires préconisent ToolsCleaner puis Malwarebytes Anti-Malware en mode normal, et des analyses en ligne avec Bitdefender, Panda ou Kaspersky, après mise à jour, puis partage du rapport pour évaluation.

Bobot (l’IA à votre service)
  1. jlpjlp Contributeur sécurité
    slt

    Télécharge ici :

    http://images.malwareremoval.com/random/RSIT.exe

    random's system information tool (RSIT) par andom/random et sauvegarde-le sur le Bureau.

    Double-clique sur RSIT.exe afin de lancer RSIT.

    Clique Continue à l'écran Disclaimer.

    Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.

    Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront.

    Poste le contenu de log.txt (<<qui sera affiché)
    ainsi que de info.txt (<<qui sera réduit dans la Barre des Tâches).

    NB : Les rapports sont sauvegardés dans le dossier C:\rsit
    1. nicos03 Auteur
      fichier log :
      Logfile of random's system information tool 1.06 (written by random/random)
      Run by Nico et marion at 2009-05-14 08:11:28
      Microsoft Windows XP Édition familiale Service Pack 3
      System drive C: has 8 GB (11%) free of 69 GB
      Total RAM: 1279 MB (56% free)

      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 08:11:53, on 14/05/2009
      Platform: Windows XP SP3 (WinNT 5.01.2600)
      MSIE: Internet Explorer v8.00 (8.00.6001.18702)
      Boot mode: Normal

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\LEXBCES.EXE
      C:\WINDOWS\system32\spoolsv.exe
      C:\WINDOWS\system32\LEXPPS.EXE
      C:\WINDOWS\system32\CAP3RSK.EXE
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
      C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\CAP3SWK.EXE
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\WINDOWS\system32\qttask.exe
      C:\PROGRA~1\McAfee.com\Agent\McAgent.exe
      C:\WINDOWS\Mixer.exe
      C:\Program Files\Windows Live\Messenger\msnmsgr.exe
      C:\Program Files\OLITEC\Moniteur WiFi OLITEC\Moniteur WiFi OLITEC.exe
      C:\WINDOWS\system32\taskmgr.exe
      C:\Program Files\Internet Explorer\Iexplore.exe
      C:\Program Files\Internet Explorer\Iexplore.exe
      C:\Program Files\Internet Explorer\Iexplore.exe
      C:\Program Files\Internet Explorer\Iexplore.exe
      C:\Program Files\Internet Explorer\Iexplore.exe
      C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
      C:\Program Files\Internet Explorer\Iexplore.exe
      C:\Program Files\Internet Explorer\Iexplore.exe
      C:\Program Files\Internet Explorer\Iexplore.exe
      C:\WINDOWS\explorer.exe
      C:\Program Files\Internet Explorer\Iexplore.exe
      C:\Program Files\Internet Explorer\Iexplore.exe
      C:\Documents and Settings\Nico et marion\Bureau\RSIT.exe
      C:\Program Files\trend micro\Nico et marion.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.msn.com/fr-fr/
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
      R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.msn.com/fr-fr/
      R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://runonce.msn.com/runonce3.aspx
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
      F3 - REG:win.ini: load=C:\WINDOWS\svchost.exe
      O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
      O2 - BHO: ShoppingReport - {100EB1FD-D03E-47FD-81F3-EE91287F9465} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
      O2 - BHO: CPV - {15421B84-3488-49A7-AD18-CBF84A3EFAF6} - C:\Program Files\WWShow\WWShow.dll
      O2 - BHO: {65feff7d-c4e5-0048-bf54-e6e6de193133} - {331391ed-6e6e-45fb-8400-5e4cd7ffef56} - C:\WINDOWS\system32\jvfnez.dll
      O2 - BHO: (no name) - {65F5A866-E091-4476-A427-CC14EEEE1639} - (no file)
      O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - C:\WINDOWS\system32\cbXNdbyA.dll
      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
      O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
      O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
      O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
      O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
      O2 - BHO: (no name) - {D0D6FA41-94FC-4641-97CA-CEA05478ADFE} - C:\WINDOWS\system32\hgGyaaYo.dll
      O2 - BHO: HelloWorldBHO - {D88E1558-7C2D-407A-953A-C044F5607CEA} - C:\Program Files\Jcore\Jcore2.dll
      O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
      O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
      O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
      O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\system32\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\McAfee.com\Agent\McUpdate.exe
      O4 - HKLM\..\Run: [MCAgentExe] C:\PROGRA~1\McAfee.com\Agent\McAgent.exe
      O4 - HKLM\..\Run: [CAP3ON] C:\WINDOWS\system32\spool\drivers\w32x86\3\CAP3ONN.EXE
      O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
      O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe
      O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
      O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
      O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
      O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
      O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
      O4 - Global Startup: Moniteur WiFi OLITEC.exe.lnk = ?
      O9 - Extra button: Messager Wanadoo - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
      O9 - Extra 'Tools' menuitem: Messager Wanadoo - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
      O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
      O9 - Extra button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
      O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
      O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
      O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
      O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
      O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
      O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
      O16 - DPF: {78ABDC59-D8E7-44D3-9A76-9A0918C52B4A} (DLoader Class) - http://dl.uc.sina.com/cab/downloader.cab
      O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://jeuxmultijoueurs.orange.fr/Gameshell/GameHost/1.0/OberonGameHost.cab
      O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
      O20 - Winlogon Notify: cbXNdbyA - C:\WINDOWS\SYSTEM32\cbXNdbyA.dll
      O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
      O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
      O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
      O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
      O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
      O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
    2. nicos03 Auteur
      @nicos03je tai mis deux fois le fichier log ...

      voici le fichier info :

      info.txt logfile of random's system information tool 1.06 2009-05-14 08:11:55

      ======Uninstall list======

      -->C:\Program Files\Nero\Nero8\\nero\uninstall\UNNERO.exe /UNINSTALL
      -->C:\WINDOWS\UNNeroBackItUp.exe /UNINSTALL
      -->C:\WINDOWS\UNNeroMediaHome.exe /UNINSTALL
      -->C:\WINDOWS\UNNeroShowTime.exe /UNINSTALL
      -->C:\WINDOWS\UNNeroVision.exe /UNINSTALL
      -->C:\WINDOWS\UNRecode.exe /UNINSTALL
      -->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
      ABBYY FineReader 5.0 Sprint-->MsiExec.exe /X{D1696920-9794-4BBC-8A30-7A88763DE5A2}
      Ad-Aware SE Professional-->C:\PROGRA~1\Lavasoft\AD-AWA~1\UNWISE.EXE C:\PROGRA~1\Lavasoft\AD-AWA~1\INSTALL.LOG
      Adobe Acrobat 5.0-->C:\WINDOWS\ISUN040C.EXE -f"C:\Program Files\Fichiers communs\Adobe\Acrobat 5.0\NT\Uninst.isu" -c"C:\Program Files\Fichiers communs\Adobe\Acrobat 5.0\NT\Uninst.dll"
      Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
      Advanced RAR Password Recovery (remove only)-->C:\Program Files\ElcomSoft\ARPR\uninstall.exe
      Agere Systems PCI Soft Modem-->agrsmdel
      Archiveur WinRAR-->C:\Program Files\WinRAR\uninstall.exe
      Assistant de connexion Windows Live-->MsiExec.exe /I{D3116CC7-24DC-4CA3-9CE1-23FED836E9F2}
      Canon LASER SHOT LBP-1120-->C:\WINDOWS\system32\spool\drivers\w32x86\3\CAP3UNIK.EXE
      CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
      Correctif pour Lecteur Windows Media 11 (KB939683)-->"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"
      Correctif pour Windows Internet Explorer 7 (KB947864)-->"C:\WINDOWS\ie7updates\KB947864-IE7\spuninst\spuninst.exe"
      Correctif pour Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
      Creative Modem Blaster V.92 DI5733-1-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C1C0717C-546A-11D7-9963-00A0C92C4EC3}\setup.exe" -l0x40c /remove
      eMule-->"C:\Program Files\eMule\Uninstall.exe"
      Ensemble clavier et souris sans fil Labtec-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A369B607-5BAF-4AB3-B18A-1017ED19902D}\Setup.exe" -l0x040c
      Favorit-->"c:\documents and settings\nico et marion\local settings\application data\smiky.exe" -uninstall
      FenAffiche (C:\Program Files\FenAffiche\)-->C:\WINDOWS\st6unst.exe -n "C:\Program Files\FenAffiche\ST6UNST.000"
      FenAffiche-->C:\WINDOWS\st6unst.exe -n "C:\Program Files\FenAffiche\ST6UNST.LOG"
      Gestionnaire Internet-->C:\PROGRA~1\Wanadoo\uninstall.exe
      Google Earth-->MsiExec.exe /I{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}
      Hercules WebCam Station-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D208F4A7-6B73-4C2A-8B1E-8756FCBA831E}\Setup.exe" -l0x40c
      Hercules Webcam-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A250D351-A07F-4D5D-AB6C-693C69B9BFAF}\Setup.exe" -l0x40c
      HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall
      Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
      Java(TM) 6 Update 2-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160020}
      Java(TM) 6 Update 3-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030}
      Java(TM) 6 Update 5-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}
      Java(TM) SE Runtime Environment 6 Update 1-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160010}
      Language pack for Ad-Aware SE-->C:\PROGRA~1\Lavasoft\AD-AWA~1\Plugins\Langs\UNWISE.EXE C:\PROGRA~1\Lavasoft\AD-AWA~1\Plugins\Langs\INSTALL.LOG
      Lecteur Windows Media 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
      Lexmark 1200 Series-->C:\WINDOWS\system32\spool\drivers\w32x86\3\LXCZUN5C.EXE -dLexmark 1200 Series
      LimeWire PRO 4.16.4-->"C:\Program Files\LimeWire\uninstall.exe"
      McAfee SecurityCenter-->c:\PROGRA~1\mcafee.com\shared\mcappins.exe /v=3 /uninstall=1 /appid=msc /interact=1 /script_proactive=0 /start=c:\PROGRA~1\mcafee.com\agent\uninst\screm.ui::uninstall.htm
      McAfee VirusScan-->c:\PROGRA~1\mcafee.com\shared\mcappins.exe /v=3 /uninstall=1 /interact=1 /script_proactive=1 /start=c:\PROGRA~1\mcafee.com\agent\uninst\vsoremui.dll::uninstall.htm
      Microsoft .NET Framework 1.1 French Language Pack-->MsiExec.exe /X{9A394342-4A68-4EBA-85A6-55B559F4E700}
      Microsoft .NET Framework 1.1 Hotfix (KB928366)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"
      Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
      Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
      Microsoft .NET Framework 2.0 Service Pack 1-->MsiExec.exe /I{B508B3F1-A24A-32C0-B310-85786919EF28}
      Microsoft .NET Framework 3.0 Service Pack 1-->MsiExec.exe /I{2BA00471-0328-3743-93BD-FA813353A783}
      Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
      Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
      Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
      Microsoft Office PowerPoint Viewer 2007 (French)-->MsiExec.exe /X{95120000-00AF-040C-0000-0000000FF1CE}
      Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
      Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
      Mise à jour critique pour Lecteur Windows Media 11 (KB959772)-->"C:\WINDOWS\$NtUninstallKB959772_WM11$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Lecteur Windows Media (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Lecteur Windows Media 10 (KB911565)-->"C:\WINDOWS\$NtUninstallKB911565$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Lecteur Windows Media 10 (KB917734)-->"C:\WINDOWS\$NtUninstallKB917734_WMP10$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Lecteur Windows Media 11 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Lecteur Windows Media 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows Internet Explorer 7 (KB928090)-->"C:\WINDOWS\ie7updates\KB928090-IE7\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows Internet Explorer 7 (KB929969)-->"C:\WINDOWS\ie7updates\KB929969\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows Internet Explorer 7 (KB931768)-->"C:\WINDOWS\ie7updates\KB931768-IE7\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows Internet Explorer 7 (KB933566)-->"C:\WINDOWS\ie7updates\KB933566-IE7\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows Internet Explorer 7 (KB937143)-->"C:\WINDOWS\ie7updates\KB937143-IE7\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows Internet Explorer 7 (KB938127)-->"C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows Internet Explorer 7 (KB939653)-->"C:\WINDOWS\ie7updates\KB939653-IE7\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows Internet Explorer 7 (KB942615)-->"C:\WINDOWS\ie7updates\KB942615-IE7\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows Internet Explorer 7 (KB944533)-->"C:\WINDOWS\ie7updates\KB944533-IE7\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows Internet Explorer 7 (KB950759)-->"C:\WINDOWS\ie7updates\KB950759-IE7\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows Internet Explorer 7 (KB953838)-->"C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows Internet Explorer 7 (KB956390)-->"C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows Internet Explorer 7 (KB958215)-->"C:\WINDOWS\ie7updates\KB958215-IE7\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows Internet Explorer 7 (KB960714)-->"C:\WINDOWS\ie7updates\KB960714-IE7\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows Internet Explorer 7 (KB961260)-->"C:\WINDOWS\ie7updates\KB961260-IE7\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB923561)-->"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB938464-v2)-->"C:\WINDOWS\$NtUninstallKB938464-v2$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB950760)-->"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB951376)-->"C:\WINDOWS\$NtUninstallKB951376$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB952004)-->"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB953839)-->"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB956572)-->"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB958690)-->"C:\WINDOWS\$NtUninstallKB958690$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB959426)-->"C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB960715)-->"C:\WINDOWS\$NtUninstallKB960715$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB960803)-->"C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe"
      Mise à jour de sécurité pour Windows XP (KB961373)-->"C:\WINDOWS\$NtUninstallKB961373$\spuninst\spuninst.exe"
      Mise à jour pour Windows Internet Explorer 8 (KB968220)-->"C:\WINDOWS\ie8updates\KB968220-IE8\spuninst\spuninst.exe"
      Mise à jour pour Windows XP (KB951072-v2)-->"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
      Mise à jour pour Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
      Mise à jour pour Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
      Mise à jour pour Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"
      Moniteur WiFi OLITEC-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{DE06F9AA-6C9D-4D64-A028-41B6340200AF}\setup.exe" -l0x40c -removeonly
      MSXML 4.0 SP2 (KB927978)-->MsiExec.exe /I{37477865-A3F1-4772-AD43-AAFC6BCFF99F}
      MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
      MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
      MSXML 4.0 SP2 Parser and SDK-->MsiExec.exe /I{716E0306-8318-4364-8B8F-0CC4E9376BAC}
      MSXML 6.0 Parser (KB933579)-->MsiExec.exe /I{0A869A65-8C94-4F7C-A5C7-972D3C8CED9E}
      Nero 8 Trial-->MsiExec.exe /X{5FCCD531-1B38-4A94-924C-127F722F1036}
      neroxml-->MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}
      Outil de mise à jour Google-->"C:\Program Files\Google\Google Updater\GoogleUpdater.exe" -uninstall
      PCI Audio Driver-->cmuninst.exe
      PowerDVD-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\setup.exe" -uninstall
      Quicktime Browser Plug-In-->C:\WINDOWS\uninst.exe -f"C:\Program Files\Netscape\Navigator\Program\Plugins\npqtw\DeIsL1.isu"
      QuickTime-->C:\WINDOWS\unvise32qt.exe C:\WINDOWS\system32\QuickTime\Uninstall.log
      RamBoost XP 4.0.6-->"C:\Program Files\RamBoost XP\unins000.exe"
      Recover Pro-->C:\Program Files\Phoenix Technologies Ltd\RecoverPro_XP\un_vback.exe
      S3 S3Info2-->vtuninst.exe -reg 5 'HKLM\Software\S3\VT\S3Uninst\S3Info2'
      S3 S3Overlay-->vtuninst.exe -reg 5 'HKLM\Software\S3\VT\S3Uninst\S3Overlay'
      SAMSUNG Mobile USB Modem 1.0 Software-->C:\WINDOWS\system32\Samsung\SS_Uninstall.exe
      Samsung PC Studio 3 USB Driver Installer-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EBA29752-DDD2-4B62-B2E3-9841F92A3E3A}\setup.exe" -l0x40c -removeonly
      Samsung PC Studio-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C4A4722E-79F9-417C-BD72-8D359A090C97}\setup.exe" -l0x40c -removeonly
      Samsung Samples Installer-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7AC15160-A49B-4A89-B181-D4619C025FFF}\setup.exe" -l0x40c -removeonly
      ShopperReports-->C:\Program Files\ShoppingReport\Uninst.exe
      Sina Web TV-->C:\PROGRA~1\sina\SINAWE~1\304~1.2\UNWISE.EXE C:\PROGRA~1\sina\SINAWE~1\304~1.2\Install.LOG
      TMPGEnc DVD Author 1.5-->MsiExec.exe /I{4A8A0AE0-8F80-4621-AD2F-E2F8FE0CC7FD}
      TuneUp Utilities 2008-->MsiExec.exe /I{5888428E-699C-4E71-BF71-94EE06B497DA}
      TVAnts 1.0-->C:\PROGRA~1\TVAnts\UNWISE.EXE C:\PROGRA~1\TVAnts\INSTALL.LOG
      VCRedistSetup-->MsiExec.exe /I{3921A67A-5AB1-4E48-9444-C71814CF3027}
      Veetle TV Player 0.9.11-->C:\Program Files\Veetle\VLC\uninstall.exe
      Veetle TV Player 0.9.11-->C:\WINDOWS\UninstVeetleTVPlayer.exe
      VIA Audio Driver Setup Program-->RunDll32.exe UnAudioNT.dll,UninstallAudio C:\WINDOWS\IsUninst.exe -y-f"C:\PROGRA~1\VIAudioi\SBASetup\Uninst.isu"
      VideoLAN VLC media player 0.8.6f-->C:\Program Files\VideoLAN\VLC\uninstall.exe
      Viewpoint Media Player-->C:\Program Files\Viewpoint\Viewpoint Experience Technology\mtsAxInstaller.exe /u
      Visionneuse Journal Windows Microsoft-->MsiExec.exe /X{43DCF766-6838-4F9A-8C91-D92DA586DFA7}
      WinAVI Video Converter 7.7-->"C:\Program Files\WinAVI Video Converter\unins000.exe"
      Windows Imaging Component-->"C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
      Windows Internet Explorer 8-->"C:\WINDOWS\ie8\spuninst\spuninst.exe"
      Windows Live installer-->MsiExec.exe /X{FD44E544-E7D0-4DBA-9FA0-8AE1A1300390}
      Windows Live Messenger-->MsiExec.exe /X{BADF6744-3787-48F6-B8C9-4C4995401D65}
      Windows Live Toolbar-->"C:\Program Files\Windows Live Toolbar\UnInstall.exe" {D5A145FC-D00C-4F1A-9119-EB4D9D659750}
      Windows Live Toolbar-->MsiExec.exe /X{D5A145FC-D00C-4F1A-9119-EB4D9D659750}
      Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
      Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
      Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
      Windows Presentation Foundation-->MsiExec.exe /X{BAF78226-3200-4DB4-BE33-4D922A799840}
      Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"

      ======Security center information======

      AV: McAfee VirusScan (outdated)

      ======System event log======

      Computer Name: NICOLAS
      Event Code: 7036
      Message: Le service Téléphonie est entré dans l'état : en cours d'exécution.

      Record Number: 108469
      Source Name: Service Control Manager
      Time Written: 20090413233839.000000+120
      Event Type: Informations
      User:

      Computer Name: NICOLAS
      Event Code: 7036
      Message: Le service Service COM de gravage de CD IMAPI est entré dans l'état : en cours d'exécution.

      Record Number: 108468
      Source Name: Service Control Manager
      Time Written: 20090413233839.000000+120
      Event Type: Informations
      User:

      Computer Name: NICOLAS
      Event Code: 7035
      Message: Un contrôle Démarrer a correctement été envoyé au service Service COM de gravage de CD IMAPI.

      Record Number: 108467
      Source Name: Service Control Manager
      Time Written: 20090413233839.000000+120
      Event Type: Informations
      User: AUTORITE NT\SYSTEM

      Computer Name: NICOLAS
      Event Code: 7036
      Message: Le service Explorateur d'ordinateur est entré dans l'état : arrêté.

      Record Number: 108466
      Source Name: Service Control Manager
      Time Written: 20090413233839.000000+120
      Event Type: Informations
      User:

      Computer Name: NICOLAS
      Event Code: 7036
      Message: Le service Service de la passerelle de la couche Application est entré dans l'état : en cours d'exécution.

      Record Number: 108465
      Source Name: Service Control Manager
      Time Written: 20090413233836.000000+120
      Event Type: Informations
      User:

      =====Application event log=====

      Computer Name: NICOLAS
      Event Code: 2003
      Message:
      Record Number: 11321
      Source Name: EAPOL
      Time Written: 20090222151412.000000+060
      Event Type: Informations
      User:

      Computer Name: NICOLAS
      Event Code: 1000
      Message: Application défaillante temp2.exe, version 0.0.0.0, module défaillant temp2.exe, version 0.0.0.0, adresse de défaillance 0x0000126e.

      Record Number: 11320
      Source Name: Application Error
      Time Written: 20090222151343.000000+060
      Event Type: erreur
      User:

      Computer Name: NICOLAS
      Event Code: 1800
      Message: Le service Centre de sécurité Windows a démarré.

      Record Number: 11319
      Source Name: SecurityCenter
      Time Written: 20090222151335.000000+060
      Event Type: Informations
      User:

      Computer Name: NICOLAS
      Event Code: 0
      Message:
      Record Number: 11318
      Source Name: Nero BackItUp Scheduler 3
      Time Written: 20090222151334.000000+060
      Event Type: Informations
      User:

      Computer Name: NICOLAS
      Event Code: 0
      Message:
      Record Number: 11317
      Source Name: gusvc
      Time Written: 20090222151334.000000+060
      Event Type: Informations
      User:

      ======Environment variables======

      "ComSpec"=%SystemRoot%\system32\cmd.exe
      "Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\Pinnacle\Shared Files\InstantCDDVD\
      "windir"=%SystemRoot%
      "FP_NO_HOST_CHECK"=NO
      "OS"=Windows_NT
      "PROCESSOR_ARCHITECTURE"=x86
      "PROCESSOR_LEVEL"=6
      "PROCESSOR_IDENTIFIER"=x86 Family 6 Model 8 Stepping 1, AuthenticAMD
      "PROCESSOR_REVISION"=0801
      "NUMBER_OF_PROCESSORS"=1
      "PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
      "TEMP"=%SystemRoot%\TEMP
      "TMP"=%SystemRoot%\TEMP

      -----------------EOF-----------------
  2. jlpjlp Contributeur sécurité
    utilise pour supprimer tes traces

    CCLEANER: (lance un nettoyage et répare 3 fois le registre) sans installer la barre yahoo
    (dans les options puis avancé :désactive la case: effacer les fichiers de plus de 48 heures)
    https://www.malekal.com/tutoriel-ccleaner/
    https://www.01net.com/telecharger/windows/Utilitaire/nettoyeurs_et_installeurs/fiches/32599.html
    -----------------------

    télécharge combofix (par sUBs) ici :

    http://download.bleepingcomputer.com/sUBs/ComboFix.exe

    et enregistre le sur le bureau.

    déconnecte toi d'internet et ferme toutes tes applications.

    désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)

    double-clique sur combofix.exe et suis les instructions

    à la fin, il va produire un rapport C:\ComboFix.txt

    réactive ton parefeu, ton antivirus, la garde de ton antispyware

    copie/colle le rapport C:\ComboFix.txt dans ta prochaine réponse.

    Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi.

    Tu as un tutoriel complet ici :

    https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

    _____________________________

    scanne rapide avec
    MalwareByte's Anti-Malware après mise a jour, en mode normal et vire ce qui est trouvé et colle le rapport

    https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
    _____________________________

    remets un rapport RSIT neuf et dis tes soucis actuels
    1. jlpjlp Contributeur sécurité
      up
      1. nicos03 Auteur
        Desolé mais combofix ne se lance pas sur mon pc ...

        Je ne comprend pas pourquoi ... J'ai pourtant suivi tes instructions a la lettre ..
    2. jlpjlp Contributeur sécurité
      essaie avec ce combofix:

      télécharge combofix (par sUBs) ici : (=killfix)

      http://sd-1.archive-host.com/membres/up/193094576412487685/Killfix.exe

      et enregistre le sur le bureau.

      déconnecte toi d'internet et ferme toutes tes applications.

      désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)

      double-clique sur combofix.exe et suis les instructions

      à la fin, il va produire un rapport C:\ComboFix.txt

      réactive ton parefeu, ton antivirus, la garde de ton antispyware

      copie/colle le rapport C:\ComboFix.txt dans ta prochaine réponse.

      Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi.

      Tu as un tutoriel complet ici :

      http://www.bleepingcomputer.com/combofix/fr/comment-utiliser­-combofix
      2. nicos03
        Voici le rapport de combofix :

        omboFix 09-05-14.02 - Nico et marion 14/05/2009 21:45.1 - NTFSx86
        Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.1279.975 [GMT 2:00]
        Lancé depuis: c:\documents and settings\Nico et marion\Bureau\Killfix2.exe
        AV: McAfee VirusScan *On-access scanning enabled* (Outdated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
        .

        (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
        .

        C:\autorun.bat
        C:\autorun.vbs
        C:\copy.exe
        c:\documents and settings\Nico et marion\Application Data\ShoppingReport
        c:\documents and settings\Nico et marion\Application Data\ShoppingReport\cs\Config.xml
        c:\documents and settings\Nico et marion\Application Data\twain\Twain.exe
        c:\documents and settings\Nico et marion\Local Settings\Application Data\smiky.dat
        c:\documents and settings\Nico et marion\Local Settings\Application Data\smiky.exe
        c:\documents and settings\Nico et marion\Local Settings\Application Data\smiky_nav.dat
        c:\documents and settings\Nico et marion\Local Settings\Application Data\smiky_navps.dat
        c:\documents and settings\Nico et marion\Local Settings\Temporary Internet Files\CPV.stt
        c:\documents and settings\Nico et marion\RavMonLog
        c:\documents and settings\nico\RavMonLog
        C:\host.exe
        c:\program files\Jcore
        c:\program files\Jcore\Jcore2.dll
        c:\program files\QUAD Utilities
        c:\program files\QUAD Utilities\QUAD Registry Cleaner\Vista Scheduler.dll
        c:\program files\ShoppingReport
        c:\program files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
        c:\program files\ShoppingReport\Uninst.exe
        c:\program files\WWShow
        c:\program files\WWShow\WWShow.dll
        c:\windows\autorun.inf
        c:\windows\svchost.exe
        c:\windows\system32\AutoRun.inf
        c:\windows\system32\autorun.reg
        c:\windows\system32\autorun.vbs
        c:\windows\system32\bhpowj.dll
        c:\windows\system32\cbXNdbyA.dll
        c:\windows\system32\config\47799240.Evt
        c:\windows\system32\cwawcy.dll
        c:\windows\system32\dcnlrs.dll
        c:\windows\system32\dlkiinwo.dll
        c:\windows\system32\drivers\UACqbuwmexmprmbsxv.sys
        c:\windows\system32\fdjxpw.dll
        c:\windows\system32\ghkpnidf.dll
        c:\windows\system32\hgGyaaYo.dll
        c:\windows\system32\hyaalnci.ini
        c:\windows\system32\icnlaayh.dll
        c:\windows\system32\jvfnez.dll
        c:\windows\system32\mcrh.tmp
        c:\windows\system32\msclock32.dll
        c:\windows\system32\msegcompid.dll
        c:\windows\system32\msplock32.dll
        c:\windows\system32\nvctrl.exe
        c:\windows\system32\oYaayGgh.ini
        c:\windows\system32\oYaayGgh.ini2
        c:\windows\system32\pafkdxav.dll
        c:\windows\system32\prdygiyf.dll
        c:\windows\system32\ptufnssk.ini
        c:\windows\system32\rwiatooh.dll
        c:\windows\system32\temp1.exe
        c:\windows\system32\temp2.exe
        c:\windows\system32\UACcpqlaorpiqwmwer.dll
        c:\windows\system32\UACepnfhtglcpotmxs.dll
        c:\windows\system32\UAChowberftyxabcbn.dll
        c:\windows\system32\uacinit.dll
        c:\windows\system32\UACkvpbbnauqhldfya.log
        c:\windows\system32\UACkvterrwxaqbpdpk.dll
        c:\windows\system32\UACmseefhtruwxspos.log
        c:\windows\system32\UACpaspbanvacceptx.dll
        c:\windows\system32\UACqmkyxuwkmrdkvoo.dll
        c:\windows\system32\UACsaisuetoxxxribl.log
        c:\windows\system32\UACweyejmielivytbo.db
        c:\windows\system32\UACylltivasdxvaefq.dat
        c:\windows\system32\vcilch.dll
        c:\windows\system32\vpymfqfk.dll
        c:\windows\xcopy.exe

        .
        ((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
        .

        -------\Service_UACd.sys
        -------\Legacy_BOONTY_GAMES
        -------\Service_asc3550p
        -------\Service_Boonty Games

        ((((((((((((((((((((((((((((( Fichiers créés du 2009-04-14 au 2009-05-14 ))))))))))))))))))))))))))))))))))))
        .

        2009-05-14 19:24 . 2009-05-14 19:25 -------- d-----w C:\Killfix
        2009-05-14 06:11 . 2009-05-14 09:11 -------- d-----w c:\program files\trend micro
        2009-05-14 06:11 . 2009-05-14 06:11 -------- d-----w C:\rsit
        2009-05-11 16:00 . 2009-05-14 19:47 -------- d-----w c:\documents and settings\Nico et marion\Application Data\Twain
        2009-05-10 17:00 . 2009-05-10 17:00 -------- d-----w c:\program files\CCleaner
        2009-05-10 14:26 . 2009-05-10 14:26 7 ----a-w c:\windows\sbacknt.bin
        2009-05-10 14:25 . 2009-05-10 14:31 -------- d-----w c:\program files\vghd
        2009-05-10 14:25 . 2009-05-10 14:27 -------- d-----w c:\documents and settings\Nico et marion\Application Data\vghd
        2009-05-10 11:57 . 2009-05-10 11:57 -------- d-----w c:\documents and settings\All Users\Application Data\Babylon
        2009-05-10 11:57 . 2009-05-10 11:57 -------- d-----w c:\documents and settings\Nico et marion\Application Data\Babylon
        2009-04-27 09:24 . 2009-05-09 13:16 -------- d-sh--w c:\documents and settings\All Users\Application Data\MPK
        2009-04-16 17:39 . 2009-02-06 10:10 227840 -c----w c:\windows\system32\dllcache\wmiprvse.exe
        2009-04-16 17:39 . 2009-03-06 14:20 286720 -c----w c:\windows\system32\dllcache\pdh.dll
        2009-04-16 17:39 . 2009-02-09 11:23 111104 -c----w c:\windows\system32\dllcache\services.exe
        2009-04-16 17:39 . 2009-02-09 10:53 401408 -c----w c:\windows\system32\dllcache\rpcss.dll
        2009-04-16 17:39 . 2009-02-09 10:53 473600 -c----w c:\windows\system32\dllcache\fastprox.dll
        2009-04-16 17:39 . 2009-02-09 10:53 685568 -c----w c:\windows\system32\dllcache\advapi32.dll
        2009-04-16 17:39 . 2009-02-09 10:53 735744 -c----w c:\windows\system32\dllcache\lsasrv.dll
        2009-04-16 17:39 . 2009-02-09 10:53 453120 -c----w c:\windows\system32\dllcache\wmiprvsd.dll
        2009-04-16 17:39 . 2009-02-09 10:53 739840 -c----w c:\windows\system32\dllcache\ntdll.dll
        2009-04-16 17:39 . 2008-12-16 12:31 354304 -c----w c:\windows\system32\dllcache\winhttp.dll
        2009-04-16 17:39 . 2008-04-21 21:15 219136 -c----w c:\windows\system32\dllcache\wordpad.exe
        2009-04-16 05:42 . 2009-04-16 05:42 -------- d-sh--w c:\documents and settings\Nico et marion\IECompatCache

        .
        (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
        .
        2009-05-12 03:55 . 2005-02-02 17:14 -------- d-----w c:\program files\eMule
        2009-05-10 17:21 . 2004-11-25 09:14 -------- d-----w c:\program files\Fichiers communs\Real
        2009-05-10 17:19 . 2006-12-17 12:06 -------- d-----w c:\program files\DivX
        2009-05-02 13:05 . 2004-11-24 17:19 85696 ----a-w c:\windows\system32\perfc00C.dat
        2009-05-02 13:05 . 2004-11-24 17:19 513492 ----a-w c:\windows\system32\perfh00C.dat
        2009-04-11 09:15 . 2009-04-10 16:02 -------- d-----w c:\program files\Microsoft Silverlight
        2009-03-15 22:07 . 2009-03-15 22:07 -------- d-----w c:\program files\Fichiers communs\Windows Live
        2009-03-08 02:34 . 2004-11-24 17:19 914944 ----a-w c:\windows\system32\wininet.dll
        2009-03-08 02:34 . 2004-11-24 17:19 43008 ----a-w c:\windows\system32\licmgr10.dll
        2009-03-08 02:33 . 2004-11-24 17:19 18944 ----a-w c:\windows\system32\corpol.dll
        2009-03-08 02:33 . 2004-11-24 17:19 420352 ----a-w c:\windows\system32\vbscript.dll
        2009-03-08 02:32 . 2004-11-24 17:19 72704 ----a-w c:\windows\system32\admparse.dll
        2009-03-08 02:32 . 2004-11-24 17:19 71680 ----a-w c:\windows\system32\iesetup.dll
        2009-03-08 02:31 . 2004-11-24 17:19 34816 ----a-w c:\windows\system32\imgutil.dll
        2009-03-08 02:31 . 2004-11-24 17:19 48128 ----a-w c:\windows\system32\mshtmler.dll
        2009-03-08 02:31 . 2004-11-24 17:19 45568 ----a-w c:\windows\system32\mshta.exe
        2009-03-08 02:22 . 2004-11-24 17:19 156160 ----a-w c:\windows\system32\msls31.dll
        2009-03-06 14:20 . 2004-11-24 17:19 286720 ----a-w c:\windows\system32\pdh.dll
        2006-02-16 14:37 . 2006-02-16 14:37 278528 -c--a-w c:\program files\Fichiers communs\FDEUnInstaller.exe
        2006-12-19 21:18 . 2006-12-19 21:18 14 -csh--w c:\windows\mswtpdxp.dll
        2006-12-19 21:18 . 2006-12-19 21:18 21 -csh--w c:\windows\prwttrxp.dll
        2006-07-30 15:20 . 2007-05-15 14:28 959 -csha-r c:\windows\system32\autorun.bin
        2006-12-19 21:18 . 2006-12-19 21:18 21 -csh--w c:\windows\system32\dpwttaxp.dll
        2006-12-19 21:18 . 2006-12-19 21:18 14 -csh--w c:\windows\system32\mswtpaxp.dll
        2006-12-19 21:18 . 2006-12-19 21:18 2 -csh--w c:\windows\system32\verwttxp.dll
        .

        ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
        .
        .
        *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
        REGEDIT4

        [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
        "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "QuickTime Task"="c:\windows\system32\qttask.exe" [2006-05-22 98304]
        "CAP3ON"="c:\windows\system32\spool\drivers\w32x86\3\CAP3ONN.EXE" [2002-07-30 22528]
        "PinnacleDriverCheck"="c:\windows\system32\PSDrvCheck.exe" [2003-11-10 406016]
        "C-Media Mixer"="Mixer.exe" - c:\windows\mixer.exe [2005-01-12 1216512]

        [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
        "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

        c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
        Moniteur WiFi OLITEC.exe.lnk - c:\program files\OLITEC\Moniteur WiFi OLITEC\Moniteur WiFi OLITEC.exe [2008-11-3 913408]

        HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32
        "wave"= serwvdrv.dll
        "wave2"= serwvdrv.dll
        "wave3"= serwvdrv.dll

        [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Activer l'ensemble clavier et souris sans fil Labtec.lnk]
        path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Activer l'ensemble clavier et souris sans fil Labtec.lnk
        backup=c:\windows\pss\Activer l'ensemble clavier et souris sans fil Labtec.lnkCommon Startup

        [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Fenêtre d'état de Canon LASER SHOT LBP-1120.LNK]
        path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Fenêtre d'état de Canon LASER SHOT LBP-1120.LNK
        backup=c:\windows\pss\Fenêtre d'état de Canon LASER SHOT LBP-1120.LNKCommon Startup

        [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Ralink Wireless Utility.lnk]
        path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Ralink Wireless Utility.lnk
        backup=c:\windows\pss\Ralink Wireless Utility.lnkCommon Startup

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
        "MCVSRte"=2 (0x2)
        "mcupdmgr.exe"=3 (0x3)
        "McTskshd.exe"=2 (0x2)
        "McShield"=3 (0x3)
        "McDetect.exe"=2 (0x2)
        "FTRTSVC"=2 (0x2)

        [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
        "AGRSMMSG"=AGRSMMSG.exe

        [HKEY_LOCAL_MACHINE\software\microsoft\security center]
        "AntiVirusDisableNotify"=dword:00000001
        "UpdatesDisableNotify"=dword:00000001

        [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
        "DisableMonitoring"=dword:00000001

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
        "EnableFirewall"= 0 (0x0)

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
        "%windir%\\system32\\sessmgr.exe"=
        "c:\\Program Files\\eMule\\emule.exe"=
        "c:\\Program Files\\NetMeeting\\conf.exe"=
        "c:\\Program Files\\Messenger\\msmsgs.exe"=
        "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
        "c:\\Program Files\\eMule\\LinkCreator.exe"=
        "c:\\Program Files\\RALINK\\Common\\RaUI.exe"=
        "c:\\Program Files\\LimeWire\\LimeWire.exe"=
        "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
        "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
        "c:\\Program Files\\OLITEC\\Moniteur WiFi OLITEC\\Moniteur WiFi OLITEC.exe"=
        "c:\\Program Files\\TVAnts\\Tvants.exe"=

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
        "4662:TCP"= 4662:TCP:emulle
        "4672:UDP"= 4672:UDP:emule
        "16100:TCP"= 16100:TCP:NortonAV
        "15598:TCP"= 15598:TCP:NortonAV
        "14753:TCP"= 14753:TCP:NortonAV
        "16994:TCP"= 16994:TCP:NortonAV
        "16566:TCP"= 16566:TCP:NortonAV
        "16383:TCP"= 16383:TCP:NortonAV
        "14480:TCP"= 14480:TCP:NortonAV
        "14271:TCP"= 14271:TCP:NortonAV
        "12612:TCP"= 12612:TCP:NortonAV
        "16103:TCP"= 16103:TCP:NortonAV
        "14872:TCP"= 14872:TCP:NortonAV
        "18567:TCP"= 18567:TCP:NortonAV
        "16597:TCP"= 16597:TCP:NortonAV
        "15336:TCP"= 15336:TCP:NortonAV
        "14187:TCP"= 14187:TCP:NortonAV
        "15462:TCP"= 15462:TCP:NortonAV

        R0 RITCPT;RITCPT;c:\windows\system32\drivers\RITCPT.SYS [24/11/2004 18:47 43512]
        R0 VVBackd5;VVBackd5;c:\windows\system32\drivers\VVBackd5.sys [02/02/2005 18:11 179482]
        R1 kbfilter;Keyboard Filter Driver;c:\windows\system32\drivers\kbfilter.sys [02/02/2005 18:09 11776]
        R2 FBAPI;FBAPI;c:\windows\system32\drivers\FBAPI.sys [24/11/2004 18:47 5088]
        R3 ovt530;Webcam Deluxe;c:\windows\system32\drivers\ov530vid.sys [06/06/2008 17:37 161792]
        S3 MRVW225;802.11g/b Wireless LAN Dirver for Windows XP;c:\windows\system32\drivers\MRVW225.sys [08/09/2008 19:03 299904]
        S3 NaiFiltr;NaiFiltr;c:\windows\system32\drivers\NaiFiltr.sys [24/11/2004 18:48 23296]
        S3 PinnacleMicroTV;Pinnacle Systems MicroTV Device;c:\windows\system32\drivers\MicroTV.sys [17/12/2006 14:05 122368]

        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
        UxTuneUp
        .
        Contenu du dossier 'Tâches planifiées'

        2009-05-14 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
        - c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 10:20]

        2009-05-14 c:\windows\Tasks\Google Software Updater.job
        - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-05-17 04:03]

        2009-05-08 c:\windows\Tasks\Maintenance en 1 clic.job
        - c:\program files\TuneUp Utilities 2008\OneClick.exe [2007-12-21 14:39]
        .
        - - - - ORPHELINS SUPPRIMES - - - -

        BHO-{100EB1FD-D03E-47FD-81F3-EE91287F9465} - c:\program files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
        BHO-{15421B84-3488-49A7-AD18-CBF84A3EFAF6} - c:\program files\WWShow\WWShow.dll
        BHO-{65F5A866-E091-4476-A427-CC14EEEE1639} - (no file)
        BHO-{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - c:\windows\system32\cbXNdbyA.dll
        BHO-{CB9C357B-C9ED-474D-80DE-DA941A919FA4} - c:\windows\system32\hgGyaaYo.dll
        BHO-{D88E1558-7C2D-407A-953A-C044F5607CEA} - c:\program files\Jcore\Jcore2.dll
        BHO-{e6292712-a69f-478a-b398-692964effe45} - c:\windows\system32\bhpowj.dll
        Toolbar-Locked - (no file)
        WebBrowser-{07AA283A-43D7-4CBE-A064-32A21112D94D} - (no file)
        ShellExecuteHooks-{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - c:\windows\system32\cbXNdbyA.dll
        ShellExecuteHooks-{34233f74-1c1b-43c2-bbfc-b65b270bde70} - c:\windows\system32\bhpowj.dll

        .
        ------- Examen supplémentaire -------
        .
        uStart Page = hxxp://www.google.fr/
        uSearchURL,(Default) = hxxp://g.msn.co.uk/0SEENWW/SAOS01?FORM=TOOLBR
        IE: { - c:\progra~1\WANADO~1\Wanadoo Messager.exe
        IE: {{C5428486-50A0-4a02-9D20-520B59A9F9B2} - {C9CCBB35-D123-4a31-AFFC-9B2933132116} - c:\program files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
        IE: {{C5428486-50A0-4a02-9D20-520B59A9F9B3} - {A16AD1E9-F69A-45af-9462-B1C286708842} - c:\program files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
        DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
        DPF: {78ABDC59-D8E7-44D3-9A76-9A0918C52B4A} - hxxp://dl.uc.sina.com/cab/downloader.cab
        .

        **************************************************************************

        catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
        Rootkit scan 2009-05-14 21:56
        Windows 5.1.2600 Service Pack 3 NTFS

        Recherche de processus cachés ...

        Recherche d'éléments en démarrage automatique cachés ...

        Recherche de fichiers cachés ...

        Scan terminé avec succès
        Fichiers cachés: 0

        **************************************************************************
        .
        --------------------- CLES DE REGISTRE BLOQUEES ---------------------

        [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
        "ThreadingModel"="Apartment"
        @="c:\\WINDOWS\\system32\\OLE32.DLL"
        "cd042efbbd7f7af1647644e76e06692b"=hex:c8,28,51,af,b0,29,a3,98,18,eb,fa,98,f5,
        65,87,9a,c8,28,51,af,b0,29,a3,98,59,76,66,8c,03,a7,2b,68,e2,63,26,f1,3f,c8,\

        [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
        "ThreadingModel"="Apartment"
        @="c:\\WINDOWS\\system32\\OLE32.DLL"
        "bca643cdc5c2726b20d2ecedcc62c59b"=hex:6a,9c,d6,61,af,45,84,18,bc,1a,95,60,77,
        6b,bf,cf,71,3b,04,66,8b,46,0d,96,e5,2d,d6,59,a7,02,f3,37,6a,9c,d6,61,af,45,\

        [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
        "ThreadingModel"="Apartment"
        @="c:\\WINDOWS\\system32\\OLE32.DLL"
        "2c81e34222e8052573023a60d06dd016"=hex:7a,45,05,fd,91,e8,6f,31,19,73,d8,82,3c,
        a9,0b,f3,25,da,ec,7e,55,20,c9,26,81,cb,1f,20,4b,63,7d,08,ff,7c,85,e0,43,d4,\

        [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
        "ThreadingModel"="Apartment"
        @="c:\\WINDOWS\\system32\\OLE32.DLL"
        "2582ae41fb52324423be06337561aa48"=hex:86,8c,21,01,be,91,eb,e7,84,52,a5,98,48,
        53,39,a7,3e,1e,9e,e0,57,5a,93,61,c2,b4,20,51,d8,32,b5,c4,86,8c,21,01,be,91,\

        [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
        "ThreadingModel"="Apartment"
        @="c:\\WINDOWS\\system32\\OLE32.DLL"
        "caaeda5fd7a9ed7697d9686d4b818472"=hex:f5,1d,4d,73,a8,13,5c,05,fe,96,13,53,51,
        08,d5,56,cd,44,cd,b9,a6,33,6c,cd,cd,24,07,d2,d8,24,da,9c,f5,1d,4d,73,a8,13,\

        [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
        "ThreadingModel"="Apartment"
        @="c:\\WINDOWS\\system32\\OLE32.DLL"
        "a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:df,20,58,62,78,6b,cf,c8,97,ec,37,30,1e,
        ef,71,c4,b0,18,ed,a7,3f,8d,37,a4,b5,1a,67,ce,1c,09,8b,9e,df,20,58,62,78,6b,\

        [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
        "ThreadingModel"="Apartment"
        @="c:\\WINDOWS\\system32\\OLE32.DLL"
        "4d370831d2c43cd13623e232fed27b7b"=hex:97,20,4e,9a,c7,f1,35,ee,1f,d8,94,43,6e,
        3a,34,82,31,77,e1,ba,b1,f8,68,02,a8,eb,91,de,2e,41,d8,d7,fb,a7,78,e6,12,2f,\

        [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
        "ThreadingModel"="Apartment"
        @="c:\\WINDOWS\\system32\\OLE32.DLL"
        "1d68fe701cdea33e477eb204b76f993d"=hex:01,3a,48,fc,e8,04,4a,f1,e6,4e,9e,90,f2,
        f7,b3,ac,83,6c,56,8b,a0,85,96,ab,03,1a,db,12,f1,d9,1e,0f,01,3a,48,fc,e8,04,\

        [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
        "ThreadingModel"="Apartment"
        @="c:\\WINDOWS\\system32\\OLE32.DLL"
        "1fac81b91d8e3c5aa4b0a51804d844a3"=hex:f6,0f,4e,58,98,5b,89,c9,b5,ad,d1,9f,fe,
        ad,1a,76,51,fa,6e,91,28,9e,14,cc,c5,89,05,52,0b,58,ea,38,f6,0f,4e,58,98,5b,\

        [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
        "ThreadingModel"="Apartment"
        @="c:\\WINDOWS\\system32\\OLE32.DLL"
        "f5f62a6129303efb32fbe080bb27835b"=hex:b1,cd,45,5a,a8,c4,f8,b9,86,29,05,73,8b,
        68,89,78,b1,cd,45,5a,a8,c4,f8,b9,9d,bc,71,93,d9,c2,d8,6f,3d,ce,ea,26,2d,45,\

        [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
        "ThreadingModel"="Apartment"
        @="c:\\WINDOWS\\system32\\OLE32.DLL"
        "fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:e3,0e,66,d5,eb,bc,2f,6b,b9,86,f7,74,79,
        1a,90,08,e3,0e,66,d5,eb,bc,2f,6b,9d,16,e8,39,80,f3,58,4f,2a,b7,cc,b5,b9,7f,\

        [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
        "ThreadingModel"="Apartment"
        @="c:\\WINDOWS\\system32\\OLE32.DLL"
        "8a8aec57dd6508a385616fbc86791ec2"=hex:fa,ea,66,7f,d4,3b,6b,70,07,83,51,b8,ff,
        cd,c5,3b,fa,ea,66,7f,d4,3b,6b,70,5a,07,df,f2,a1,21,6a,57,6c,43,2d,1e,aa,22,\
        .
        --------------------- DLLs chargées dans les processus actifs ---------------------

        - - - - - - - > 'explorer.exe'(3576)
        c:\windows\system32\ieframe.dll
        c:\windows\system32\eappprxy.dll
        c:\windows\system32\webcheck.dll
        c:\windows\system32\WPDShServiceObj.dll
        c:\program files\Hercules\WebCam Station\PhotoImpression\share\pihook.dll
        c:\windows\system32\PortableDeviceTypes.dll
        c:\windows\system32\PortableDeviceApi.dll
        .
        ------------------------ Autres processus actifs ------------------------
        .
        c:\windows\system32\LEXBCES.EXE
        c:\windows\system32\LEXPPS.EXE
        c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
        c:\windows\system32\CAP3RSK.EXE
        c:\windows\system32\spool\drivers\w32x86\3\CAP3SWK.EXE
        .
        **************************************************************************
        .
        Heure de fin: 2009-05-14 22:00 - La machine a redémarré
        ComboFix-quarantined-files.txt 2009-05-14 20:00

        Avant-CF: 8 292 077 568 octets libres
        Après-CF: 9 424 547 840 octets libres

        WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
        [boot loader]
        timeout=2
        default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
        [operating systems]
        c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
        multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP dition familiale" /noexecute=optin /fastdetect

        361 --- E O F --- 2009-04-17 09:18
        2. nicos03
          RAPPORT RSIT

          Logfile of random's system information tool 1.06 (written by random/random)
          Run by Nico et marion at 2009-05-14 22:37:55
          Microsoft Windows XP Édition familiale Service Pack 3
          System drive C: has 9 GB (13%) free of 69 GB
          Total RAM: 1279 MB (67% free)

          Logfile of Trend Micro HijackThis v2.0.2
          Scan saved at 22:37:58, on 14/05/2009
          Platform: Windows XP SP3 (WinNT 5.01.2600)
          MSIE: Internet Explorer v8.00 (8.00.6001.18702)
          Boot mode: Normal

          Running processes:
          C:\WINDOWS\System32\smss.exe
          C:\WINDOWS\system32\winlogon.exe
          C:\WINDOWS\system32\services.exe
          C:\WINDOWS\system32\lsass.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\System32\svchost.exe
          C:\WINDOWS\Explorer.EXE
          C:\WINDOWS\system32\LEXBCES.EXE
          C:\WINDOWS\system32\spoolsv.exe
          C:\WINDOWS\system32\LEXPPS.EXE
          C:\WINDOWS\System32\svchost.exe
          C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\system32\wscntfy.exe
          C:\WINDOWS\system32\qttask.exe
          C:\WINDOWS\Mixer.exe
          C:\WINDOWS\system32\ctfmon.exe
          C:\Program Files\Windows Live\Messenger\msnmsgr.exe
          C:\WINDOWS\system32\CAP3RSK.EXE
          C:\Program Files\OLITEC\Moniteur WiFi OLITEC\Moniteur WiFi OLITEC.exe
          C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\CAP3SWK.EXE
          C:\Program Files\Internet Explorer\IEXPLORE.EXE
          C:\Program Files\Internet Explorer\IEXPLORE.EXE
          C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
          C:\Program Files\Internet Explorer\IEXPLORE.EXE
          C:\WINDOWS\system32\NOTEPAD.EXE
          C:\Documents and Settings\Nico et marion\Bureau\RSIT.exe
          C:\Program Files\trend micro\Nico et marion.exe

          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
          R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
          R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.msn.com/fr-fr/
          R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://runonce.msn.com/runonce3.aspx
          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
          O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
          O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
          O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
          O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
          O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
          O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
          O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
          O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
          O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
          O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
          O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\system32\qttask.exe" -atboottime
          O4 - HKLM\..\Run: [CAP3ON] C:\WINDOWS\system32\spool\drivers\w32x86\3\CAP3ONN.EXE
          O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
          O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe
          O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
          O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
          O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
          O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
          O4 - Global Startup: Moniteur WiFi OLITEC.exe.lnk = ?
          O9 - Extra button: Messager Wanadoo - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
          O9 - Extra 'Tools' menuitem: Messager Wanadoo - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
          O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
          O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
          O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
          O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
          O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
          O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
          O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
          O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
          O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
          O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
          O16 - DPF: {78ABDC59-D8E7-44D3-9A76-9A0918C52B4A} (DLoader Class) - http://dl.uc.sina.com/cab/downloader.cab
          O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://jeuxmultijoueurs.orange.fr/Gameshell/GameHost/1.0/OberonGameHost.cab
          O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
          O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
          O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
          O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
          O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
          O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
          1. nicos03
            RAPPORT MALWARE

            Malwarebytes' Anti-Malware 1.36
            Version de la base de données: 2132
            Windows 5.1.2600 Service Pack 3

            14/05/2009 22:26:03
            mbam-log-2009-05-14 (22-26-03).txt

            Type de recherche: Examen rapide
            Eléments examinés: 84288
            Temps écoulé: 3 minute(s), 29 second(s)

            Processus mémoire infecté(s): 0
            Module(s) mémoire infecté(s): 0
            Clé(s) du Registre infectée(s): 8
            Valeur(s) du Registre infectée(s): 2
            Elément(s) de données du Registre infecté(s): 2
            Dossier(s) infecté(s): 4
            Fichier(s) infecté(s): 234

            Processus mémoire infecté(s):
            (Aucun élément nuisible détecté)

            Module(s) mémoire infecté(s):
            (Aucun élément nuisible détecté)

            Clé(s) du Registre infectée(s):
            HKEY_CLASSES_ROOT\AppID\{26a98aa8-07fe-46e6-b6df-26704f3b895f} (Trojan.BHO) -> Quarantined and deleted successfully.
            HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5428486-50a0-4a02-9d20-520b59a9f9b2} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
            HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
            HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{a7cddcdc-beeb-4685-a062-978f5e07ceee} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
            HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{c5428486-50a0-4a02-9d20-520b59a9f9b2} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
            HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
            HKEY_LOCAL_MACHINE\SOFTWARE\Casino Tropez (Adware.Casino) -> Quarantined and deleted successfully.
            HKEY_CLASSES_ROOT\AppID\BHO_CPV.DLL (Trojan.BHO) -> Quarantined and deleted successfully.

            Valeur(s) du Registre infectée(s):
            HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{c5428486-50a0-4a02-9d20-520b59a9f9b2} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
            HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.Shopping.Report) -> Quarantined and deleted successfully.

            Elément(s) de données du Registre infecté(s):
            HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
            HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

            Dossier(s) infecté(s):
            C:\Program Files\DomPlayer (Trojan.Lop) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\Nico et marion\Application Data\Twain (Trojan.Matcash) -> Quarantined and deleted successfully.

            Fichier(s) infecté(s):
            C:\Documents and Settings\Nico et marion\Application Data\Microsoft\Windows\jncyu.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\M0000 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\S0000 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\D0000 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_4832817824 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_4867540046 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_4902264120 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_4936988194 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_4971712153 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_5006434375 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_5041158449 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_5075882523 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_5249493634 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_5284215856 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_5318938079 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_5353660301 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_5457826968 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_5492549190 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_5527271412 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_5561993634 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_5596715856 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_5631438079 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_5666160301 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_5700882523 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_5735604745 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_5770326968 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_5805049190 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_5839771412 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_5874493634 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_6048104745 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_6082826968 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_6117549190 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_6152271412 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_6430049190 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_6464771412 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_6499493634 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_6534215856 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_6603660301 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_6638382523 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_6673104745 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_6707826968 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_6777271412 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_6811993634 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_6846715856 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_6881438079 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_6916160301 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_6950882523 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_6985604745 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_7020326968 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_7055050926 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_7089771412 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_7124493634 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_7159215856 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_7193938079 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_7298104745 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_7332826968 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_7367549190 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_7402271412 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_7471715856 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_7506438079 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_7541160301 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_7575882523 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_7645326968 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_7680049190 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_7714771412 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_7749493634 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_7992549190 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_8027271412 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_8061993634 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_8096715856 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_8235604745 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_8270326968 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_8305049190 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_8339771412 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_8513384259 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_8548104745 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_8583036690 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_8617549190 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_8652271412 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_8686993634 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_8721715856 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_8756438079 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_8791160301 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_8825882523 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_8860935648 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_8895912847 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_8930049190 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_8964771412 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_8999493634 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_9034215856 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39930_9068938079 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_3440883449 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_3475605671 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_3510327894 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_3545050116 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_3579772338 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_3614494560 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_3649216782 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_3683939005 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_3718661227 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_3753383449 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_3788109259 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_4378385301 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_4413107523 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_4447829745 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_4482551968 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_4551996412 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_4586718634 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_4621440856 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_4656163079 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_4690885301 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_4725607523 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_4760329745 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_4795051968 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_4829774190 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_4864496412 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_4899218634 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_4933940856 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_4968663079 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_5003385301 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_5038107523 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_5072829745 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_5107551968 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_5142274190 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_5558940856 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_5593663079 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_5628387037 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_5663111111 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_5697835069 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_5906170255 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_5940892477 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_5975614699 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_6010336921 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_6149225810 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_6183948032 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_6218670255 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_6253392477 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_6288114699 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_6322836921 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_6357559144 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_6392281366 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_6947836921 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_6982559144 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_7017283218 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_7052005440 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_7086727662 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_7121449884 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_7746449884 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_7781172106 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_7815894329 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_7850616551 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_7885338773 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_7920060995 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_7954783218 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_8024227662 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_8058949884 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_8232560995 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_8267283218 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_8302005440 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_8336727662 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_8440894329 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_8475616551 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_8510338773 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_8545060995 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_8579783218 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_8614505440 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_8649229398 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_8683951620 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_8753396065 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_8788118287 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_8822840509 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_8857562732 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_8892284954 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_8961729398 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_9028417940 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_9063141898 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_9097864120 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_9132586343 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_9167308565 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_9202030787 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_9236753009 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_9271475232 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_9306197454 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_9340919676 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_9445086343 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_9479808565 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39931_9514530787 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39932_2930087153 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39932_2964809375 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39933_3114892477 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39933_3149616551 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39934_7888407755 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39934_7923119213 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39934_7957841435 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39934_7992563657 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39934_8027287616 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39934_8062011690 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39934_8096733912 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39934_8131456134 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39934_8166178356 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39934_8200900579 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39934_8235622801 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39934_8305067245 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39934_8339789468 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39934_8374511690 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39934_8409233912 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39934_8895345023 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39934_8930067245 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39934_8964789468 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39934_8999511690 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39934_9381456134 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39934_9416178356 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39934_9450900579 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39934_9485622801 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39935_0596733912 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39935_0631456134 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39935_0666178356 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39935_0700900579 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39935_0735622801 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39935_0770345023 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39935_0805067245 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39935_0943956134 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39935_0978678356 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39935_1013400579 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39935_1048122801 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39935_1083027662 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39935_1117567245 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39935_1152289468 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39935_6295247338 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39935_6329969560 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39935_6364691782 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39939_2097495255 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\I39939_2132217477 (Refog.Keylogger) -> Quarantined and deleted successfully.
            C:\Documents and Settings\All Users\Application Data\MPK\1\S0000 (Refog.Keylogger) -> Quarantined and deleted successfully.
            1. nicos03
              Mon pc va beaucoup mieux !!!

              Rien a voir!!!

              Comment te remercier .... tu reponds 5 min apres mes post .. encore mieux qu'un professionnel (payant);)

              Pour info tu fais ca toute la journée ???

              Donc mon pc va mieux mais comment le proteger maintenant ...

              Encore merci
              1. jlpjlp Contributeur sécurité
                ok vire ce qui est en quarantaine dans malwarebyte puis remets un rapport avec . Puis pour dernière vérification colle un scan en ligne de chez panda ou bitdefender ou kaspersky . Comme tu avais un keylogger qui récurrère ce que tu tape sur ton clavier il est préférable de modifier tes codes
                1. nicos03
                  Malwarebytes' Anti-Malware 1.36
                  Version de la base de données: 2132
                  Windows 5.1.2600 Service Pack 3

                  15/05/2009 21:54:56
                  mbam-log-2009-05-15 (21-54-56).txt

                  Type de recherche: Examen rapide
                  Eléments examinés: 86104
                  Temps écoulé: 4 minute(s), 37 second(s)

                  Processus mémoire infecté(s): 0
                  Module(s) mémoire infecté(s): 0
                  Clé(s) du Registre infectée(s): 0
                  Valeur(s) du Registre infectée(s): 0
                  Elément(s) de données du Registre infecté(s): 2
                  Dossier(s) infecté(s): 0
                  Fichier(s) infecté(s): 0

                  Processus mémoire infecté(s):
                  (Aucun élément nuisible détecté)

                  Module(s) mémoire infecté(s):
                  (Aucun élément nuisible détecté)

                  Clé(s) du Registre infectée(s):
                  (Aucun élément nuisible détecté)

                  Valeur(s) du Registre infectée(s):
                  (Aucun élément nuisible détecté)

                  Elément(s) de données du Registre infecté(s):
                  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
                  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

                  Dossier(s) infecté(s):
                  (Aucun élément nuisible détecté)

                  Fichier(s) infecté(s):
                  (Aucun élément nuisible détecté)
                  --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

                  rapport kapersky

                  KASPERSKY ON-LINE SCANNER REPORT
                  Saturday, May 16, 2009 12:20:15 AM
                  Système d'exploitation : Microsoft Windows XP Home Edition, Service Pack 3 (Build 2600)
                  Kaspersky On-line Scanner version : 5.0.84.2
                  Dernière mise à jour de la base antivirus Kaspersky : 15/05/2009
                  Enregistrements dans la base antivirus Kaspersky : 1975811
                  -------------------------------------------------------------------------------

                  Paramètres d'analyse:
                  Analyser avec la base antivirus suivante: standard
                  Analyser les archives: vrai
                  Analyser les bases de messagerie: vrai

                  Cible de l'analyse - Poste de travail:
                  C:\
                  D:\
                  E:\
                  F:\
                  I:\
                  J:\
                  K:\

                  Statistiques de l'analyse:
                  Total d'objets analysés: 63056
                  Nombre de virus trouvés: 20
                  Nombre d'objets infectés: 82 / 0
                  Nombre d'objets suspects: 0
                  Durée de l'analyse: 01:20:45

                  Nom de l'objet infecté / Nom du virus / Dernière action
                  C:\AUTORUN.FCB Infecté : Virus.VBS.Small.a ignoré
                  C:\autorun.reg Infecté : Trojan.WinREG.AutoRun.a ignoré
                  C:\Documents and Settings\All Users\Application Data\Cast New Cake Remote\each option.bk! Infecté : Packed.Win32.PolyCrypt.d ignoré
                  C:\Documents and Settings\All Users\Application Data\Cast New Cake Remote\Open 16.bk! Infecté : Packed.Win32.PolyCrypt.d ignoré
                  C:\Documents and Settings\All Users\Application Data\Cast New Cake Remote\program active.bk! Infecté : Trojan.Win32.Obfuscated.en ignoré
                  C:\Documents and Settings\All Users\Application Data\Cast New Cake Remote\remote mail.bk! Infecté : Packed.Win32.PolyCrypt.d ignoré
                  C:\Documents and Settings\All Users\Application Data\Cast New Cake Remote\Vga 32.exe Infecté : Packed.Win32.PolyCrypt.d ignoré
                  C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\511a0f3f9e960fa97de3d0b74adfc574_9be7f5ca-9b56-4563-ac45-d648659ecf4f L'objet est verrouillé ignoré
                  C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\5a3b8b8198a9e44cb496ff42ccf8d99c_9be7f5ca-9b56-4563-ac45-d648659ecf4f L'objet est verrouillé ignoré
                  C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat L'objet est verrouillé ignoré
                  C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat L'objet est verrouillé ignoré
                  C:\Documents and Settings\All Users\Application Data\Nero\Nero8\Nero BackItUp\Cache\NeroBackItUpScheduler3.log L'objet est verrouillé ignoré
                  C:\Documents and Settings\LocalService\Cookies\index.dat L'objet est verrouillé ignoré
                  C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré
                  C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré
                  C:\Documents and Settings\LocalService\Local Settings\Historique\History.IE5\index.dat L'objet est verrouillé ignoré
                  C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré
                  C:\Documents and Settings\LocalService\NTUSER.DAT L'objet est verrouillé ignoré
                  C:\Documents and Settings\LocalService\ntuser.dat.LOG L'objet est verrouillé ignoré
                  C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré
                  C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré
                  C:\Documents and Settings\NetworkService\NTUSER.DAT L'objet est verrouillé ignoré
                  C:\Documents and Settings\NetworkService\ntuser.dat.LOG L'objet est verrouillé ignoré
                  C:\Documents and Settings\Nico et marion\Bureau\fixperl.exe Infecté : Trojan.Win32.Genome.bag ignoré
                  C:\Documents and Settings\Nico et marion\Cookies\index.dat L'objet est verrouillé ignoré
                  C:\Documents and Settings\Nico et marion\IETldCache\index.dat L'objet est verrouillé ignoré
                  C:\Documents and Settings\Nico et marion\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{269B027B-4184-11DE-B3DB-F18D7ADC350E}.dat L'objet est verrouillé ignoré
                  C:\Documents and Settings\Nico et marion\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{E10D05E6-4186-11DE-B3DB-000A78A07432}.dat L'objet est verrouillé ignoré
                  C:\Documents and Settings\Nico et marion\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré
                  C:\Documents and Settings\Nico et marion\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré
                  C:\Documents and Settings\Nico et marion\Local Settings\Historique\History.IE5\index.dat L'objet est verrouillé ignoré
                  C:\Documents and Settings\Nico et marion\Local Settings\Historique\History.IE5\MSHist012009051520090516\index.dat L'objet est verrouillé ignoré
                  C:\Documents and Settings\Nico et marion\Local Settings\temp\~DF71ED.tmp L'objet est verrouillé ignoré
                  C:\Documents and Settings\Nico et marion\Local Settings\temp\~DFB742.tmp L'objet est verrouillé ignoré
                  C:\Documents and Settings\Nico et marion\Local Settings\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré
                  C:\Documents and Settings\Nico et marion\Local Settings\Temporary Internet Files\Content.IE5\L0S26690\p_840749908=23[11].txt L'objet est verrouillé ignoré
                  C:\Documents and Settings\Nico et marion\ntuser.dat L'objet est verrouillé ignoré
                  C:\Documents and Settings\Nico et marion\ntuser.dat.LOG L'objet est verrouillé ignoré
                  C:\Program Files\FenAffiche\FenUnika.exe Infecté : Trojan.Win32.VB.fhg ignoré
                  C:\Program Files\Nero\Nero8\Nero BackItUp\BIU1.txt L'objet est verrouillé ignoré
                  C:\Qoobox\Quarantine\C\autorun.bat.vir Infecté : Virus.VBS.Small.a ignoré
                  C:\Qoobox\Quarantine\C\autorun.vbs.vir Infecté : Virus.VBS.Small.a ignoré
                  C:\Qoobox\Quarantine\C\copy.exe.vir Infecté : Worm.Win32.Perlovga.a ignoré
                  C:\Qoobox\Quarantine\C\Documents and Settings\Nico et marion\Application Data\Twain\Twain.exe.vir Infecté : Trojan.Win32.Agent.ccwx ignoré
                  C:\Qoobox\Quarantine\C\host.exe.vir Infecté : Trojan-Dropper.Win32.Small.apl ignoré
                  C:\Qoobox\Quarantine\C\WINDOWS\svchost.exe.vir Infecté : Trojan-Dropper.Win32.Small.apl ignoré
                  C:\Qoobox\Quarantine\C\WINDOWS\system32\autorun.reg.vir Infecté : Trojan.WinREG.AutoRun.a ignoré
                  C:\Qoobox\Quarantine\C\WINDOWS\system32\autorun.vbs.vir Infecté : Virus.VBS.Small.a ignoré
                  C:\Qoobox\Quarantine\C\WINDOWS\system32\bhpowj.dll.vir Infecté : Packed.Win32.Krap.q ignoré
                  C:\Qoobox\Quarantine\C\WINDOWS\system32\cbXNdbyA.dll.vir Infecté : Trojan.Win32.Monder.aanc ignoré
                  C:\Qoobox\Quarantine\C\WINDOWS\system32\config\47799240.Evt.vir Infecté : Trojan.Win32.Pakes.miu ignoré
                  C:\Qoobox\Quarantine\C\WINDOWS\system32\cwawcy.dll.vir Infecté : Packed.Win32.Krap.q ignoré
                  C:\Qoobox\Quarantine\C\WINDOWS\system32\dcnlrs.dll.vir Infecté : Packed.Win32.Krap.q ignoré
                  C:\Qoobox\Quarantine\C\WINDOWS\system32\dlkiinwo.dll.vir Infecté : Packed.Win32.Krap.q ignoré
                  C:\Qoobox\Quarantine\C\WINDOWS\system32\fdjxpw.dll.vir Infecté : Packed.Win32.Krap.q ignoré
                  C:\Qoobox\Quarantine\C\WINDOWS\system32\ghkpnidf.dll.vir Infecté : Packed.Win32.Krap.q ignoré
                  C:\Qoobox\Quarantine\C\WINDOWS\system32\hgGyaaYo.dll.vir Infecté : Packed.Win32.Krap.q ignoré
                  C:\Qoobox\Quarantine\C\WINDOWS\system32\icnlaayh.dll.vir Infecté : Packed.Win32.Krap.q ignoré
                  C:\Qoobox\Quarantine\C\WINDOWS\system32\jvfnez.dll.vir Infecté : Packed.Win32.Krap.q ignoré
                  C:\Qoobox\Quarantine\C\WINDOWS\system32\nvctrl.exe.vir Infecté : Trojan-Downloader.Win32.Zlob.ik ignoré
                  C:\Qoobox\Quarantine\C\WINDOWS\system32\pafkdxav.dll.vir Infecté : Packed.Win32.Krap.q ignoré
                  C:\Qoobox\Quarantine\C\WINDOWS\system32\prdygiyf.dll.vir Infecté : Packed.Win32.Krap.q ignoré
                  C:\Qoobox\Quarantine\C\WINDOWS\system32\rwiatooh.dll.vir Infecté : Packed.Win32.Krap.q ignoré
                  C:\Qoobox\Quarantine\C\WINDOWS\system32\temp1.exe.vir Infecté : Worm.Win32.Perlovga.f ignoré
                  C:\Qoobox\Quarantine\C\WINDOWS\system32\temp2.exe.vir Infecté : Backdoor.Win32.Small.lo ignoré
                  C:\Qoobox\Quarantine\C\WINDOWS\system32\UACcpqlaorpiqwmwer.dll.vir Infecté : Packed.Win32.Tdss.f ignoré
                  C:\Qoobox\Quarantine\C\WINDOWS\system32\UACepnfhtglcpotmxs.dll.vir Infecté : Packed.Win32.Tdss.f ignoré
                  C:\Qoobox\Quarantine\C\WINDOWS\system32\UAChowberftyxabcbn.dll.vir Infecté : Trojan.Win32.TDSS.acbv ignoré
                  C:\Qoobox\Quarantine\C\WINDOWS\system32\UACkvterrwxaqbpdpk.dll.vir Infecté : Packed.Win32.Tdss.f ignoré
                  C:\Qoobox\Quarantine\C\WINDOWS\system32\UACpaspbanvacceptx.dll.vir Infecté : Packed.Win32.Tdss.f ignoré
                  C:\Qoobox\Quarantine\C\WINDOWS\system32\UACqmkyxuwkmrdkvoo.dll.vir Infecté : Packed.Win32.Tdss.f ignoré
                  C:\Qoobox\Quarantine\C\WINDOWS\system32\vcilch.dll.vir Infecté : Packed.Win32.Krap.q ignoré
                  C:\Qoobox\Quarantine\C\WINDOWS\system32\vpymfqfk.dll.vir Infecté : Packed.Win32.Krap.q ignoré
                  C:\Qoobox\Quarantine\C\WINDOWS\xcopy.exe.vir Infecté : Worm.Win32.Perlovga.a ignoré
                  C:\System Volume Information\MountPointManagerRemoteDatabase L'objet est verrouillé ignoré
                  C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000002.dll Infecté : Trojan.Win32.TDSS.acbv ignoré
                  C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000003.dll Infecté : Packed.Win32.Tdss.f ignoré
                  C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000004.dll Infecté : Packed.Win32.Tdss.f ignoré
                  C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000005.dll Infecté : Packed.Win32.Tdss.f ignoré
                  C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000006.dll Infecté : Packed.Win32.Tdss.f ignoré
                  C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000007.dll Infecté : Packed.Win32.Tdss.f ignoré
                  C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000024.exe Infecté : Trojan-Dropper.Win32.Small.apl ignoré
                  C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000031.exe Infecté : Trojan-Dropper.Win32.Small.apl ignoré
                  C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000033.reg Infecté : Trojan.WinREG.AutoRun.a ignoré
                  C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000034.vbs Infecté : Virus.VBS.Small.a ignoré
                  C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000038.exe Infecté : Trojan-Downloader.Win32.Zlob.ik ignoré
                  C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000039.exe Infecté : Worm.Win32.Perlovga.f ignoré
                  C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000040.exe Infecté : Backdoor.Win32.Small.lo ignoré
                  C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000042.exe Infecté : Worm.Win32.Perlovga.a ignoré
                  C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000044.exe Infecté : Trojan.Win32.Agent.ccwx ignoré
                  C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000046.bat Infecté : Virus.VBS.Small.a ignoré
                  C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000047.vbs Infecté : Virus.VBS.Small.a ignoré
                  C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000048.exe Infecté : Worm.Win32.Perlovga.a ignoré
                  C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000049.dll Infecté : Packed.Win32.Krap.q ignoré
                  C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000050.dll Infecté : Trojan.Win32.Monder.aanc ignoré
                  C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000051.dll Infecté : Packed.Win32.Krap.q ignoré
                  C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000052.dll Infecté : Packed.Win32.Krap.q ignoré
                  C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000053.dll Infecté : Packed.Win32.Krap.q ignoré
                  C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000054.dll Infecté : Packed.Win32.Krap.q ignoré
                  C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000055.dll Infecté : Packed.Win32.Krap.q ignoré
                  C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000056.dll Infecté : Packed.Win32.Krap.q ignoré
                  C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000058.dll Infecté : Packed.Win32.Krap.q ignoré
                  C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000059.dll Infecté : Packed.Win32.Krap.q ignoré
                  C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000060.dll Infecté : Packed.Win32.Krap.q ignoré
                  C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000061.dll Infecté : Packed.Win32.Krap.q ignoré
                  C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000063.dll Infecté : Packed.Win32.Krap.q ignoré
                  C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000064.dll Infecté : Packed.Win32.Krap.q ignoré
                  C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP0\A0000065.dll Infecté : Packed.Win32.Krap.q ignoré
                  C:\System Volume Information\_restore{2FCDDC6D-7EB1-4998-A715-B6117C690A23}\RP1\change.log L'objet est verrouillé ignoré
                  C:\WINDOWS\Debug\PASSWD.LOG L'objet est verrouillé ignoré
                  C:\WINDOWS\SchedLgU.Txt L'objet est verrouillé ignoré
                  C:\WINDOWS\SoftwareDistribution\ReportingEvents.log L'objet est verrouillé ignoré
                  C:\WINDOWS\Sti_Trace.log L'objet est verrouillé ignoré
                  C:\WINDOWS\system32\1024\ld6138.tmp Infecté : Hoax.Win32.Renos.dv ignoré
                  C:\WINDOWS\system32\1024\ldC4C9.tmp Infecté : Hoax.Win32.Renos.dv ignoré
                  C:\WINDOWS\system32\AUTORUN.FCB Infecté : Virus.VBS.Small.a ignoré
                  C:\WINDOWS\system32\CatRoot2\edb.log L'objet est verrouillé ignoré
                  C:\WINDOWS\system32\CatRoot2\tmp.edb L'objet est verrouillé ignoré
                  C:\WINDOWS\system32\config\AppEvent.Evt L'objet est verrouillé ignoré
                  C:\WINDOWS\system32\config\default L'objet est verrouillé ignoré
                  C:\WINDOWS\system32\config\default.LOG L'objet est verrouillé ignoré
                  C:\WINDOWS\system32\config\Internet.evt L'objet est verrouillé ignoré
                  C:\WINDOWS\system32\config\ODiag.evt L'objet est verrouillé ignoré
                  C:\WINDOWS\system32\config\OSession.evt L'objet est verrouillé ignoré
                  C:\WINDOWS\system32\config\SAM L'objet est verrouillé ignoré
                  C:\WINDOWS\system32\config\SAM.LOG L'objet est verrouillé ignoré
                  C:\WINDOWS\system32\config\SecEvent.Evt L'objet est verrouillé ignoré
                  C:\WINDOWS\system32\config\SECURITY L'objet est verrouillé ignoré
                  C:\WINDOWS\system32\config\SECURITY.LOG L'objet est verrouillé ignoré
                  C:\WINDOWS\system32\config\software L'objet est verrouillé ignoré
                  C:\WINDOWS\system32\config\software.LOG L'objet est verrouillé ignoré
                  C:\WINDOWS\system32\config\SysEvent.Evt L'objet est verrouillé ignoré
                  C:\WINDOWS\system32\config\system L'objet est verrouillé ignoré
                  C:\WINDOWS\system32\config\system.LOG L'objet est verrouillé ignoré
                  C:\WINDOWS\system32\h323log.txt L'objet est verrouillé ignoré
                  C:\WINDOWS\system32\hp1886.tmp Infecté : Trojan-Downloader.Win32.Zlob.ik ignoré
                  C:\WINDOWS\system32\hpC47A.tmp Infecté : Trojan-Downloader.Win32.Zlob.gu ignoré
                  C:\WINDOWS\system32\ldA5E9.tmp Infecté : Trojan-Downloader.Win32.Zlob.in ignoré
                  C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR L'objet est verrouillé ignoré
                  C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP L'objet est verrouillé ignoré
                  C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER L'objet est verrouillé ignoré
                  C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP L'objet est verrouillé ignoré
                  C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP L'objet est verrouillé ignoré
                  C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA L'objet est verrouillé ignoré
                  C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP L'objet est verrouillé ignoré
                  C:\WINDOWS\wiadebug.log L'objet est verrouillé ignoré
                  C:\WINDOWS\wiaservc.log L'objet est verrouillé ignoré
                  C:\WINDOWS\WindowsUpdate.log L'objet est verrouillé ignoré

                  Analyse terminée.
                  1. jlpjlp Contributeur sécurité
                    iok c'est en bonne voie!

                    télécharge OTMoveIt
                    http://oldtimer.geekstogo.com/OTMoveIt3.exe (de Old_Timer) sur ton Bureau.

                    double-clique sur OTMoveIt.exe pour le lancer.
                    copie la liste qui se trouve en citation ci-dessous,
                    et colle-la dans le cadre de gauche de OTMoveIt :Paste instruction for items to be moved.
                    (attention bien mettre :files)

                    :processes
                    explorer.exe
                    :files
                    C:\AUTORUN.FCB
                    C:\autorun.reg
                    C:\Documents and Settings\All Users\Application Data\Cast New Cake Remote\each option.bk!
                    C:\Documents and Settings\All Users\Application Data\Cast New Cake Remote\Open 16.bk!
                    C:\Documents and Settings\All Users\Application Data\Cast New Cake Remote\program active.bk!
                    C:\Documents and Settings\All Users\Application Data\Cast New Cake Remote\remote mail.bk!
                    C:\Documents and Settings\All Users\Application Data\Cast New Cake Remote\Vga 32.exe
                    C:\Documents and Settings\Nico et marion\Bureau\fixperl.exe
                    C:\Program Files\FenAffiche\FenUnika.exe
                    C:\Qoobox\Quarantine
                    C:\WINDOWS\system32\1024\ld6138.tmp
                    C:\WINDOWS\system32\1024\ldC4C9.tmp
                    C:\WINDOWS\system32\AUTORUN.FCB
                    C:\WINDOWS\system32\hp1886.tmp
                    C:\WINDOWS\system32\hpC47A.tmp
                    C:\WINDOWS\system32\ldA5E9.tmp
                    :commands
                    [purity]
                    [emptytemp]
                    [start explorer]

                    clique sur MoveIt! pour lancer la suppression.
                    le résultat apparaitra dans le cadre "Results".
                    clique sur Exit pour fermer.
                    poste le rapport situé dans C:\_OTMoveIt\MovedFiles.

                    il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes.

                    __________________________

                    vire le fichier moved files en allant dans psote de travail puis C puis otmovit

                    _________________________

                    utilise pour supprimer tes traces

                    CCLEANER: (lance un nettoyage et répare 3 fois le registre)
                    -----------------------

                    Désactive ta restauration systeme puis redemarre ton ordi puis réactive là comme ceci:
                    https://www.informatruc.com

                    ______________________

                    Télécharge et install UsbFix de C_XX & Chiquitine29

                    Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) susceptible d'avoir été infectées sans les ouvrir

                    # Double clic sur le raccourci UsbFix présent sur ton bureau .

                    # Choisis l'option 1 ( Recherche )

                    # Laisse travailler l'outil.

                    # Ensuite post le rapport UsbFix.txt qui apparaitra.

                    # Note : Le rapport UsbFix.txt est sauvegardé a la racine du disque. ( C:\UsbFix.txt )

                    ( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

                    # Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
                    Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
                    Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.
                    1. nicos03
                      Désolé pour le retard ; j'étais persuadé de t'avoir répondu ...

                      Du coup j'ai perdu le rapport OTMoveIt en effacant le fichier fichier moved files .... je pensai te l'avoir déjà envoyé ...

                      Voici quand meme le rapport usbfix :

                      ############################## [ UsbFix V3.021 # Scan ]

                      # User : Nico et marion (Administrateurs) # NICOLAS
                      # Update on 16/05/09 by Chiquitine29, C_XX & Chimay8
                      # WebSite : http://pagesperso-orange.fr/NosTools/usbfix.html
                      # Start at: 01:15:23 | 17/05/2009

                      # AMD Sempron(tm) 2600+
                      # Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
                      # Internet Explorer 8.0.6001.18702
                      # Windows Firewall Status : Enabled
                      # AV : McAfee VirusScan [ Enabled | (!) Outdated ]

                      # C:\ # Disque fixe local # 67,25 Go (11,85 Go free) # NTFS
                      # D:\ # Disque CD-ROM
                      # E:\ # Disque amovible
                      # F:\ # Disque amovible
                      # G:\ # Disque fixe local # 111,78 Go (11,7 Go free) [Nicolas] # NTFS
                      # I:\ # Disque amovible
                      # J:\ # Disque CD-ROM
                      # K:\ # Disque amovible

                      ############################## [ Processus actifs ]

                      C:\WINDOWS\System32\smss.exe
                      C:\WINDOWS\system32\csrss.exe
                      C:\WINDOWS\system32\winlogon.exe
                      C:\WINDOWS\system32\services.exe
                      C:\WINDOWS\system32\lsass.exe
                      C:\WINDOWS\system32\svchost.exe
                      C:\WINDOWS\system32\svchost.exe
                      C:\WINDOWS\System32\svchost.exe
                      C:\WINDOWS\system32\svchost.exe
                      C:\WINDOWS\system32\svchost.exe
                      C:\WINDOWS\Explorer.EXE
                      C:\WINDOWS\system32\LEXBCES.EXE
                      C:\WINDOWS\system32\spoolsv.exe
                      C:\WINDOWS\system32\LEXPPS.EXE
                      C:\WINDOWS\system32\svchost.exe
                      C:\WINDOWS\System32\svchost.exe
                      C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
                      C:\WINDOWS\system32\svchost.exe
                      C:\WINDOWS\system32\svchost.exe
                      C:\WINDOWS\System32\alg.exe
                      C:\WINDOWS\system32\qttask.exe
                      C:\WINDOWS\Mixer.exe
                      C:\PROGRA~1\McAfee.com\Agent\McAgent.exe
                      C:\WINDOWS\system32\CAP3RSK.EXE
                      c:\progra~1\mcafee.com\vso\mcvsescn.exe
                      C:\WINDOWS\system32\ctfmon.exe
                      C:\Program Files\Windows Live\Messenger\msnmsgr.exe
                      C:\Program Files\Messenger\msmsgs.exe
                      C:\Program Files\OLITEC\Moniteur WiFi OLITEC\Moniteur WiFi OLITEC.exe
                      C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\CAP3SWK.EXE
                      c:\progra~1\mcafee.com\vso\mcvsftsn.exe
                      C:\WINDOWS\system32\wuauclt.exe
                      C:\Program Files\Internet Explorer\IEXPLORE.EXE
                      C:\Program Files\Internet Explorer\IEXPLORE.EXE
                      C:\Program Files\Internet Explorer\IEXPLORE.EXE
                      C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
                      C:\WINDOWS\system32\wbem\wmiprvse.exe

                      ################## [ Registre # Startup ]

                      HKCU_Main: "Local Page"="C:\\WINDOWS\\system32\\blank.htm"
                      HKCU_Main: "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
                      HKCU_Main: "Start Page"="https://www.google.fr/?gws_rd=ssl"
                      HKLM_logon: "Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
                      HKLM_logon: "DefaultUserName"="Nico et marion"
                      HKLM_logon: "AltDefaultUserName"="Nico et marion"
                      HKLM_logon: "LegalNoticeCaption"=""
                      HKLM_logon: "LegalNoticeText"=""
                      HKLM_Run: QuickTime Task="C:\WINDOWS\system32\qttask.exe" -atboottime
                      HKLM_Run: CAP3ON=C:\WINDOWS\system32\spool\drivers\w32x86\3\CAP3ONN.EXE
                      HKLM_Run: C-Media Mixer=Mixer.exe /startup
                      HKLM_Run: PinnacleDriverCheck=C:\WINDOWS\system32\PSDrvCheck.exe
                      HKLM_Run: MCUpdateExe=C:\PROGRA~1\McAfee.com\Agent\McUpdate.exe
                      HKLM_Run: MCAgentExe=C:\PROGRA~1\McAfee.com\Agent\McAgent.exe
                      HKLM_Run: VirusScan Online="c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
                      HKLM_Run: VSOCheckTask="c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
                      HKCU_Run: ctfmon.exe=C:\WINDOWS\system32\ctfmon.exe
                      HKCU_Run: msnmsgr="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
                      HKCU_Run: MSMSGS="C:\Program Files\Messenger\msmsgs.exe" /background

                      ################## [ Fichiers # Dossiers infectieux ]

                      Found ! G:\autorun.bat
                      Found ! G:\autorun.reg
                      Found ! G:\autorun.vbs
                      Found ! G:\copy.exe
                      Found ! G:\ravmone.exe
                      Found ! G:\autorun.inf
                      Found ! G:\copy.exe
                      Found ! G:\host.exe
                      Found ! G:\msvcr71.dll

                      ################## [ Registre # Clés Run infectieuses ]

                      Found ! HKLM\software\microsoft\security center\\ "AntiVirusDisableNotify"
                      # -> ( Value = 0x1 | Good = 0x0 Bad = 0x1 )
                      Found ! HKLM\software\microsoft\security center\\ "FirewallDisableNotify"
                      # -> ( Value = 0x1 | Good = 0x0 Bad = 0x1 )

                      ################## [ Registre # Mountpoints2 ]

                      HKCU\...\Explorer\MountPoints2\{c033d376-ad05-11db-8940-0011098d624a}\Shell\AutoRun\Command

                      ################## [ ! Fin du rapport # UsbFix V3.021 ! ]

                      Je n'est toujours pas rectivé ma restauration système .
                      1. jlpjlp Contributeur sécurité
                        Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) susceptible d avoir été infectés sans les ouvrir

                        # Double clic sur le raccourci UsbFix présent sur ton bureau

                        # choisis l'option 2 ( Suppression )

                        # Ton bureau disparaitra et le pc redémarrera .

                        # Au redémarrage , UsbFix scannera ton pc , laisse travailler l'outil.

                        # Ensuite post le rapport UsbFix.txt qui apparaitra avec le bureau .

                        # Note : Le rapport UsbFix.txt est sauvegardé a la racine du disque.( C:\UsbFix.txt )

                        ( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )
                        1. nicos03
                          voici le rapport usb fix

                          ############################## [ UsbFix V3.021 # Cleaning ]

                          # User : Nico et marion (Administrateurs) # NICOLAS
                          # Update on 16/05/09 by Chiquitine29, C_XX & Chimay8
                          # WebSite : http://pagesperso-orange.fr/NosTools/usbfix.html
                          # Start at: 13:05:00 | 21/05/2009

                          # AMD Sempron(tm) 2600+
                          # Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
                          # Internet Explorer 8.0.6001.18702
                          # Windows Firewall Status : Enabled
                          # AV : McAfee VirusScan [ Enabled | (!) Outdated ]

                          # C:\ # Disque fixe local # 67,25 Go (14,1 Go free) # NTFS
                          # D:\ # Disque CD-ROM
                          # E:\ # Disque amovible
                          # F:\ # Disque amovible
                          # G:\ # Disque fixe local # 111,78 Go (11,7 Go free) [Nicolas] # NTFS
                          # I:\ # Disque amovible
                          # J:\ # Disque CD-ROM
                          # K:\ # Disque amovible

                          ############################## [ Processus actifs ]

                          C:\WINDOWS\System32\smss.exe
                          C:\WINDOWS\system32\csrss.exe
                          C:\WINDOWS\system32\winlogon.exe
                          C:\WINDOWS\system32\services.exe
                          C:\WINDOWS\system32\lsass.exe
                          C:\WINDOWS\system32\svchost.exe
                          C:\WINDOWS\system32\svchost.exe
                          C:\WINDOWS\System32\svchost.exe
                          C:\WINDOWS\system32\svchost.exe
                          C:\WINDOWS\system32\svchost.exe
                          C:\WINDOWS\system32\WgaTray.exe
                          C:\WINDOWS\Explorer.EXE
                          C:\WINDOWS\system32\LEXBCES.EXE
                          C:\WINDOWS\system32\spoolsv.exe
                          C:\WINDOWS\system32\LEXPPS.EXE
                          C:\WINDOWS\system32\svchost.exe
                          C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                          C:\WINDOWS\System32\svchost.exe
                          C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
                          C:\WINDOWS\system32\svchost.exe
                          C:\WINDOWS\system32\svchost.exe
                          C:\WINDOWS\system32\wbem\wmiprvse.exe
                          C:\WINDOWS\system32\CAP3RSK.EXE
                          C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\CAP3SWK.EXE

                          ################## [ Fichiers # Dossiers infectieux ]

                          Deleted ! G:\autorun.bat
                          Deleted ! G:\autorun.reg
                          Deleted ! G:\autorun.vbs
                          Deleted ! G:\copy.exe
                          Deleted ! G:\ravmone.exe
                          Deleted ! G:\autorun.inf
                          Deleted ! G:\host.exe
                          Deleted ! G:\msvcr71.dll

                          ################## [ Registre # Clés Run infectieuses ]

                          # HKLM\software\microsoft\security center\\ "AntiVirusDisableNotify"
                          # -> ( Value = 0x1 | Good = 0x0 Bad = 0x1 ) # -> Reset sucessfully !
                          # HKLM\software\microsoft\security center\\ "FirewallDisableNotify"
                          # -> ( Value = 0x1 | Good = 0x0 Bad = 0x1 ) # -> Reset sucessfully !

                          ################## [ Registre # Mountpoints2 ]

                          Deleted ! HKCU\...\Explorer\MountPoints2\{c033d376-ad05-11db-8940-0011098d624a}\Shell\AutoRun\Command

                          ################## [ Listing des fichiers présent ]

                          [24/11/2004 18:37|--a------|0] - C:\AUTOEXEC.BAT
                          [30/07/2006 17:20|-rahs----|959] - C:\autorun.bin
                          [14/06/2006 04:26|-rahs----|24] - C:\autorun.txt
                          [06/07/2006 13:58|-rahs----|72] - C:\autorun.wsh
                          [11/05/2009 23:20|--a------|216] - C:\Boot.bak
                          [14/05/2009 21:35|-rahs----|286] - C:\boot.ini
                          [05/08/2004 14:00|-rahs----|4952] - C:\Bootfont.bin
                          [27/07/2008 11:39|--a------|536] - C:\checkrun.txt
                          [03/08/2004 23:00|--a------|263488] - C:\cmldr
                          [14/05/2009 22:00|--a------|21187] - C:\ComboFix.txt
                          [24/11/2004 18:37|--a------|0] - C:\CONFIG.SYS
                          [06/03/2007 16:46|--a------|0] - C:\DBS.TXT
                          [09/06/2008 09:25|--a------|14682] - C:\debug.log
                          [?|?|?] - C:\hiberfil.sys
                          [24/11/2004 18:37|-rahs----|0] - C:\IO.SYS
                          [25/11/2004 16:50|--ah-----|741] - C:\IPH.PH
                          [24/11/2004 18:37|-rahs----|0] - C:\MSDOS.SYS
                          [05/08/2004 14:00|-rahs----|47564] - C:\NTDETECT.COM
                          [21/10/2008 07:21|-rahs----|252240] - C:\ntldr
                          [?|?|?] - C:\pagefile.sys
                          [27/07/2008 12:17|--a------|5632] - C:\PclePctv60ePreview.failed.grf
                          [02/02/2005 18:30|--a------|90] - C:\Setup.log
                          [08/09/2008 18:18|--a------|168] - C:\setupfax.log
                          [18/11/2008 22:23|--ah-----|268] - C:\sqmdata00.sqm
                          [03/12/2008 08:04|--ah-----|268] - C:\sqmdata01.sqm
                          [19/12/2008 14:46|--ah-----|268] - C:\sqmdata02.sqm
                          [17/01/2009 19:04|--ah-----|268] - C:\sqmdata03.sqm
                          [05/05/2009 22:11|--ah-----|268] - C:\sqmdata04.sqm
                          [06/05/2009 13:38|--ah-----|268] - C:\sqmdata05.sqm
                          [21/05/2009 02:10|--ah-----|268] - C:\sqmdata06.sqm
                          [23/08/2008 15:43|--ah-----|268] - C:\sqmdata07.sqm
                          [07/09/2008 02:52|--ah-----|268] - C:\sqmdata08.sqm
                          [17/09/2008 19:03|--ah-----|268] - C:\sqmdata09.sqm
                          [16/10/2008 11:16|--ah-----|268] - C:\sqmdata10.sqm
                          [20/10/2008 15:29|--ah-----|292] - C:\sqmdata11.sqm
                          [20/10/2008 15:37|--ah-----|268] - C:\sqmdata12.sqm
                          [20/10/2008 15:45|--ah-----|280] - C:\sqmdata13.sqm
                          [20/10/2008 16:03|--ah-----|268] - C:\sqmdata14.sqm
                          [20/10/2008 16:19|--ah-----|268] - C:\sqmdata15.sqm
                          [20/10/2008 16:38|--ah-----|268] - C:\sqmdata16.sqm
                          [03/11/2008 19:22|--ah-----|268] - C:\sqmdata17.sqm
                          [03/11/2008 19:32|--ah-----|268] - C:\sqmdata18.sqm
                          [03/11/2008 19:40|--ah-----|268] - C:\sqmdata19.sqm
                          [18/11/2008 22:23|--ah-----|244] - C:\sqmnoopt00.sqm
                          [03/12/2008 08:04|--ah-----|244] - C:\sqmnoopt01.sqm
                          [19/12/2008 14:46|--ah-----|244] - C:\sqmnoopt02.sqm
                          [17/01/2009 19:04|--ah-----|244] - C:\sqmnoopt03.sqm
                          [05/05/2009 22:11|--ah-----|244] - C:\sqmnoopt04.sqm
                          [06/05/2009 13:38|--ah-----|244] - C:\sqmnoopt05.sqm
                          [21/05/2009 02:10|--ah-----|244] - C:\sqmnoopt06.sqm
                          [23/08/2008 15:43|--ah-----|244] - C:\sqmnoopt07.sqm
                          [07/09/2008 02:52|--ah-----|244] - C:\sqmnoopt08.sqm
                          [17/09/2008 19:03|--ah-----|244] - C:\sqmnoopt09.sqm
                          [16/10/2008 11:16|--ah-----|244] - C:\sqmnoopt10.sqm
                          [20/10/2008 15:29|--ah-----|244] - C:\sqmnoopt11.sqm
                          [20/10/2008 15:37|--ah-----|244] - C:\sqmnoopt12.sqm
                          [20/10/2008 15:45|--ah-----|244] - C:\sqmnoopt13.sqm
                          [20/10/2008 16:03|--ah-----|244] - C:\sqmnoopt14.sqm
                          [20/10/2008 16:19|--ah-----|244] - C:\sqmnoopt15.sqm
                          [20/10/2008 16:38|--ah-----|244] - C:\sqmnoopt16.sqm
                          [03/11/2008 19:22|--ah-----|244] - C:\sqmnoopt17.sqm
                          [03/11/2008 19:32|--ah-----|244] - C:\sqmnoopt18.sqm
                          [03/11/2008 19:40|--ah-----|244] - C:\sqmnoopt19.sqm
                          [21/05/2009 13:06|--a------|5807] - C:\UsbFix.txt
                          [13/02/2009 19:23|--a------|3230033] - G:\- Alesha Dixon - The boys does nothing.mp3
                          [13/02/2009 19:05|--a------|3041616] - G:\01-Sherifa Luna- Ce qu'ils aiment.mp3
                          [04/04/2009 06:52|--a------|1467097088] - G:\AUSTRALIA.DVDRIP.FR.VVF.COOLI.[emule-island.com].avi
                          [30/07/2006 17:20|-rahs----|959] - G:\autorun.bin
                          [14/06/2006 11:06|-rahs----|203] - G:\AUTORUN.FCB
                          [14/06/2006 04:26|-rahs----|24] - G:\autorun.txt
                          [06/07/2006 13:58|-rahs----|72] - G:\autorun.wsh
                          [13/02/2009 19:10|--a------|5414799] - G:\Copie de [0] Peps - Liberta.mp3
                          [04/04/2009 17:17|--a------|652908544] - G:\Daryl - Fooler Doolers - vol 4.avi
                          [07/10/2008 17:59|--a------|734021632] - G:\Hancock.FRENCH.DVDRiP.XviD-ULTRASON.caline012.LcKt.[emule-island.com].avi
                          [17/11/2008 19:52|--a------|364407108] - G:\Heroes.3x08.Villains.VOSTFR.HDTV.XviD-GDXFD.[emule-island.com].avi
                          [04/04/2009 02:46|--a------|365227104] - G:\Heroes.S03E20.VOSTFR.HDTV.XviD-Bjork.[emule-island.com].avi
                          [04/04/2009 03:38|--a------|364317126] - G:\Heroes.S03E21.VOSTFR.HDTV.XviD-Bjork.[emule-island.com].avi
                          [15/12/2008 03:17|--a------|735913984] - G:\Les.Rebelles.De.La.Foret.2.TRUEFRENCH.DVDRIP.XVID-SYR.avi
                          [04/04/2009 16:38|--a------|361854112] - G:\Lost.5x11.Whatever.Happened.Happened.VOSTFR.PROPER.HDTV.XviD-AlFleNi-TeaM.[emule-island.com].avi
                          [31/01/2009 23:20|--a------|387262556] - G:\lost.s05e03.vostf.avi
                          [13/02/2009 19:15|--a------|5611648] - G:\Neyo - Miss Independant.mp3
                          [22/01/2009 10:41|--a------|734423040] - G:\Nick.And.Noahs.Infinite.Playlist.FRENCH.DVDRip.XViD-NERD.FUCK.[emule-island.com].avi
                          [04/04/2009 02:45|--a------|692202970] - G:\OUTLANDER.2008.FRENCH.DVDRiP.XViD-OLi82.FUCK.[emule-island.com].avi
                          [15/12/2008 03:52|--a------|733849600] - G:\Sans.Arme.Ni.Haine.Ni.Violence.FRENCH.DVDRiP.XViD-PROD.LcKtM.[emule-island.com].avi
                          [08/10/2008 02:16|--a------|737957888] - G:\Strays.2008.STV.FRENCH.DVDRiP.XViD-iPS.LcKtM.[emule-island.com].avi
                          [04/04/2009 20:02|--a------|733990912] - G:\The.Andromeda.Strain.Part.1.FRENCH.DVDRiP.XviD-BaLLanTeAm.[emule-island.com].avi
                          [04/04/2009 19:52|--a------|734052352] - G:\The.Andromeda.Strain.Part.2.FiNAL.FRENCH.DVDRiP.XviD-BaLLanTeAm.[emule-island.com].avi
                          [01/04/2009 01:35|--a------|718018560] - G:\The.Broken.2008.LiMiTED.FRENCH.DVDRiP.XviD-ULTRASON.FUCK.[emule-island.com].avi
                          [02/03/2009 08:30|--a------|732710912] - G:\The.Day.The.Earth.Stood.Still.2008.FRENCH.DVDRiP.XviD-ULTRASON.FUCK.[emule-island.com].avi
                          [01/04/2009 03:01|--a------|370401214] - G:\The.Legend.of.the.Seeker.1x16.Bloodline.VOstFR.HDTV.XviD-AlFleNi-TeaM-.[emule-island.com].avi
                          [15/02/2009 20:19|--ahs----|17920] - G:\Thumbs.db

                          ################## [ Vaccination ]

                          # C:\autorun.inf ( # Not infected ) -> Folder created by UsbFix.
                          # G:\autorun.inf ( # Not infected ) -> Folder created by UsbFix.

                          ################## [ Cracks / Keygens / Serials ]

                          # -> Nothing found !

                          ################## [ ! Fin du rapport # UsbFix V3.021 ! ]
                          2. nicos03
                            RAPPORT RSIT

                            Logfile of random's system information tool 1.06 (written by random/random)
                            Run by Nico et marion at 2009-05-21 13:56:59
                            Microsoft Windows XP Édition familiale Service Pack 3
                            System drive C: has 16 GB (23%) free of 69 GB
                            Total RAM: 1279 MB (58% free)

                            Logfile of Trend Micro HijackThis v2.0.2
                            Scan saved at 13:57:02, on 21/05/2009
                            Platform: Windows XP SP3 (WinNT 5.01.2600)
                            MSIE: Internet Explorer v8.00 (8.00.6001.18702)
                            Boot mode: Normal

                            Running processes:
                            C:\WINDOWS\System32\smss.exe
                            C:\WINDOWS\system32\winlogon.exe
                            C:\WINDOWS\system32\services.exe
                            C:\WINDOWS\system32\lsass.exe
                            C:\WINDOWS\system32\svchost.exe
                            C:\WINDOWS\System32\svchost.exe
                            C:\WINDOWS\system32\LEXBCES.EXE
                            C:\WINDOWS\system32\spoolsv.exe
                            C:\WINDOWS\system32\LEXPPS.EXE
                            C:\WINDOWS\System32\svchost.exe
                            C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
                            C:\WINDOWS\system32\svchost.exe
                            C:\WINDOWS\system32\svchost.exe
                            C:\WINDOWS\system32\CAP3RSK.EXE
                            C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\CAP3SWK.EXE
                            C:\WINDOWS\explorer.exe
                            C:\Program Files\Internet Explorer\IEXPLORE.EXE
                            C:\WINDOWS\system32\ctfmon.exe
                            C:\Program Files\Internet Explorer\IEXPLORE.EXE
                            C:\Program Files\OLITEC\Moniteur WiFi OLITEC\Moniteur WiFi OLITEC.exe
                            C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
                            C:\Program Files\Internet Explorer\IEXPLORE.EXE
                            C:\Program Files\Windows Live\Messenger\msnmsgr.exe
                            C:\WINDOWS\system32\wuauclt.exe
                            C:\Documents and Settings\Nico et marion\Bureau\RSIT.exe
                            C:\Program Files\trend micro\Nico et marion.exe

                            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
                            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
                            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
                            R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
                            R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.co.uk/0SEENWW/SAOS01?FORM=TOOLBR
                            R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
                            R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                            O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
                            O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
                            O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                            O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                            O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                            O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
                            O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                            O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
                            O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
                            O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                            O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\system32\qttask.exe" -atboottime
                            O4 - HKLM\..\Run: [CAP3ON] C:\WINDOWS\system32\spool\drivers\w32x86\3\CAP3ONN.EXE
                            O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
                            O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe
                            O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\McAfee.com\Agent\McUpdate.exe
                            O4 - HKLM\..\Run: [MCAgentExe] C:\PROGRA~1\McAfee.com\Agent\McAgent.exe
                            O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
                            O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
                            O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                            O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
                            O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
                            O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                            O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                            O4 - Global Startup: Moniteur WiFi OLITEC.exe.lnk = ?
                            O9 - Extra button: Messager Wanadoo - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
                            O9 - Extra 'Tools' menuitem: Messager Wanadoo - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
                            O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                            O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                            O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
                            O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                            O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                            O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                            O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                            O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.orange.fr (file missing) (HKCU)
                            O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
                            O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://webscanner.kaspersky.fr/kavwebscan_unicode.cab
                            O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
                            O16 - DPF: {78ABDC59-D8E7-44D3-9A76-9A0918C52B4A} (DLoader Class) - http://dl.uc.sina.com/cab/downloader.cab
                            O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://jeuxmultijoueurs.orange.fr/Gameshell/GameHost/1.0/OberonGameHost.cab
                            O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
                            O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                            O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
                            O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
                            O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
                            O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
                            1. jlpjlp Contributeur sécurité
                              malwarebyte ?

                              scanne rapide avec
                              MalwareByte's Anti-Malware après mise a jour, en mode normal et vire ce qui est trouvé et colle le rapport

                              https://www.malekal.com/tutoriel-malwarebyte-anti-malware/­­

                              ____________

                              colle le rapport d'un scan en ligne
                              avec un des suivants:

                              bitdefender en ligne :
                              http://www.bitdefender.fr/scan_fr/scan8/ie.html

                              Panda en ligne :
                              http://pandasoftware.fr

                              Kaspersky en ligne
                              https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
                              1. nicos03
                                rapport ot move it

                                ========== PROCESSES ==========
                                Process explorer.exe killed successfully.
                                ========== FILES ==========
                                G:\AUTORUN.FCB moved successfully.
                                ========== COMMANDS ==========
                                User's Temp folder emptied.
                                User's Internet Explorer cache folder emptied.
                                File delete failed. C:\Documents and Settings\Nico et marion\Local Settings\Temporary Internet Files\Content.IE5\YG94I9UH\01[1].htm scheduled to be deleted on reboot.
                                File delete failed. C:\Documents and Settings\Nico et marion\Local Settings\Temporary Internet Files\Content.IE5\YG94I9UH\im[1].htm scheduled to be deleted on reboot.
                                File delete failed. C:\Documents and Settings\Nico et marion\Local Settings\Temporary Internet Files\Content.IE5\VZNJHBIT\default[1].htm scheduled to be deleted on reboot.
                                File delete failed. C:\Documents and Settings\Nico et marion\Local Settings\Temporary Internet Files\Content.IE5\VZNJHBIT\InboxLight[1].htm scheduled to be deleted on reboot.
                                File delete failed. C:\Documents and Settings\Nico et marion\Local Settings\Temporary Internet Files\Content.IE5\VZNJHBIT\ToastFull[1].htm scheduled to be deleted on reboot.
                                File delete failed. C:\Documents and Settings\Nico et marion\Local Settings\Temporary Internet Files\Content.IE5\VZNJHBIT\ToastMini[1].htm scheduled to be deleted on reboot.
                                File delete failed. C:\Documents and Settings\Nico et marion\Local Settings\Temporary Internet Files\Content.IE5\B0KIQQNM\2G30WCA667S39CAWS2HPKCA5Q991TCAF88PBPCAAEOQZJCA4WOEZQCAPGRIPTCAXX1SR3CASKPYMUCADD5FBDCAATATQ9CAY7VMD1CABK6PDICAEIOVGNCAPDPFBZCA23BKH0CAMJFDJQCAHI8F66.htm scheduled to be deleted on reboot.
                                File delete failed. C:\Documents and Settings\Nico et marion\Local Settings\Temporary Internet Files\Content.IE5\B0KIQQNM\google_fr[1].htm scheduled to be deleted on reboot.
                                File delete failed. C:\Documents and Settings\Nico et marion\Local Settings\Temporary Internet Files\Content.IE5\5B9HETOA\forum-7-virus-securite[1].htm scheduled to be deleted on reboot.
                                File delete failed. C:\Documents and Settings\Nico et marion\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
                                User's Temporary Internet Files folder emptied.
                                Local Service Temp folder emptied.
                                File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
                                Local Service Temporary Internet Files folder emptied.
                                Network Service Temp folder emptied.
                                Network Service Temporary Internet Files folder emptied.
                                Windows Temp folder emptied.
                                Java cache emptied.
                                Temp folders emptied.
                                Explorer started successfully

                                OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 05212009_185429
                            2. nicos03
                              rapport MalwareByte's Anti-Malware :
                              Malwarebytes' Anti-Malware 1.36
                              Version de la base de données: 2132
                              Windows 5.1.2600 Service Pack 3

                              21/05/2009 14:55:54
                              mbam-log-2009-05-21 (14-55-54).txt

                              Type de recherche: Examen rapide
                              Eléments examinés: 85004
                              Temps écoulé: 6 minute(s), 18 second(s)

                              Processus mémoire infecté(s): 0
                              Module(s) mémoire infecté(s): 0
                              Clé(s) du Registre infectée(s): 0
                              Valeur(s) du Registre infectée(s): 0
                              Elément(s) de données du Registre infecté(s): 0
                              Dossier(s) infecté(s): 0
                              Fichier(s) infecté(s): 0

                              Processus mémoire infecté(s):
                              (Aucun élément nuisible détecté)

                              Module(s) mémoire infecté(s):
                              (Aucun élément nuisible détecté)

                              Clé(s) du Registre infectée(s):
                              (Aucun élément nuisible détecté)

                              Valeur(s) du Registre infectée(s):
                              (Aucun élément nuisible détecté)

                              Elément(s) de données du Registre infecté(s):
                              (Aucun élément nuisible détecté)

                              Dossier(s) infecté(s):
                              (Aucun élément nuisible détecté)

                              Fichier(s) infecté(s):
                              (Aucun élément nuisible détecté)
                              • 1
                              • 2