Probleme de virus Win32 !!

Résolu
Alice -  
Bonjour.... Depuis ce matin, lorsque j'allume mon ordi, j'ai une énorme fenêtre "YOUR SYSTEM IS INFECTED" qui apparait...
J'ai fais un scan avast qui m'a trouvé tout plein de virus de type "Win32 malware gen"
Avast les a mis en quarantaine, mais des que je refais un scan, ils sont de nouveaux là...
J'ai vu quelque part qu'il fallait télécharger Hijackthis, je l'ai fais, j'ai fais un scan, j'ai le rapport, mais je n'y comprends vraiment rien.... Si quelqu'un peut m'aider, je lui en serait TRÈS TRÈS TRÈS reconnaissante...

39 réponses

  • Votes
  • Date
  • Date décroissante
Résumé de la discussion

Une alerte YOUR SYSTEM IS INFECTED s'affiche au démarrage et Avast détecte des Win32 malware gen qui réapparaissent après chaque balayage, et l'utilisateur ne comprend pas le rapport HijackThis. Plusieurs conseils visent à éliminer les barres d'outils malveillantes et à prévenir leur réinstallation, notamment désinstaller les toolbars indésirables, puis utiliser Ad-Remover sur le bureau et suivre le nettoyage jusqu'au rapport. En parallèle, l'échange évoque Kill'em pour produire des rapports et suggère des mesures de maintenance comme Malwarebytes, mises à jour système et logiciels, sauvegardes externes, et prudence avec les téléchargements et le P2P. Des recommandations complémentaires insistent enfin sur l'usage d'extensions de sécurité et sur le changement des mots de passe, tout en rappelant d'éviter EoRezo et les téléchargements suspects.

Bobot (l’IA à votre service)
  2. Alice
    Voilà le rapport

    Logfile of Trend Micro HijackThis v2.0.4
    Scan saved at 22:51:06, on 02/05/2010
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
    C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\WINDOWS\arservice.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\system32\drivers\CDAC11BA.EXE
    C:\WINDOWS\ehome\ehtray.exe
    C:\WINDOWS\ARPWRMSG.EXE
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\windows\system\hpsysdrv.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
    C:\HP\KBD\KBD.EXE
    C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
    C:\Program Files\QuickTime\QTTask.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
    C:\WINDOWS\vsnpstd2.exe
    C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\LimeWire\LimeWire.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Canon\CAL\CALMAIN.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\WINDOWS\eHome\ehmsas.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\Lavasoft\Ad-Aware\Ad-Aware.exe
    C:\Program Files\Java\jre6\bin\jucheck.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
    C:\Program Files\Firefox\firefox.exe
    C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe
    C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ustart.org
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ustart.org
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\winlogon32.exe
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
    O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O3 - Toolbar: LimeWire Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
    O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
    O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode
    O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
    O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
    O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
    O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
    O4 - HKLM\..\Run: [SNPSTD2] C:\WINDOWS\vsnpstd2.exe
    O4 - HKLM\..\Run: [Regedit32] C:\WINDOWS\system32\regedit.exe
    O4 - HKLM\..\Run: [syncman] c:\windows\system32\wuaucldt.exe
    O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus1.exe" /WinStart
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [syncman] c:\documents and settings\hp_administrateur\wuaucldt.exe
    O4 - HKCU\..\Run: [smss32.exe] C:\WINDOWS\system32\smss32.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
    O4 - S-1-5-18 Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'SYSTEM')
    O4 - .DEFAULT Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
    O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
    O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
    O4 - Global Startup: Barre d'état système d'ATI CATALYST.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
    O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O15 - Trusted Zone: http://*.buy-security-essentials.com
    O15 - Trusted Zone: http://*.download-soft-package.com
    O15 - Trusted Zone: http://*.download-software-package.com
    O15 - Trusted Zone: http://*.get-key-se10.com
    O15 - Trusted Zone: http://*.is-software-download.com
    O15 - Trusted Zone: http://*.buy-security-essentials.com (HKLM)
    O15 - Trusted Zone: http://*.get-key-se10.com (HKLM)
    O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
    O18 - Protocol: bw+0 - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw+0s - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw-0 - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw-0s - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw00 - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw00s - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw10 - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw10s - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw20 - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw20s - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw30 - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw30s - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw40 - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw40s - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw50 - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw50s - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw60 - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw60s - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw70 - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw70s - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw80 - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw80s - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw90 - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw90s - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwa0 - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwa0s - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwb0 - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwb0s - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwc0 - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwc0s - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwd0 - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwd0s - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwe0 - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwe0s - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwf0 - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwf0s - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    O18 - Protocol: bwg0 - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwg0s - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwh0 - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwh0s - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwi0 - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwi0s - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwj0 - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwj0s - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwk0 - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwk0s - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwl0 - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwl0s - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwm0 - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwm0s - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwn0 - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwn0s - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwo0 - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwo0s - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwp0 - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwp0s - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwq0 - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwq0s - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwr0 - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwr0s - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bws0 - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bws0s - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwt0 - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwt0s - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwu0 - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwu0s - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwv0 - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwv0s - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bww0 - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bww0s - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwx0 - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwx0s - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwy0 - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwy0s - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwz0 - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwz0s - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: offline-8876480 - {2F6CF6BA-808C-44B3-BE2C-9DB7239912C8} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
    O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
    O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: C-DillaCdaC11BA - C-Dilla Ltd - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
    O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
    O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
    O23 - Service: Service de planification Media Center (ehSched) - Unknown owner - C:\WINDOWS\eHome\ehSched.exe
    O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
    O23 - Service: Fax - Unknown owner - C:\WINDOWS\system32\fxssvc.exe
    O23 - Service: Service Google Update (gupdate) (gupdate) - Unknown owner - C:\Program Files\Google\Update\GoogleUpdate.exe
    O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe
    O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
    O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe
    O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
    O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
    O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
    O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
    O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
    O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe
    1. Utilisateur anonyme
      Télécharge malwarebytes' anti-malware
      https://www.commentcamarche.net/telecharger/securite/14361-malwarebytes-anti-malware/
      Enregistre le sur le bureau
      Double-clique sur l'icône Download_mbam-setup.exe pour lancer le processus d'installation
      Si la pare-feu demande l'autorisation de se connecter pour malwarebytes, accepte
      Il va se mettre à jour une fois faite
      Va dans l'onglet recherche
      Sélectionne exécuter un examen complet
      Clique sur rechercher
      Le scan démarre
      A la fin de l'analyse, le message s'affiche: L'examen s'est terminé normalement.
      Clique sur afficher les résultats pour afficher les objets trouvés
      Clique sur OK pour pousuivre
      Si des malwares ont été détectés, cliquer sur afficher les résultats
      Sélectionne tout (ou laisser coché)
      Clique sur supprimer la sélection
      Malwarebytes va détruire les fichiers et les clés de registre et en mettre une
      copie dans la quarantaine
      Malewarebytes va ouvrir le bloc-note et y copier le rapport
      Redémarre le PC
      Une fois redémarré, double-clique sur Malewarebytes
      Va dans l'onglet rapport/log
      Clique dessus pour l'afficher une fois affiché, cliquer sur édition en haut du
      bloc-note puis sur sélectionner tout
      Revient sur édition, puis sur copier et revient sur le forum et dans ta réponse
      Clic droit dans le cadre de la réponse et coller
      1. Alice
        Voilà, j'ai fais tout ce que tu m'a dis, désolé ca a pris beaucoup de temps...

        et voici le rapport malwarebytes:

        Malwarebytes' Anti-Malware 1.46
        www.malwarebytes.org

        Version de la base de données: 4060

        Windows 5.1.2600 Service Pack 3
        Internet Explorer 6.0.2900.5512

        03/05/2010 01:29:01
        mbam-log-2010-05-03 (01-29-01).txt

        Type d'examen: Examen complet (C:\|D:\|)
        Elément(s) analysé(s): 251055
        Temps écoulé: 1 heure(s), 33 minute(s), 12 seconde(s)

        Processus mémoire infecté(s): 0
        Module(s) mémoire infecté(s): 0
        Clé(s) du Registre infectée(s): 0
        Valeur(s) du Registre infectée(s): 4
        Elément(s) de données du Registre infecté(s): 9
        Dossier(s) infecté(s): 0
        Fichier(s) infecté(s): 14

        Processus mémoire infecté(s):
        (Aucun élément nuisible détecté)

        Module(s) mémoire infecté(s):
        (Aucun élément nuisible détecté)

        Clé(s) du Registre infectée(s):
        (Aucun élément nuisible détecté)

        Valeur(s) du Registre infectée(s):
        HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss32.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\regedit32 (Trojan.Agent) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\syncman (Trojan.Agent) -> Quarantined and deleted successfully.
        HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\syncman (Trojan.Agent) -> Quarantined and deleted successfully.

        Elément(s) de données du Registre infecté(s):
        HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\get-key-se10.com\http (Hijack.TrustedZone) -> Bad: (2) Good: (4) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\buy-security-essentials.com\http (Hijack.TrustedZone) -> Bad: (2) Good: (4) -> Quarantined and deleted successfully.
        HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\buy-security-essentials.com\http (Hijack.TrustedZone) -> Bad: (2) Good: (4) -> Quarantined and deleted successfully.
        HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\get-key-se10.com\http (Hijack.TrustedZone) -> Bad: (2) Good: (4) -> Quarantined and deleted successfully.
        HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoChangingWallpaper (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
        HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\activedesktop\NoChangingWallpaper (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
        HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

        Dossier(s) infecté(s):
        (Aucun élément nuisible détecté)

        Fichier(s) infecté(s):
        C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP399\A0052014.exe (Worm.Koobface) -> Quarantined and deleted successfully.
        C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP399\A0052015.exe (Worm.Koobface) -> Quarantined and deleted successfully.
        C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP399\A0052016.exe (Worm.Koobface) -> Quarantined and deleted successfully.
        C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP505\A0069617.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
        C:\WINDOWS\system32\41.exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
        C:\WINDOWS\system32\ES15.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
        C:\WINDOWS\system32\drivers\gfvzsv.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
        C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\4UJFAWQ5\firewall[1].dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
        C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\RRRP1AGV\SetupSE2010[1].exe (Trojan.Downloader) -> Quarantined and deleted successfully.
        C:\WINDOWS\Temp\CA.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.
        C:\WINDOWS\system32\warnings.html (Malware.Trace) -> Quarantined and deleted successfully.
        C:\Documents and Settings\LocalService\oashdihasidhasuidhiasdhiashdiuasdhasd (Malware.Trace) -> Quarantined and deleted successfully.
        C:\WINDOWS\system32\config\systemprofile\oashdihasidhasuidhiasdhiashdiuasdhasd (Malware.Trace) -> Quarantined and deleted successfully.
        C:\Documents and Settings\HP_Administrateur\Application Data\avdrn.dat (Malware.Trace) -> Quarantined and deleted successfully.
        2. Alice
          Bonjour;

          As tu compris le rapport ? ce matin, j'ai refais un scan avast, et 5 menaces ont été trouvées ... toujours win32, malwares et rootkits... J'attends ta reponse, hier c'était très clair, je t'en en remercie.
          1. Utilisateur anonyme
            Bonjour
            C:\WINDOWS\Temp\CA.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.
            Tu as un rootkit TDSS, qu'il va falloir éradiquer

            Attention, cet outil n'est pas à utiliser à la légère, et doit
            être recommandé que par une personne formée à cet outil
            Imprime la procédure

            Télécharge ComboFix de sUBs sur ton Bureau :
            http://download.bleepingcomputer.com/sUBs/ComboFix.exe

            tutoriel pour bien utiliser l'outil
            http://www.bleepingcomputer.com/combofix/fr/comment-utiliser­-combofix

            /!\ Déconnecte-toi du net et DESACTIVE TOUTES LES DEFENSES, antivirus et antispyware y compris /!\
            ---> Double-clique sur ComboFix.exe
            Un "pop-up" va apparaître qui dit que ComboFix est utilisé à vos risques et avec aucune garantie... Clique sur oui pour accepter
            Surtout, accepte d'installer la console de récupération
            ---> Mets-le en langue française F
            Tape sur la touche 1 (Yes) pour démarrer le scan.

            Ne touche à rien(souris, clavier) tant que le scan n'est pas terminé, car tu risques de figer ton PC

            En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.

            Une fois le scan achevé, un rapport va s'afficher : Poste son contenu

            /!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\

            Note : Le rapport se trouve également là : C:\ComboFix.txt
            1. Alice
              Alors, tout ne s'est pas déroulé comme tu m'avais indiqué... dés que j'ai telechargé combofix, il s'est installé et s'est "emballé" tout seul, je n'ai cliqué sur rien, il a redemarré plusieurs fois, il n'y a pas eu le message pour la console de recuperation... Bref, il a tout de meme effectué un "autoscan" et voici le rapport:

              ComboFix 10-05-02.03 - HP_Administrateur 03/05/2010 15:51:33.1.2 - x86
              Lancé depuis: c:\documents and settings\HP_Administrateur\Mes documents\Téléchargements\ComboFix.exe
              AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
              .

              (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
              .

              c:\docume~1\HP_ADM~1\LOCALS~1\Temp\IadHide5.dll
              c:\docume~1\HP_ADM~1\LOCALS~1\Temp\jna8309575987874914522.tmp
              c:\documents and settings\HP_Administrateur\Local Settings\Temp\IadHide5.dll
              c:\documents and settings\HP_Administrateur\Local Settings\Temp\jna8309575987874914522.tmp
              c:\program files\WindowsUpdate
              c:\windows\system32\fjhdyfhsn.bat
              D:\Autorun.inf

              Une copie infectée de c:\windows\system32\drivers\afd.sys a été trouvée et désinfectée
              Copie restaurée à partir de - Kitty had a snack :p
              c:\windows\system32\drivers\cdrom.sys était absent
              Copie restaurée à partir de - c:\windows\ServicePackFiles\i386\cdrom.sys

              .
              ((((((((((((((((((((((((((((( Fichiers créés du 2010-04-03 au 2010-05-03 ))))))))))))))))))))))))))))))))))))
              .

              2010-05-03 14:04 . 2008-04-13 18:40 62976 ----a-w- c:\windows\system32\drivers\cdrom.sys
              2010-05-02 21:28 . 2010-05-02 21:28 -------- d-----w- c:\documents and settings\HP_Administrateur\Application Data\Malwarebytes
              2010-05-02 21:27 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
              2010-05-02 21:26 . 2010-05-02 21:26 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
              2010-05-02 21:26 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
              2010-05-02 21:26 . 2010-05-02 21:27 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
              2010-05-02 20:21 . 2010-05-02 20:21 -------- d-----w- c:\program files\Trend Micro
              2010-05-02 09:55 . 2008-04-13 16:39 142592 ----a-w- c:\windows\system32\drivers\aec.sys
              2010-05-02 09:55 . 2008-04-13 16:39 142592 ----a-w- c:\windows\system32\dllcache\aec.sys
              2010-05-01 21:32 . 2010-05-01 10:12 15880 ----a-w- c:\windows\system32\lsdelete.exe
              2010-05-01 10:39 . 2010-05-01 10:39 -------- d-----w- c:\documents and settings\LocalService\Bureau
              2010-05-01 10:13 . 2010-02-05 09:03 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys
              2010-05-01 10:13 . 2010-05-01 10:13 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
              2010-05-01 10:09 . 2010-05-01 10:10 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{52AC600B-5800-407E-99FF-83CD0669760B}
              2010-05-01 10:09 . 2010-05-01 10:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
              2010-05-01 10:04 . 2010-05-01 10:04 -------- d-s---w- c:\documents and settings\NetworkService\UserData
              2010-04-28 04:18 . 2010-02-12 10:03 293376 ------w- c:\windows\system32\browserchoice.exe
              2010-04-25 15:33 . 2010-04-25 15:53 128347 ----a-w- c:\windows\hpoins11.dat
              2010-04-25 15:26 . 2006-04-13 00:02 659456 ----a-w- c:\windows\system32\hpowiax2.dll
              2010-04-25 15:26 . 2006-04-13 00:02 827392 ----a-w- c:\windows\system32\hpotiop2.dll
              2010-04-25 15:26 . 2006-04-13 00:02 254026 ----a-w- c:\windows\system32\hpovst09.dll
              2010-04-25 15:25 . 2006-05-05 23:17 11634 ----a-w- c:\windows\hpomdl11.dat
              2010-04-21 05:10 . 2009-08-13 15:20 512000 ------w- c:\windows\system32\dllcache\jscript.dll
              2010-04-20 13:35 . 2010-04-20 13:35 -------- d-----w- c:\windows\system32\fr-fr
              2010-04-20 13:35 . 2010-04-20 13:35 -------- d-----w- c:\windows\l2schemas
              2010-04-20 13:35 . 2010-04-20 13:35 -------- d-----w- c:\windows\system32\fr
              2010-04-20 13:35 . 2010-04-20 13:35 -------- d-----w- c:\windows\system32\bits
              2010-04-20 13:05 . 2010-04-20 13:05 -------- d-----w- c:\windows\system32\FRA
              2010-04-20 13:05 . 2006-03-09 06:57 122880 ----a-w- c:\windows\system32\Imsmudlg.exe
              2010-04-20 12:59 . 2010-04-20 13:07 -------- d-----w- c:\documents and settings\HP_Administrateur\Application Data\U3
              2010-04-09 15:54 . 2010-04-09 15:55 -------- d-----w- c:\program files\Windows Live Safety Center

              .
              (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
              .
              2010-05-03 14:10 . 2010-02-19 20:27 -------- d-----w- c:\documents and settings\HP_Administrateur\Application Data\LimeWire
              2010-05-02 11:04 . 2010-05-02 11:04 0 ----a-w- c:\windows\system32\drivers\aec.sys.bak
              2010-05-01 22:03 . 2010-05-01 22:03 16 ----a-w- c:\documents and settings\LocalService\Application Data\wzmjhy.dat
              2010-05-01 10:10 . 2006-04-01 16:00 -------- d-----w- c:\program files\Lavasoft
              2010-04-30 22:10 . 2010-04-30 22:10 16 ----a-w- c:\windows\system32\config\systemprofile\Application Data\wzmjhy.dat
              2010-04-29 11:45 . 2010-02-19 20:46 -------- d-----w- c:\documents and settings\HP_Administrateur\Application Data\Intelli-studio
              2010-04-25 15:45 . 2005-01-02 04:46 -------- d-----w- c:\program files\Fichiers communs\HP
              2010-04-25 15:45 . 2005-01-02 04:45 -------- d-----w- c:\program files\HP
              2010-04-25 15:41 . 2005-01-02 04:56 -------- d-----w- c:\program files\Hewlett-Packard
              2010-04-20 15:01 . 2006-04-01 17:45 79208 ----a-w- c:\documents and settings\HP_Administrateur\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
              2010-04-20 14:03 . 2005-10-10 19:39 64484 ----a-w- c:\windows\system32\perfc00C.dat
              2010-04-20 14:03 . 2005-10-10 19:39 446566 ----a-w- c:\windows\system32\perfh00C.dat
              2010-04-20 13:22 . 2005-01-02 04:46 -------- d-----w- c:\program files\Fichiers communs\Sonic Shared
              2010-04-14 16:47 . 2010-02-19 09:30 38848 ----a-w- c:\windows\system32\avastSS.scr
              2010-04-14 16:47 . 2010-02-19 09:30 153184 ----a-w- c:\windows\system32\aswBoot.exe
              2010-04-14 16:35 . 2010-02-19 09:30 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
              2010-04-14 16:35 . 2010-02-19 09:30 162768 ----a-w- c:\windows\system32\drivers\aswSP.sys
              2010-04-14 16:31 . 2010-02-19 09:30 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
              2010-04-14 16:31 . 2010-02-19 09:30 100432 ----a-w- c:\windows\system32\drivers\aswmon2.sys
              2010-04-14 16:31 . 2010-02-19 09:30 94800 ----a-w- c:\windows\system32\drivers\aswmon.sys
              2010-04-14 16:31 . 2010-02-19 09:30 19024 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
              2010-04-14 16:30 . 2010-02-19 09:30 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
              2010-04-14 14:30 . 2005-01-02 05:08 -------- d-----w- c:\program files\Google
              2010-04-02 11:18 . 2006-04-01 15:34 -------- d-----w- c:\program files\Firefox
              2010-03-09 11:10 . 2004-08-10 19:00 430080 ----a-w- c:\windows\system32\vbscript.dll
              2010-02-26 05:42 . 2004-08-10 19:00 671232 ----a-w- c:\windows\system32\wininet.dll
              2010-02-26 05:42 . 2004-08-10 19:00 81920 ----a-w- c:\windows\system32\ieencode.dll
              2010-02-24 13:11 . 2004-08-10 19:00 455680 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
              2010-02-19 20:24 . 2010-02-19 20:24 411368 ----a-w- c:\windows\system32\deploytk.dll
              2010-02-16 19:06 . 2004-08-10 19:00 2148352 ----a-w- c:\windows\system32\ntoskrnl.exe
              2010-02-16 19:06 . 2004-08-10 19:00 2026496 ----a-w- c:\windows\system32\ntkrnlpa.exe
              2010-02-12 04:34 . 2004-08-10 19:00 100864 ----a-w- c:\windows\system32\6to4svc.dll
              2010-02-11 12:02 . 2004-08-10 19:00 226880 ----a-w- c:\windows\system32\drivers\tcpip6.sys
              .

              ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
              .
              .
              *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
              REGEDIT4

              [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
              2010-02-04 15:50 1197448 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll

              [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
              "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-02-04 1197448]

              [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
              [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
              [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
              [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

              [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
              "LDM"="c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2006-05-19 36864]
              "MessengerPlus3"="c:\program files\MessengerPlus! 3\MsgPlus1.exe" [2006-04-22 190024]
              "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]

              [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
              "ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
              "ftutil2"="ftutil2.dll" [2004-06-07 106496]
              "AlwaysReady Power Message APP"="ARPWRMSG.EXE" [2005-08-03 77312]
              "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2010-02-19 149280]
              "hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
              "RTHDCPL"="RTHDCPL.EXE" [2005-10-15 14864384]
              "IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2006-02-21 143360]
              "ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2005-10-02 57344]
              "Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2005-07-22 237568]
              "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152]
              "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
              "Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe" [2005-06-23 57344]
              "KBD"="c:\hp\KBD\KBD.EXE" [2005-02-02 61440]
              "TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2005-01-02 180269]
              "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792]
              "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-01-22 141608]
              "avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-04-14 2790472]
              "SNPSTD2"="c:\windows\vsnpstd2.exe" [2004-08-30 286720]

              c:\documents and settings\Default User\Menu D'marrer\Programmes\D'marrage\
              Pin.lnk - c:\hp\bin\CLOAKER.EXE [2005-1-2 27136]

              c:\documents and settings\Default User\Menu D'marrer\Programmes\D'marrage\
              Pin.lnk - c:\hp\bin\CLOAKER.EXE [2005-1-2 27136]

              c:\documents and settings\HP_Administrateur\Menu D'marrer\Programmes\D'marrage\
              LimeWire On Startup.lnk - c:\program files\LimeWire\LimeWire.exe [2010-2-12 503808]

              c:\documents and settings\All Users\Menu D'marrer\Programmes\D'marrage\
              Barre d''tat systSme d'ATI CATALYST.lnk - c:\program files\ATI Technologies\ATI.ACE\CLI.exe [2005-10-2 57344]
              HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]
              Lancement rapide d'Adobe Reader.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-24 29696]
              Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2006-5-19 196608]

              c:\documents and settings\Default User\Menu D'marrer\Programmes\D'marrage\
              Pin.lnk - c:\hp\bin\CLOAKER.EXE [2005-1-2 27136]

              [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
              @="Service"

              [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
              "%windir%\\system32\\sessmgr.exe"=
              "c:\\Program Files\\Messenger\\msmsgs.exe"=
              "c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
              "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
              "c:\\Program Files\\iTunes\\iTunes.exe"=
              "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
              "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
              "c:\\Program Files\\LimeWire\\LimeWire.exe"=
              "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
              "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
              "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
              "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
              "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
              "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
              "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
              "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
              "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
              "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
              "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
              "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
              "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
              "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
              "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=

              R0 d347bus;d347bus;c:\windows\system32\drivers\d347bus.sys [27/07/2006 19:16 155136]
              R0 d347prt;d347prt;c:\windows\system32\drivers\d347prt.sys [27/07/2006 19:16 5248]
              R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [01/05/2010 12:13 64288]
              R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [19/02/2010 11:30 162768]
              R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [19/02/2010 11:30 19024]
              R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [05/02/2010 11:03 1285864]
              R3 3xHybrid;3xHybrid service;c:\windows\system32\drivers\3xHybrid.sys [02/01/2005 06:41 2799488]
              R3 WN5301;LIteon Wireless PCI Network Adapter Service;c:\windows\system32\drivers\wn5301.sys [02/01/2005 06:40 468768]
              S2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [24/02/2010 19:12 135664]
              S3 WN5401;Liteon Wireless LAN PCI 802.11 a/b/g adapter WN5401A;c:\windows\system32\drivers\wn5401.sys [02/01/2005 06:40 449920]
              S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [12/02/2007 17:21 682232]
              .
              Contenu du dossier 'Tâches planifiées'

              2010-05-03 c:\windows\Tasks\Ad-Aware Update (Weekly).job
              - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-02-05 10:12]

              2010-04-29 c:\windows\Tasks\AppleSoftwareUpdate.job
              - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

              2010-05-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
              - c:\program files\Google\Update\GoogleUpdate.exe [2010-02-24 17:12]

              2010-05-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
              - c:\program files\Google\Update\GoogleUpdate.exe [2010-02-24 17:12]

              2010-05-03 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
              - c:\program files\Ask.com\UpdateTask.exe [2010-02-04 15:50]

              2010-05-02 c:\windows\Tasks\WebReg psc C3100 series.job
              - c:\program files\HP\Digital Imaging\bin\hpqwrg.exe [2006-02-19 03:09]
              .
              .
              ------- Examen supplémentaire -------
              .
              uStart Page = hxxp://www.ustart.org
              mStart Page = hxxp://www.ustart.org
              uInternet Settings,ProxyOverride = *.local
              uSearchAssistant = hxxp://www.google.com/ie
              uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
              IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
              Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
              FF - ProfilePath - c:\documents and settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\akl7iuwj.default\
              FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
              FF - prefs.js: browser.search.selectedEngine - Google
              FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr
              FF - plugin: c:\program files\Firefox\plugins\np-mswmp.dll
              FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
              FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
              FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll

              ---- PARAMETRES FIREFOX ----
              c:\program files\Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
              c:\program files\Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
              c:\program files\Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
              c:\program files\Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
              c:\program files\Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
              c:\program files\Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
              c:\program files\Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
              c:\program files\Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
              c:\program files\Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
              c:\program files\Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
              c:\program files\Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
              c:\program files\Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
              c:\program files\Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
              c:\program files\Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
              c:\program files\Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
              c:\program files\Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
              c:\program files\Firefox\greprefs\all.js - pref("html5.enable", false);
              c:\program files\Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
              c:\program files\Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
              c:\program files\Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
              c:\program files\Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
              c:\program files\Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
              c:\program files\Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "https://www.mozilla.org/en-US/firefox/new/?redirect_source=firefox-com");
              c:\program files\Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
              c:\program files\Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
              c:\program files\Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
              c:\program files\Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
              c:\program files\Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
              c:\program files\Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
              c:\program files\Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
              c:\program files\Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
              c:\program files\Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
              c:\program files\Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
              c:\program files\Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
              c:\program files\Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
              c:\program files\Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
              .
              - - - - ORPHELINS SUPPRIMES - - - -

              HKLM-Run-Logitech Hardware Abstraction Layer - KHALMNPR.EXE
              AddRemove-Works2005Setup - c:\program files\Microsoft Works Suite 2005\Setup\Launcher.exe

              **************************************************************************

              catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
              Rootkit scan 2010-05-03 16:10
              Windows 5.1.2600 Service Pack 3 NTFS

              Recherche de processus cachés ...

              Recherche d'éléments en démarrage automatique cachés ...

              Recherche de fichiers cachés ...

              c:\docume~1\HP_ADM~1\LOCALS~1\Temp\DIOB.tmp

              Scan terminé avec succès
              Fichiers cachés: 1

              **************************************************************************
              .
              --------------------- CLES DE REGISTRE BLOQUEES ---------------------

              [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø*€|ÿÿÿÿ*€|ù*9~*]
              "C040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
              .
              --------------------- DLLs chargées dans les processus actifs ---------------------

              - - - - - - - > 'winlogon.exe'(976)
              c:\windows\system32\Ati2evxx.dll

              - - - - - - - > 'explorer.exe'(4784)
              c:\docume~1\HP_ADM~1\LOCALS~1\Temp\IadHide5.dll
              c:\windows\system32\eappprxy.dll
              .
              ------------------------ Autres processus actifs ------------------------
              .
              c:\windows\system32\Ati2evxx.exe
              c:\windows\system32\Ati2evxx.exe
              c:\program files\Alwil Software\Avast5\AvastSvc.exe
              c:\windows\RTHDCPL.EXE
              c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
              c:\program files\Bonjour\mDNSResponder.exe
              c:\windows\system32\drivers\CDAC11BA.EXE
              c:\windows\eHome\ehRecvr.exe
              c:\windows\eHome\ehSched.exe
              c:\program files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
              c:\program files\Java\jre6\bin\jqs.exe
              c:\program files\Fichiers communs\LightScribe\LSSrvc.exe
              c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
              c:\windows\ehome\mcrdsvc.exe
              c:\program files\Canon\CAL\CALMAIN.exe
              c:\windows\system32\wbem\unsecapp.exe
              c:\program files\iPod\bin\iPodService.exe
              c:\windows\eHome\ehmsas.exe
              c:\windows\system32\dllhost.exe
              c:\windows\system32\HPZipm12.exe
              c:\program files\Lavasoft\Ad-Aware\AAWTray.exe
              .
              **************************************************************************
              .
              Heure de fin: 2010-05-03 16:24:32 - La machine a redémarré
              ComboFix-quarantined-files.txt 2010-05-03 14:24

              Avant-CF: 177 899 614 208 octets libres
              Après-CF: 179 869 925 376 octets libres

              Current=1 Default=1 Failed=2 LastKnownGood=5 Sets=,1,2,4,5
              - - End Of File - - 716F769B02EFD1EACD57C3AD3938CBF8
              1. Utilisateur anonyme
                ComboFix a fait déjà du bon travail
                il a remplacé un fichier patché, et restauré un autre fichier qui était manquant
                Effectivement, y'a du rootkit, il reste des traces à nettoyer avec une manip spéciale que je dois préparer

                J'ai oublié de te dire de vider la quarantaine de Malwarebytes qui avait
                trouvé tout un pannel de nuisibles
                1. Utilisateur anonyme
                  Attention, ce script a été spécialement conçu pour Alice. Il ne faut
                  en aucun cas le transporter sur un autre ordinateur, ce qui pourrai l'endommager

                  Surtout, garde tes protections désactivées, sinon, désactive les
                  Ouvre le bloc-notes, et copie/colle dans le bloc-note ce qui est en gras ci-dessous:

                  KillAll::

                  File::
                  c:\docume~1\HP_ADM~1\LOCALS~1\Temp\DIOB.tmp
                  c:\docume~1\HP_ADM~1\LOCALS~1\Temp\IadHide5.dll

                  Enregistre ce fichier sur ton bureau et pas ailleurs sous le nom de CFScript.txt
                  Quitte le bloc-notes
                  * Fais un glisser/déposer de ce fichier CFScript.txt sur le fichier Combofix.exe
                  comme ceci
                  * Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal ! Ne touche à rien tant que le scan n'est pas terminé.
                  * Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
                  * Si le fichier ne s'ouvre pas, il se trouve ici ? C:\ComboFix.txt
                  1. Alice
                    Merci encore pour ton aide.

                    Voici le rapport:

                    ComboFix 10-05-02.03 - HP_Administrateur 04/05/2010 4:18.2.2 - x86
                    Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.1022.229 [GMT 2:00]
                    Lancé depuis: c:\documents and settings\HP_Administrateur\Mes documents\Téléchargements\ComboFix.exe
                    Commutateurs utilisés :: c:\documents and settings\HP_Administrateur\Bureau\CFScript.txt
                    AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
                    .

                    ((((((((((((((((((((((((((((( Fichiers créés du 2010-04-04 au 2010-05-04 ))))))))))))))))))))))))))))))))))))
                    .

                    2010-05-03 17:16 . 2010-05-03 17:16 -------- d-----w- c:\documents and settings\HP_Administrateur\Local Settings\Application Data\Help
                    2010-05-03 16:33 . 2010-05-03 16:33 -------- d-----w- c:\program files\Sophos
                    2010-05-03 14:04 . 2008-04-13 18:40 62976 ----a-w- c:\windows\system32\drivers\cdrom.sys
                    2010-05-03 14:04 . 2008-04-13 18:40 62976 ----a-w- c:\windows\system32\dllcache\cdrom.sys
                    2010-05-02 21:28 . 2010-05-02 21:28 -------- d-----w- c:\documents and settings\HP_Administrateur\Application Data\Malwarebytes
                    2010-05-02 21:27 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
                    2010-05-02 21:26 . 2010-05-02 21:26 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
                    2010-05-02 21:26 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
                    2010-05-02 21:26 . 2010-05-02 21:27 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
                    2010-05-02 20:21 . 2010-05-02 20:21 -------- d-----w- c:\program files\Trend Micro
                    2010-05-02 09:55 . 2008-04-13 16:39 142592 ----a-w- c:\windows\system32\drivers\aec.sys
                    2010-05-02 09:55 . 2008-04-13 16:39 142592 ----a-w- c:\windows\system32\dllcache\aec.sys
                    2010-05-01 21:32 . 2010-05-01 10:12 15880 ----a-w- c:\windows\system32\lsdelete.exe
                    2010-05-01 10:39 . 2010-05-01 10:39 -------- d-----w- c:\documents and settings\LocalService\Bureau
                    2010-05-01 10:13 . 2010-02-05 09:03 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys
                    2010-05-01 10:13 . 2010-05-01 10:13 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
                    2010-05-01 10:09 . 2010-05-01 10:10 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{52AC600B-5800-407E-99FF-83CD0669760B}
                    2010-05-01 10:09 . 2010-05-01 10:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
                    2010-05-01 10:04 . 2010-05-01 10:04 -------- d-s---w- c:\documents and settings\NetworkService\UserData
                    2010-04-28 04:18 . 2010-02-12 10:03 293376 ------w- c:\windows\system32\browserchoice.exe
                    2010-04-25 15:33 . 2010-04-25 15:53 128347 ----a-w- c:\windows\hpoins11.dat
                    2010-04-25 15:26 . 2006-04-13 00:02 659456 ----a-w- c:\windows\system32\hpowiax2.dll
                    2010-04-25 15:26 . 2006-04-13 00:02 827392 ----a-w- c:\windows\system32\hpotiop2.dll
                    2010-04-25 15:26 . 2006-04-13 00:02 254026 ----a-w- c:\windows\system32\hpovst09.dll
                    2010-04-25 15:25 . 2006-05-05 23:17 11634 ----a-w- c:\windows\hpomdl11.dat
                    2010-04-21 05:10 . 2009-08-13 15:20 512000 ------w- c:\windows\system32\dllcache\jscript.dll
                    2010-04-20 13:35 . 2010-04-20 13:35 -------- d-----w- c:\windows\system32\fr-fr
                    2010-04-20 13:35 . 2010-04-20 13:35 -------- d-----w- c:\windows\l2schemas
                    2010-04-20 13:35 . 2010-04-20 13:35 -------- d-----w- c:\windows\system32\fr
                    2010-04-20 13:35 . 2010-04-20 13:35 -------- d-----w- c:\windows\system32\bits
                    2010-04-20 13:05 . 2010-04-20 13:05 -------- d-----w- c:\windows\system32\FRA
                    2010-04-20 13:05 . 2006-03-09 06:57 122880 ----a-w- c:\windows\system32\Imsmudlg.exe
                    2010-04-20 12:59 . 2010-04-20 13:07 -------- d-----w- c:\documents and settings\HP_Administrateur\Application Data\U3
                    2010-04-09 15:54 . 2010-04-09 15:55 -------- d-----w- c:\program files\Windows Live Safety Center

                    .
                    (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                    .
                    2010-05-04 02:28 . 2010-02-19 20:27 -------- d-----w- c:\documents and settings\HP_Administrateur\Application Data\LimeWire
                    2010-05-02 11:04 . 2010-05-02 11:04 0 ----a-w- c:\windows\system32\drivers\aec.sys.bak
                    2010-05-01 22:03 . 2010-05-01 22:03 16 ----a-w- c:\documents and settings\LocalService\Application Data\wzmjhy.dat
                    2010-05-01 10:10 . 2006-04-01 16:00 -------- d-----w- c:\program files\Lavasoft
                    2010-04-30 22:10 . 2010-04-30 22:10 16 ----a-w- c:\windows\system32\config\systemprofile\Application Data\wzmjhy.dat
                    2010-04-29 11:45 . 2010-02-19 20:46 -------- d-----w- c:\documents and settings\HP_Administrateur\Application Data\Intelli-studio
                    2010-04-25 15:45 . 2005-01-02 04:46 -------- d-----w- c:\program files\Fichiers communs\HP
                    2010-04-25 15:45 . 2005-01-02 04:45 -------- d-----w- c:\program files\HP
                    2010-04-25 15:41 . 2005-01-02 04:56 -------- d-----w- c:\program files\Hewlett-Packard
                    2010-04-20 15:01 . 2006-04-01 17:45 79208 ----a-w- c:\documents and settings\HP_Administrateur\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
                    2010-04-20 14:03 . 2005-10-10 19:39 64484 ----a-w- c:\windows\system32\perfc00C.dat
                    2010-04-20 14:03 . 2005-10-10 19:39 446566 ----a-w- c:\windows\system32\perfh00C.dat
                    2010-04-20 13:22 . 2005-01-02 04:46 -------- d-----w- c:\program files\Fichiers communs\Sonic Shared
                    2010-04-14 16:47 . 2010-02-19 09:30 38848 ----a-w- c:\windows\system32\avastSS.scr
                    2010-04-14 16:47 . 2010-02-19 09:30 153184 ----a-w- c:\windows\system32\aswBoot.exe
                    2010-04-14 16:35 . 2010-02-19 09:30 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
                    2010-04-14 16:35 . 2010-02-19 09:30 162768 ----a-w- c:\windows\system32\drivers\aswSP.sys
                    2010-04-14 16:31 . 2010-02-19 09:30 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
                    2010-04-14 16:31 . 2010-02-19 09:30 100432 ----a-w- c:\windows\system32\drivers\aswmon2.sys
                    2010-04-14 16:31 . 2010-02-19 09:30 94800 ----a-w- c:\windows\system32\drivers\aswmon.sys
                    2010-04-14 16:31 . 2010-02-19 09:30 19024 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
                    2010-04-14 16:30 . 2010-02-19 09:30 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
                    2010-04-14 14:30 . 2005-01-02 05:08 -------- d-----w- c:\program files\Google
                    2010-04-02 11:18 . 2006-04-01 15:34 -------- d-----w- c:\program files\Firefox
                    2010-03-09 11:10 . 2004-08-10 19:00 430080 ----a-w- c:\windows\system32\vbscript.dll
                    2010-02-26 05:42 . 2004-08-10 19:00 671232 ----a-w- c:\windows\system32\wininet.dll
                    2010-02-26 05:42 . 2004-08-10 19:00 81920 ----a-w- c:\windows\system32\ieencode.dll
                    2010-02-24 13:11 . 2004-08-10 19:00 455680 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
                    2010-02-19 20:24 . 2010-02-19 20:24 411368 ----a-w- c:\windows\system32\deploytk.dll
                    2010-02-16 19:06 . 2004-08-10 19:00 2148352 ----a-w- c:\windows\system32\ntoskrnl.exe
                    2010-02-16 19:06 . 2004-08-10 19:00 2026496 ----a-w- c:\windows\system32\ntkrnlpa.exe
                    2010-02-12 04:34 . 2004-08-10 19:00 100864 ----a-w- c:\windows\system32\6to4svc.dll
                    2010-02-11 12:02 . 2004-08-10 19:00 226880 ----a-w- c:\windows\system32\drivers\tcpip6.sys
                    .

                    ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
                    .
                    .
                    *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
                    REGEDIT4

                    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
                    2010-02-04 15:50 1197448 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll

                    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
                    "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-02-04 1197448]

                    [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
                    [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
                    [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
                    [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

                    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                    "LDM"="c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2006-05-19 36864]
                    "MessengerPlus3"="c:\program files\MessengerPlus! 3\MsgPlus1.exe" [2006-04-22 190024]
                    "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]

                    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                    "ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
                    "ftutil2"="ftutil2.dll" [2004-06-07 106496]
                    "AlwaysReady Power Message APP"="ARPWRMSG.EXE" [2005-08-03 77312]
                    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2010-02-19 149280]
                    "hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
                    "RTHDCPL"="RTHDCPL.EXE" [2005-10-15 14864384]
                    "IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2006-02-21 143360]
                    "ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2005-10-02 57344]
                    "Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2005-07-22 237568]
                    "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152]
                    "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
                    "Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe" [2005-06-23 57344]
                    "KBD"="c:\hp\KBD\KBD.EXE" [2005-02-02 61440]
                    "TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2005-01-02 180269]
                    "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792]
                    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-01-22 141608]
                    "avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-04-14 2790472]
                    "SNPSTD2"="c:\windows\vsnpstd2.exe" [2004-08-30 286720]

                    c:\documents and settings\Default User\Menu D'marrer\Programmes\D'marrage\
                    Pin.lnk - c:\hp\bin\CLOAKER.EXE [2005-1-2 27136]

                    c:\documents and settings\Default User\Menu D'marrer\Programmes\D'marrage\
                    Pin.lnk - c:\hp\bin\CLOAKER.EXE [2005-1-2 27136]

                    c:\documents and settings\HP_Administrateur\Menu D'marrer\Programmes\D'marrage\
                    LimeWire On Startup.lnk - c:\program files\LimeWire\LimeWire.exe [2010-2-12 503808]

                    c:\documents and settings\All Users\Menu D'marrer\Programmes\D'marrage\
                    Barre d''tat systSme d'ATI CATALYST.lnk - c:\program files\ATI Technologies\ATI.ACE\CLI.exe [2005-10-2 57344]
                    HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]
                    Lancement rapide d'Adobe Reader.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-24 29696]
                    Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2006-5-19 196608]

                    c:\documents and settings\Default User\Menu D'marrer\Programmes\D'marrage\
                    Pin.lnk - c:\hp\bin\CLOAKER.EXE [2005-1-2 27136]

                    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
                    @="Service"

                    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                    "%windir%\\system32\\sessmgr.exe"=
                    "c:\\Program Files\\Messenger\\msmsgs.exe"=
                    "c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
                    "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
                    "c:\\Program Files\\iTunes\\iTunes.exe"=
                    "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
                    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
                    "c:\\Program Files\\LimeWire\\LimeWire.exe"=
                    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
                    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
                    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
                    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
                    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
                    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
                    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
                    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
                    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
                    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
                    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
                    "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
                    "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
                    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
                    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=

                    R0 d347bus;d347bus;c:\windows\system32\drivers\d347bus.sys [27/07/2006 19:16 155136]
                    R0 d347prt;d347prt;c:\windows\system32\drivers\d347prt.sys [27/07/2006 19:16 5248]
                    R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [01/05/2010 12:13 64288]
                    R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [19/02/2010 11:30 162768]
                    R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [19/02/2010 11:30 19024]
                    R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [05/02/2010 11:03 1285864]
                    R3 3xHybrid;3xHybrid service;c:\windows\system32\drivers\3xHybrid.sys [02/01/2005 06:41 2799488]
                    R3 WN5301;LIteon Wireless PCI Network Adapter Service;c:\windows\system32\drivers\wn5301.sys [02/01/2005 06:40 468768]
                    S2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [24/02/2010 19:12 135664]
                    S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [02/05/2010 23:27 38224]
                    S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\52.tmp --> c:\windows\system32\52.tmp [?]
                    S3 WN5401;Liteon Wireless LAN PCI 802.11 a/b/g adapter WN5401A;c:\windows\system32\drivers\wn5401.sys [02/01/2005 06:40 449920]
                    S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [12/02/2007 17:21 682232]
                    .
                    Contenu du dossier 'Tâches planifiées'

                    2010-05-04 c:\windows\Tasks\Ad-Aware Update (Weekly).job
                    - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-02-05 10:12]

                    2010-04-29 c:\windows\Tasks\AppleSoftwareUpdate.job
                    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

                    2010-05-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
                    - c:\program files\Google\Update\GoogleUpdate.exe [2010-02-24 17:12]

                    2010-05-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
                    - c:\program files\Google\Update\GoogleUpdate.exe [2010-02-24 17:12]

                    2010-05-04 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
                    - c:\program files\Ask.com\UpdateTask.exe [2010-02-04 15:50]

                    2010-05-02 c:\windows\Tasks\WebReg psc C3100 series.job
                    - c:\program files\HP\Digital Imaging\bin\hpqwrg.exe [2006-02-19 03:09]
                    .
                    .
                    ------- Examen supplémentaire -------
                    .
                    uStart Page = hxxp://www.ustart.org
                    mStart Page = hxxp://www.ustart.org
                    uInternet Settings,ProxyOverride = *.local
                    uSearchAssistant = hxxp://www.google.com/ie
                    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
                    IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
                    Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
                    FF - ProfilePath - c:\documents and settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\akl7iuwj.default\
                    FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
                    FF - prefs.js: browser.search.selectedEngine - Google
                    FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr
                    FF - plugin: c:\program files\Firefox\plugins\np-mswmp.dll
                    FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
                    FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
                    FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll

                    ---- PARAMETRES FIREFOX ----
                    c:\program files\Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
                    c:\program files\Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
                    c:\program files\Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
                    c:\program files\Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
                    c:\program files\Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
                    c:\program files\Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
                    c:\program files\Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
                    c:\program files\Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
                    c:\program files\Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
                    c:\program files\Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
                    c:\program files\Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
                    c:\program files\Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
                    c:\program files\Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
                    c:\program files\Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
                    c:\program files\Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
                    c:\program files\Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
                    c:\program files\Firefox\greprefs\all.js - pref("html5.enable", false);
                    c:\program files\Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
                    c:\program files\Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
                    c:\program files\Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
                    c:\program files\Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
                    c:\program files\Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
                    c:\program files\Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "https://www.mozilla.org/en-US/firefox/new/?redirect_source=firefox-com");
                    c:\program files\Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
                    c:\program files\Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
                    c:\program files\Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
                    c:\program files\Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
                    c:\program files\Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
                    c:\program files\Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
                    c:\program files\Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
                    c:\program files\Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
                    c:\program files\Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
                    c:\program files\Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
                    c:\program files\Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
                    c:\program files\Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
                    c:\program files\Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
                    .

                    **************************************************************************

                    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                    Rootkit scan 2010-05-04 04:28
                    Windows 5.1.2600 Service Pack 3 NTFS

                    Recherche de processus cachés ...

                    Recherche d'éléments en démarrage automatique cachés ...

                    Recherche de fichiers cachés ...

                    Scan terminé avec succès
                    Fichiers cachés: 0

                    **************************************************************************

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MEMSWEEP2]
                    "ImagePath"="\??\c:\windows\system32\52.tmp"
                    .
                    --------------------- CLES DE REGISTRE BLOQUEES ---------------------

                    [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø*€|ÿÿÿÿ*€|ù*9~*]
                    "C040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
                    .
                    --------------------- DLLs chargées dans les processus actifs ---------------------

                    - - - - - - - > 'winlogon.exe'(972)
                    c:\windows\system32\Ati2evxx.dll

                    - - - - - - - > 'explorer.exe'(5404)
                    c:\docume~1\HP_ADM~1\LOCALS~1\Temp\IadHide5.dll
                    c:\windows\system32\eappprxy.dll
                    .
                    ------------------------ Autres processus actifs ------------------------
                    .
                    c:\windows\system32\Ati2evxx.exe
                    c:\windows\system32\Ati2evxx.exe
                    c:\program files\Alwil Software\Avast5\AvastSvc.exe
                    c:\windows\RTHDCPL.EXE
                    c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                    c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
                    c:\program files\Bonjour\mDNSResponder.exe
                    c:\windows\system32\drivers\CDAC11BA.EXE
                    c:\windows\eHome\ehRecvr.exe
                    c:\windows\eHome\ehSched.exe
                    c:\program files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
                    c:\program files\Java\jre6\bin\jqs.exe
                    c:\program files\Fichiers communs\LightScribe\LSSrvc.exe
                    c:\windows\ehome\mcrdsvc.exe
                    c:\program files\Canon\CAL\CALMAIN.exe
                    c:\windows\system32\wbem\unsecapp.exe
                    c:\program files\iPod\bin\iPodService.exe
                    c:\windows\system32\dllhost.exe
                    c:\windows\eHome\ehmsas.exe
                    c:\program files\Lavasoft\Ad-Aware\AAWTray.exe
                    .
                    **************************************************************************
                    .
                    Heure de fin: 2010-05-04 04:39:55 - La machine a redémarré
                    ComboFix-quarantined-files.txt 2010-05-04 02:39
                    ComboFix2.txt 2010-05-03 14:24

                    Avant-CF: 183 666 581 504 octets libres
                    Après-CF: 183 675 232 256 octets libres

                    Current=1 Default=1 Failed=2 LastKnownGood=5 Sets=,1,2,4,5
                    - - End Of File - - FA4AB083D6E8C65E7A639BBBD9A52996
                    1. Utilisateur anonyme
                      Bonjour
                      Tu vas recommencer

                      Télécharge CFScript.zip sur ton bureau
                      http://sd-1.archive-host.com/membres/up/203669918515832581/CFScript.zip

                      Fais un clic-droit dessus --> Extraire tout --> choisis le Bureau comme destination

                      * Un fichier CFScript.txt se trouve à l'intérieur et se place sur le Bureau.
                      * Surtout, garde tes protections désactivées, sinon, désactive les
                      * Fais un glisser/déposer de ce fichier CFScript.txt sur le fichier Combofix.exe
                      comme ceci
                      * Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal ! Ne touche à rien tant que le scan n'est pas terminé.
                      * Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
                      * Si le fichier ne s'ouvre pas, il se trouve ici ? C:\ComboFix.txt
                      1. Alice
                        Voilà le second rapport comme tu m'a demandé.

                        ComboFix 10-05-02.03 - HP_Administrateur 04/05/2010 17:20:38.3.2 - x86
                        Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.1022.247 [GMT 2:00]
                        Lancé depuis: c:\documents and settings\HP_Administrateur\Mes documents\Téléchargements\ComboFix.exe
                        Commutateurs utilisés :: c:\documents and settings\HP_Administrateur\Bureau\CFScript.txt
                        AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

                        FILE ::
                        "c:\docume~1\HP_ADM~1\LOCALS~1\Temp\DIOB.tmp"
                        "c:\docume~1\HP_ADM~1\LOCALS~1\Temp\IadHide5.dll"
                        .

                        (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
                        .

                        c:\docume~1\HP_ADM~1\LOCALS~1\Temp\IadHide5.dll

                        .
                        ((((((((((((((((((((((((((((( Fichiers créés du 2010-04-04 au 2010-05-04 ))))))))))))))))))))))))))))))))))))
                        .

                        2010-05-03 17:16 . 2010-05-03 17:16 -------- d-----w- c:\documents and settings\HP_Administrateur\Local Settings\Application Data\Help
                        2010-05-03 16:33 . 2010-05-03 16:33 -------- d-----w- c:\program files\Sophos
                        2010-05-03 14:04 . 2008-04-13 18:40 62976 ----a-w- c:\windows\system32\drivers\cdrom.sys
                        2010-05-03 14:04 . 2008-04-13 18:40 62976 ----a-w- c:\windows\system32\dllcache\cdrom.sys
                        2010-05-02 21:28 . 2010-05-02 21:28 -------- d-----w- c:\documents and settings\HP_Administrateur\Application Data\Malwarebytes
                        2010-05-02 21:27 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
                        2010-05-02 21:26 . 2010-05-02 21:26 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
                        2010-05-02 21:26 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
                        2010-05-02 21:26 . 2010-05-02 21:27 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
                        2010-05-02 20:21 . 2010-05-02 20:21 -------- d-----w- c:\program files\Trend Micro
                        2010-05-02 09:55 . 2008-04-13 16:39 142592 ----a-w- c:\windows\system32\drivers\aec.sys
                        2010-05-02 09:55 . 2008-04-13 16:39 142592 ----a-w- c:\windows\system32\dllcache\aec.sys
                        2010-05-01 21:32 . 2010-05-01 10:12 15880 ----a-w- c:\windows\system32\lsdelete.exe
                        2010-05-01 10:39 . 2010-05-01 10:39 -------- d-----w- c:\documents and settings\LocalService\Bureau
                        2010-05-01 10:13 . 2010-02-05 09:03 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys
                        2010-05-01 10:13 . 2010-05-01 10:13 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
                        2010-05-01 10:09 . 2010-05-01 10:10 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{52AC600B-5800-407E-99FF-83CD0669760B}
                        2010-05-01 10:09 . 2010-05-01 10:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
                        2010-05-01 10:04 . 2010-05-01 10:04 -------- d-s---w- c:\documents and settings\NetworkService\UserData
                        2010-04-28 04:18 . 2010-02-12 10:03 293376 ------w- c:\windows\system32\browserchoice.exe
                        2010-04-25 15:33 . 2010-04-25 15:53 128347 ----a-w- c:\windows\hpoins11.dat
                        2010-04-25 15:26 . 2006-04-13 00:02 659456 ----a-w- c:\windows\system32\hpowiax2.dll
                        2010-04-25 15:26 . 2006-04-13 00:02 827392 ----a-w- c:\windows\system32\hpotiop2.dll
                        2010-04-25 15:26 . 2006-04-13 00:02 254026 ----a-w- c:\windows\system32\hpovst09.dll
                        2010-04-25 15:25 . 2006-05-05 23:17 11634 ----a-w- c:\windows\hpomdl11.dat
                        2010-04-21 05:10 . 2009-08-13 15:20 512000 ------w- c:\windows\system32\dllcache\jscript.dll
                        2010-04-20 13:35 . 2010-04-20 13:35 -------- d-----w- c:\windows\system32\fr-fr
                        2010-04-20 13:35 . 2010-04-20 13:35 -------- d-----w- c:\windows\l2schemas
                        2010-04-20 13:35 . 2010-04-20 13:35 -------- d-----w- c:\windows\system32\fr
                        2010-04-20 13:35 . 2010-04-20 13:35 -------- d-----w- c:\windows\system32\bits
                        2010-04-20 13:05 . 2010-04-20 13:05 -------- d-----w- c:\windows\system32\FRA
                        2010-04-20 13:05 . 2006-03-09 06:57 122880 ----a-w- c:\windows\system32\Imsmudlg.exe
                        2010-04-20 12:59 . 2010-04-20 13:07 -------- d-----w- c:\documents and settings\HP_Administrateur\Application Data\U3
                        2010-04-09 15:54 . 2010-04-09 15:55 -------- d-----w- c:\program files\Windows Live Safety Center

                        .
                        (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                        .
                        2010-05-04 15:31 . 2010-02-19 20:27 -------- d-----w- c:\documents and settings\HP_Administrateur\Application Data\LimeWire
                        2010-05-02 11:04 . 2010-05-02 11:04 0 ----a-w- c:\windows\system32\drivers\aec.sys.bak
                        2010-05-01 22:03 . 2010-05-01 22:03 16 ----a-w- c:\documents and settings\LocalService\Application Data\wzmjhy.dat
                        2010-05-01 10:10 . 2006-04-01 16:00 -------- d-----w- c:\program files\Lavasoft
                        2010-04-30 22:10 . 2010-04-30 22:10 16 ----a-w- c:\windows\system32\config\systemprofile\Application Data\wzmjhy.dat
                        2010-04-29 11:45 . 2010-02-19 20:46 -------- d-----w- c:\documents and settings\HP_Administrateur\Application Data\Intelli-studio
                        2010-04-25 15:45 . 2005-01-02 04:46 -------- d-----w- c:\program files\Fichiers communs\HP
                        2010-04-25 15:45 . 2005-01-02 04:45 -------- d-----w- c:\program files\HP
                        2010-04-25 15:41 . 2005-01-02 04:56 -------- d-----w- c:\program files\Hewlett-Packard
                        2010-04-20 15:01 . 2006-04-01 17:45 79208 ----a-w- c:\documents and settings\HP_Administrateur\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
                        2010-04-20 14:03 . 2005-10-10 19:39 64484 ----a-w- c:\windows\system32\perfc00C.dat
                        2010-04-20 14:03 . 2005-10-10 19:39 446566 ----a-w- c:\windows\system32\perfh00C.dat
                        2010-04-20 13:22 . 2005-01-02 04:46 -------- d-----w- c:\program files\Fichiers communs\Sonic Shared
                        2010-04-14 16:47 . 2010-02-19 09:30 38848 ----a-w- c:\windows\system32\avastSS.scr
                        2010-04-14 16:47 . 2010-02-19 09:30 153184 ----a-w- c:\windows\system32\aswBoot.exe
                        2010-04-14 16:35 . 2010-02-19 09:30 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
                        2010-04-14 16:35 . 2010-02-19 09:30 162768 ----a-w- c:\windows\system32\drivers\aswSP.sys
                        2010-04-14 16:31 . 2010-02-19 09:30 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
                        2010-04-14 16:31 . 2010-02-19 09:30 100432 ----a-w- c:\windows\system32\drivers\aswmon2.sys
                        2010-04-14 16:31 . 2010-02-19 09:30 94800 ----a-w- c:\windows\system32\drivers\aswmon.sys
                        2010-04-14 16:31 . 2010-02-19 09:30 19024 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
                        2010-04-14 16:30 . 2010-02-19 09:30 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
                        2010-04-14 14:30 . 2005-01-02 05:08 -------- d-----w- c:\program files\Google
                        2010-04-02 11:18 . 2006-04-01 15:34 -------- d-----w- c:\program files\Firefox
                        2010-03-09 11:10 . 2004-08-10 19:00 430080 ----a-w- c:\windows\system32\vbscript.dll
                        2010-02-26 05:42 . 2004-08-10 19:00 671232 ----a-w- c:\windows\system32\wininet.dll
                        2010-02-26 05:42 . 2004-08-10 19:00 81920 ----a-w- c:\windows\system32\ieencode.dll
                        2010-02-24 13:11 . 2004-08-10 19:00 455680 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
                        2010-02-19 20:24 . 2010-02-19 20:24 411368 ----a-w- c:\windows\system32\deploytk.dll
                        2010-02-16 19:06 . 2004-08-10 19:00 2148352 ----a-w- c:\windows\system32\ntoskrnl.exe
                        2010-02-16 19:06 . 2004-08-10 19:00 2026496 ----a-w- c:\windows\system32\ntkrnlpa.exe
                        2010-02-12 04:34 . 2004-08-10 19:00 100864 ----a-w- c:\windows\system32\6to4svc.dll
                        2010-02-11 12:02 . 2004-08-10 19:00 226880 ----a-w- c:\windows\system32\drivers\tcpip6.sys
                        .

                        ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
                        .
                        .
                        *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
                        REGEDIT4

                        [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
                        2010-02-04 15:50 1197448 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll

                        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
                        "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-02-04 1197448]

                        [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
                        [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
                        [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
                        [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

                        [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                        "LDM"="c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2006-05-19 36864]
                        "MessengerPlus3"="c:\program files\MessengerPlus! 3\MsgPlus1.exe" [2006-04-22 190024]
                        "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]

                        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                        "ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
                        "ftutil2"="ftutil2.dll" [2004-06-07 106496]
                        "AlwaysReady Power Message APP"="ARPWRMSG.EXE" [2005-08-03 77312]
                        "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2010-02-19 149280]
                        "hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
                        "RTHDCPL"="RTHDCPL.EXE" [2005-10-15 14864384]
                        "IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2006-02-21 143360]
                        "ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2005-10-02 57344]
                        "Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2005-07-22 237568]
                        "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152]
                        "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
                        "Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe" [2005-06-23 57344]
                        "KBD"="c:\hp\KBD\KBD.EXE" [2005-02-02 61440]
                        "TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2005-01-02 180269]
                        "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792]
                        "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-01-22 141608]
                        "avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-04-14 2790472]
                        "SNPSTD2"="c:\windows\vsnpstd2.exe" [2004-08-30 286720]

                        c:\documents and settings\Default User\Menu D'marrer\Programmes\D'marrage\
                        Pin.lnk - c:\hp\bin\CLOAKER.EXE [2005-1-2 27136]

                        c:\documents and settings\Default User\Menu D'marrer\Programmes\D'marrage\
                        Pin.lnk - c:\hp\bin\CLOAKER.EXE [2005-1-2 27136]

                        c:\documents and settings\HP_Administrateur\Menu D'marrer\Programmes\D'marrage\
                        LimeWire On Startup.lnk - c:\program files\LimeWire\LimeWire.exe [2010-2-12 503808]

                        c:\documents and settings\All Users\Menu D'marrer\Programmes\D'marrage\
                        Barre d''tat systSme d'ATI CATALYST.lnk - c:\program files\ATI Technologies\ATI.ACE\CLI.exe [2005-10-2 57344]
                        HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]
                        Lancement rapide d'Adobe Reader.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-24 29696]
                        Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2006-5-19 196608]

                        c:\documents and settings\Default User\Menu D'marrer\Programmes\D'marrage\
                        Pin.lnk - c:\hp\bin\CLOAKER.EXE [2005-1-2 27136]

                        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
                        @="Service"

                        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                        "%windir%\\system32\\sessmgr.exe"=
                        "c:\\Program Files\\Messenger\\msmsgs.exe"=
                        "c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
                        "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
                        "c:\\Program Files\\iTunes\\iTunes.exe"=
                        "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
                        "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
                        "c:\\Program Files\\LimeWire\\LimeWire.exe"=
                        "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
                        "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
                        "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
                        "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
                        "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
                        "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
                        "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
                        "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
                        "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
                        "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
                        "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
                        "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
                        "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
                        "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
                        "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=

                        R0 d347bus;d347bus;c:\windows\system32\drivers\d347bus.sys [27/07/2006 19:16 155136]
                        R0 d347prt;d347prt;c:\windows\system32\drivers\d347prt.sys [27/07/2006 19:16 5248]
                        R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [01/05/2010 12:13 64288]
                        R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [19/02/2010 11:30 162768]
                        R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [19/02/2010 11:30 19024]
                        R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [05/02/2010 11:03 1285864]
                        R3 3xHybrid;3xHybrid service;c:\windows\system32\drivers\3xHybrid.sys [02/01/2005 06:41 2799488]
                        R3 WN5301;LIteon Wireless PCI Network Adapter Service;c:\windows\system32\drivers\wn5301.sys [02/01/2005 06:40 468768]
                        S2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [24/02/2010 19:12 135664]
                        S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [02/05/2010 23:27 38224]
                        S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\52.tmp --> c:\windows\system32\52.tmp [?]
                        S3 WN5401;Liteon Wireless LAN PCI 802.11 a/b/g adapter WN5401A;c:\windows\system32\drivers\wn5401.sys [02/01/2005 06:40 449920]
                        S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [12/02/2007 17:21 682232]
                        .
                        Contenu du dossier 'Tâches planifiées'

                        2010-05-04 c:\windows\Tasks\Ad-Aware Update (Weekly).job
                        - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-02-05 10:12]

                        2010-04-29 c:\windows\Tasks\AppleSoftwareUpdate.job
                        - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

                        2010-05-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
                        - c:\program files\Google\Update\GoogleUpdate.exe [2010-02-24 17:12]

                        2010-05-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
                        - c:\program files\Google\Update\GoogleUpdate.exe [2010-02-24 17:12]

                        2010-05-04 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
                        - c:\program files\Ask.com\UpdateTask.exe [2010-02-04 15:50]

                        2010-05-02 c:\windows\Tasks\WebReg psc C3100 series.job
                        - c:\program files\HP\Digital Imaging\bin\hpqwrg.exe [2006-02-19 03:09]
                        .
                        .
                        ------- Examen supplémentaire -------
                        .
                        uStart Page = hxxp://www.ustart.org
                        mStart Page = hxxp://www.ustart.org
                        uInternet Settings,ProxyOverride = *.local
                        uSearchAssistant = hxxp://www.google.com/ie
                        uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
                        IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
                        Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
                        FF - ProfilePath - c:\documents and settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\akl7iuwj.default\
                        FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
                        FF - prefs.js: browser.search.selectedEngine - Google
                        FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr
                        FF - plugin: c:\program files\Firefox\plugins\np-mswmp.dll
                        FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
                        FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
                        FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll

                        ---- PARAMETRES FIREFOX ----
                        c:\program files\Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
                        c:\program files\Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
                        c:\program files\Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
                        c:\program files\Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
                        c:\program files\Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
                        c:\program files\Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
                        c:\program files\Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
                        c:\program files\Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
                        c:\program files\Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
                        c:\program files\Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
                        c:\program files\Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
                        c:\program files\Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
                        c:\program files\Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
                        c:\program files\Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
                        c:\program files\Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
                        c:\program files\Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
                        c:\program files\Firefox\greprefs\all.js - pref("html5.enable", false);
                        c:\program files\Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
                        c:\program files\Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
                        c:\program files\Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
                        c:\program files\Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
                        c:\program files\Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
                        c:\program files\Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "https://www.mozilla.org/en-US/firefox/new/?redirect_source=firefox-com");
                        c:\program files\Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
                        c:\program files\Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
                        c:\program files\Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
                        c:\program files\Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
                        c:\program files\Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
                        c:\program files\Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
                        c:\program files\Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
                        c:\program files\Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
                        c:\program files\Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
                        c:\program files\Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
                        c:\program files\Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
                        c:\program files\Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
                        c:\program files\Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
                        .

                        **************************************************************************

                        catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                        Rootkit scan 2010-05-04 17:32
                        Windows 5.1.2600 Service Pack 3 NTFS

                        Recherche de processus cachés ...

                        Recherche d'éléments en démarrage automatique cachés ...

                        Recherche de fichiers cachés ...

                        Scan terminé avec succès
                        Fichiers cachés: 0

                        **************************************************************************

                        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MEMSWEEP2]
                        "ImagePath"="\??\c:\windows\system32\52.tmp"
                        .
                        --------------------- CLES DE REGISTRE BLOQUEES ---------------------

                        [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø*€|ÿÿÿÿ*€|ù*9~*]
                        "C040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
                        .
                        --------------------- DLLs chargées dans les processus actifs ---------------------

                        - - - - - - - > 'winlogon.exe'(972)
                        c:\windows\system32\Ati2evxx.dll

                        - - - - - - - > 'explorer.exe'(5640)
                        c:\windows\system32\eappprxy.dll
                        c:\program files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
                        c:\program files\Microsoft Office\OFFICE11\msohev.dll
                        c:\program files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll
                        .
                        ------------------------ Autres processus actifs ------------------------
                        .
                        c:\windows\system32\Ati2evxx.exe
                        c:\windows\system32\Ati2evxx.exe
                        c:\program files\Alwil Software\Avast5\AvastSvc.exe
                        c:\windows\RTHDCPL.EXE
                        c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                        c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
                        c:\program files\Bonjour\mDNSResponder.exe
                        c:\windows\system32\drivers\CDAC11BA.EXE
                        c:\windows\eHome\ehRecvr.exe
                        c:\windows\eHome\ehSched.exe
                        c:\program files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
                        c:\program files\Java\jre6\bin\jqs.exe
                        c:\program files\Fichiers communs\LightScribe\LSSrvc.exe
                        c:\windows\ehome\mcrdsvc.exe
                        c:\program files\Canon\CAL\CALMAIN.exe
                        c:\program files\iPod\bin\iPodService.exe
                        c:\windows\system32\wbem\unsecapp.exe
                        c:\windows\system32\dllhost.exe
                        c:\windows\eHome\ehmsas.exe
                        c:\program files\Lavasoft\Ad-Aware\AAWTray.exe
                        .
                        **************************************************************************
                        .
                        Heure de fin: 2010-05-04 17:43:22 - La machine a redémarré
                        ComboFix-quarantined-files.txt 2010-05-04 15:43
                        ComboFix2.txt 2010-05-04 02:39
                        ComboFix3.txt 2010-05-03 14:24

                        Avant-CF: 183 605 329 920 octets libres
                        Après-CF: 183 613 485 056 octets libres

                        Current=1 Default=1 Failed=2 LastKnownGood=5 Sets=,1,2,4,5
                        - - End Of File - - E5DA484D1B83D14833AD5B013E85BAC4
                        1. Utilisateur anonyme
                          Tu as une toolbar néfaste Ask
                          Les toolbars ne servent à rien. Certaines sont néfastes et espionnent ta navigation
                          Certaines sont inutiles, elles ne font qu'alourdir la navigation
                          Soit vigilent lorsque tu installes ou met à jour un logiciel gratuit
                          Lit bien les instructions, et décoche la case sur les suppléments qu'on te propose
                          telle que les barres d'outil comme Ask, Kiwee, Search Setting, Crawler, Daemon
                          (à ne pas confondre avec le logiciel Daemon), Dealio, VMN, Fast Browser Search qui sont les plus fréquentes et néfastes
                          Les toolbars, c'est pas obligatoire
                          Je vais te donner ceci en passant, c'est à lire
                          https://forum.malekal.com/viewtopic.php?f=45&t=6173

                          Télécharge Ad-Remover sur ton bureau:
                          http://pagesperso-orange.fr/NosTools/C_XX/AD-R.exe
                          https://www.androidworld.fr/

                          /!\ Ferme toutes tes applications ouvertes. /!\

                          Double clique sur le fichier que tu viens de télécharger, à l'écran qui apparait, clique sur Nettoyer.
                          Laisse travailler l'outil.
                          Poste le rapport qui s'affiche à l'écran quand l'analyse est terminée.
                          Il est sauvegardé dans C:\Ad-Remover-CLEAN[1].txt
                          1. Alice
                            Merci pour tout tes conseils. Penses tu que mon P.C est "sain", en tout cas, plus qu'il ne l'était au debut ?

                            Voilà le rapport ad remover:

                            .
                            ======= RAPPORT D'AD-REMOVER 2.0.0.0,D | UNIQUEMENT XP/VISTA/7 =======
                            .
                            Mis à jour par C_XX le 01/05/10 à 19:50
                            Contact: AdRemover.contact@gmail.com
                            Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
                            .
                            Lancé à: 22:08:50 le 04/05/2010 | Mode normal | Option: CLEAN
                            Exécuté de: C:\Ad-Remover\ADR.exe
                            SE: Microsoft® Windows XP(TM) Service Pack 3 - X86
                            Nom du PC: ATTI
                            Utilisateur actuel: HP_Administrateur
                            .
                            ============== ÉLÉMENT(S) NEUTRALISÉ(S) ==============
                            .
                            .
                            C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\FireFox\Profiles\akl7iuwj.default\extensions\toolbar@ask.com
                            C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\AskToolbar
                            C:\Program Files\Ask.com
                            C:\WINDOWS\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
                            C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job

                            (!) -- Fichiers temporaires supprimés.
                            .
                            HKCU\Software\AppDataLow\AskToolbarInfo
                            HKCU\Software\Ask.com
                            HKCU\Software\AskToolbar
                            HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
                            HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
                            HKLM\Software\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
                            HKLM\Software\Classes\AppID\GenericAskToolbar.DLL
                            HKLM\Software\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
                            HKLM\Software\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
                            HKLM\Software\Classes\GenericAskToolbar.ToolbarWnd
                            HKLM\Software\Classes\GenericAskToolbar.ToolbarWnd.1
                            HKLM\Software\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
                            HKLM\Software\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
                            HKLM\Software\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
                            HKLM\Software\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
                            HKLM\Software\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
                            HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
                            HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
                            HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Userdata\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
                            HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
                            HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser|{D4027C7F-154A-4066-A1AD-4243D8127440}
                            HKLM\Software\Microsoft\Internet Explorer\Toolbar|{D4027C7F-154A-4066-A1AD-4243D8127440}
                            .
                            (Orpheline) BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} (CLSID manquant)
                            .
                            ============== SCAN ADDITIONNEL ==============
                            .
                            * Mozilla FireFox Version 3.6.2pre (fr) *
                            .
                            C:\Documents and Settings\HP_Administrateur\..\akl7iuwj.default\prefs.js - browser.download.lastDir: C:\\Documents and Settings\\HP_Administrateur\\Mes documents\\Mes images
                            C:\Documents and Settings\HP_Administrateur\..\akl7iuwj.default\prefs.js - browser.search.defaultenginename: Google
                            C:\Documents and Settings\HP_Administrateur\..\akl7iuwj.default\prefs.js - browser.search.defaulturl: hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
                            C:\Documents and Settings\HP_Administrateur\..\akl7iuwj.default\prefs.js - browser.search.selectedEngine: Google
                            C:\Documents and Settings\HP_Administrateur\..\akl7iuwj.default\prefs.js - browser.startup.homepage: hxxp://www.google.fr
                            C:\Documents and Settings\HP_Administrateur\..\akl7iuwj.default\prefs.js - browser.startup.homepage_override.mstone: rv:1.9.2.2
                            .
                            EFFACÉ: C:\Documents and Settings\HP_Administrateur\..\akl7iuwj.default\prefs.js - user_pref("extensions.asktb.cbid", "HS");
                            EFFACÉ: C:\Documents and Settings\HP_Administrateur\..\akl7iuwj.default\prefs.js - user_pref("extensions.asktb.default-channel-url-mask", "hxxp://www.ask.com/web?q={query}&o={o}&l={l}&qsrc={qsrc}&alwb=y");
                            EFFACÉ: C:\Documents and Settings\HP_Administrateur\..\akl7iuwj.default\prefs.js - user_pref("extensions.asktb.fresh-install", false);
                            EFFACÉ: C:\Documents and Settings\HP_Administrateur\..\akl7iuwj.default\prefs.js - user_pref("extensions.asktb.l", "dis");
                            EFFACÉ: C:\Documents and Settings\HP_Administrateur\..\akl7iuwj.default\prefs.js - user_pref("extensions.asktb.last-config-req", "1272823959893");
                            EFFACÉ: C:\Documents and Settings\HP_Administrateur\..\akl7iuwj.default\prefs.js - user_pref("extensions.asktb.locale", "en_US");
                            EFFACÉ: C:\Documents and Settings\HP_Administrateur\..\akl7iuwj.default\prefs.js - user_pref("extensions.asktb.o", "15753");
                            EFFACÉ: C:\Documents and Settings\HP_Administrateur\..\akl7iuwj.default\prefs.js - user_pref("extensions.asktb.options-lang", "en");
                            EFFACÉ: C:\Documents and Settings\HP_Administrateur\..\akl7iuwj.default\prefs.js - user_pref("extensions.asktb.options-locale", "UK");
                            EFFACÉ: C:\Documents and Settings\HP_Administrateur\..\akl7iuwj.default\prefs.js - user_pref("extensions.asktb.overlay-reloaded-using-restart", true);
                            EFFACÉ: C:\Documents and Settings\HP_Administrateur\..\akl7iuwj.default\prefs.js - user_pref("extensions.asktb.qsrc", "2871");
                            EFFACÉ: C:\Documents and Settings\HP_Administrateur\..\akl7iuwj.default\prefs.js - user_pref("extensions.asktb.r", "6");
                            EFFACÉ: C:\Documents and Settings\HP_Administrateur\..\akl7iuwj.default\prefs.js - user_pref("extensions.asktb.to", "15885");
                            EFFACÉ: C:\Documents and Settings\HP_Administrateur\..\akl7iuwj.default\prefs.js - user_pref("extensions.enabledItems", "{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}:6.0.16,toolbar@ask.com:3.6.6.117,jqs@sun.com:1.0,{972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.2");
                            .
                            * Internet Explorer Version 6.0.2900.5512 *
                            .
                            [HKCU\Software\Microsoft\Internet Explorer\Main]
                            .
                            Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
                            Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                            Do404Search: 0x01000000
                            Enable Browser Extensions: yes
                            Local Page: C:\WINDOWS\system32\blank.htm
                            Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
                            Show_ToolBar: yes
                            Start Page: hxxp://fr.msn.com/
                            Use Search Asst: no
                            .
                            [HKLM\Software\Microsoft\Internet Explorer\Main]
                            .
                            Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
                            Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                            Delete_Temp_Files_On_Exit: yes
                            Local Page: %SystemRoot%\system32\blank.htm
                            Search bar: hxxp://search.msn.com/spbasic.htm
                            Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                            Start Page: hxxp://fr.msn.com/
                            .
                            [HKLM\Software\Microsoft\Internet Explorer\ABOUTURLS]
                            .
                            Tabs: res://ieframe.dll/tabswelcome.htm
                            Blank: res://mshtml.dll/blank.htm
                            .
                            ========================================
                            .
                            C:\Ad-Remover\Quarantine: 1 Fichier(s)
                            C:\Ad-Remover\Backup: 13 Fichier(s)
                            .
                            C:\Ad-Report-CLEAN[1].txt - 6818 Octet(s)
                            .
                            Fin à: 22:16:52, 04/05/2010
                            .
                            ============== E.O.F - CLEAN[1] ==============
                            1. Utilisateur anonyme
                              C'est bien mieux
                              DESACTIVE TON ANTIVIRUS ET TON PAREFEU SI PRESENTS !!!!!(car il est detecté a tort comme infection)

                              ? Télécharge List_Kill'em et enregistre le sur ton bureau
                              http://sd-1.archive-host.com/...
                              double clique ( clic droit "executer en tant qu'administrateur" pour Vista/7 ) sur le raccourci sur ton bureau pour lancer l'installation

                              Une fois terminée , clic sur "terminer" et le programme se lancera seul

                              Choisis l'option Search

                              Une icône blanche et noire va s'afficher sur le bureau , il te servira à relancer le programme par la suite.
                              Une autre rouge et noir te servira a désinstaller le prog a la fin de la désinfection.

                              ? laisse travailler l'outil

                              A l'apparition de la fenêtre blanche , c'est un peu long , c'est normal , le programme n'est pas bloqué.

                              Un rapport du nom de catchme apparait sur ton bureau , ignore-le,ne le poste pas , , il s'auto supprimera a la fin du scan

                              ? Poste le contenu du rapport qui s'ouvre aux 100 % du scan à l'écran "COMPLETED"
                              1. Alice
                                List'em by g3n-h@ckm@n 1.7.3.0

                                User : HP_Administrateur (Administrateurs)
                                Update on 04/05/2010 by g3n-h@ckm@n ::::: 04.50
                                Start at: 22:41:47 | 04/05/2010

                                Intel(R) Pentium(R) D CPU 2.80GHz
                                Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
                                Internet Explorer 6.0.2900.5512
                                Windows Firewall Status : Enabled
                                AV : avast! Antivirus 5.0.83886587 [ Enabled | Updated ]

                                C:\ -> Disque fixe local | 225,87 Go (170,88 Go free) [HP_PAVILION] | NTFS
                                D:\ -> Disque fixe local | 7 Go (2,06 Go free) [HP_RECOVERY] | FAT32
                                F:\ -> Disque amovible
                                G:\ -> Disque amovible
                                H:\ -> Disque amovible
                                I:\ -> Disque amovible
                                L:\ -> Disque amovible

                                Boot: Normal
                                ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

                                C:\WINDOWS\System32\smss.exe
                                C:\WINDOWS\system32\csrss.exe
                                C:\WINDOWS\system32\winlogon.exe
                                C:\WINDOWS\system32\services.exe
                                C:\WINDOWS\system32\lsass.exe
                                C:\WINDOWS\system32\Ati2evxx.exe
                                C:\WINDOWS\system32\svchost.exe
                                C:\WINDOWS\system32\svchost.exe
                                C:\WINDOWS\System32\svchost.exe
                                C:\WINDOWS\system32\svchost.exe
                                C:\WINDOWS\system32\Ati2evxx.exe
                                C:\WINDOWS\system32\svchost.exe
                                C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
                                C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
                                C:\WINDOWS\Explorer.EXE
                                C:\WINDOWS\ehome\ehtray.exe
                                C:\Program Files\Java\jre6\bin\jusched.exe
                                C:\windows\system\hpsysdrv.exe
                                C:\WINDOWS\RTHDCPL.EXE
                                C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
                                C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
                                C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
                                C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
                                C:\HP\KBD\KBD.EXE
                                C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
                                C:\Program Files\QuickTime\QTTask.exe
                                C:\Program Files\iTunes\iTunesHelper.exe
                                C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
                                C:\WINDOWS\vsnpstd2.exe
                                C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
                                C:\Program Files\Windows Live\Messenger\msnmsgr.exe
                                C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                                C:\Program Files\LimeWire\LimeWire.exe
                                C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
                                C:\WINDOWS\system32\spoolsv.exe
                                C:\WINDOWS\system32\svchost.exe
                                C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                                C:\Program Files\Bonjour\mDNSResponder.exe
                                C:\WINDOWS\system32\drivers\CDAC11BA.EXE
                                C:\WINDOWS\eHome\ehRecvr.exe
                                C:\WINDOWS\eHome\ehSched.exe
                                C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
                                C:\Program Files\Java\jre6\bin\jqs.exe
                                C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
                                C:\WINDOWS\system32\svchost.exe
                                C:\WINDOWS\system32\svchost.exe
                                C:\WINDOWS\ehome\mcrdsvc.exe
                                C:\Program Files\Canon\CAL\CALMAIN.exe
                                C:\WINDOWS\system32\HPZipm12.exe
                                C:\WINDOWS\system32\wbem\unsecapp.exe
                                C:\Program Files\iPod\bin\iPodService.exe
                                C:\WINDOWS\system32\wbem\wmiprvse.exe
                                C:\WINDOWS\system32\dllhost.exe
                                C:\WINDOWS\System32\alg.exe
                                C:\WINDOWS\System32\svchost.exe
                                C:\Program Files\Firefox\firefox.exe
                                C:\WINDOWS\system32\wuauclt.exe
                                C:\WINDOWS\eHome\ehmsas.exe
                                C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
                                C:\WINDOWS\system32\NOTEPAD.EXE
                                C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
                                C:\Program Files\Windows Live\Contacts\wlcomm.exe
                                C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
                                C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
                                C:\Program Files\Microsoft\Office Live\OfficeLiveSignIn.exe
                                C:\Program Files\List_Kill'em\List_Kill'em.exe
                                C:\WINDOWS\system32\cmd.exe
                                C:\WINDOWS\system32\wbem\wmiprvse.exe
                                C:\Program Files\List_Kill'em\pv.exe

                                ======================
                                Keys "Run"
                                ======================

                                [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                                LDM REG_SZ C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
                                MessengerPlus3 REG_SZ "C:\Program Files\MessengerPlus! 3\MsgPlus1.exe" /WinStart
                                msnmsgr REG_SZ "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background

                                [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                                ehTray REG_SZ C:\WINDOWS\ehome\ehtray.exe
                                ftutil2 REG_SZ rundll32.exe ftutil2.dll,SetWriteCacheMode
                                AlwaysReady Power Message APP REG_SZ ARPWRMSG.EXE
                                SunJavaUpdateSched REG_SZ "C:\Program Files\Java\jre6\bin\jusched.exe"
                                hpsysdrv REG_SZ c:\windows\system\hpsysdrv.exe
                                RTHDCPL REG_SZ RTHDCPL.EXE
                                IAAnotif REG_SZ C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
                                ATICCC REG_SZ "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
                                Recguard REG_SZ C:\WINDOWS\SMINST\RECGUARD.EXE
                                HP Software Update REG_SZ C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
                                NeroFilterCheck REG_SZ C:\WINDOWS\system32\NeroCheck.exe
                                Adobe Photo Downloader REG_SZ "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
                                KBD REG_SZ C:\HP\KBD\KBD.EXE
                                TkBellExe REG_SZ "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                                QuickTime Task REG_SZ "C:\Program Files\QuickTime\QTTask.exe" -atboottime
                                iTunesHelper REG_SZ "C:\Program Files\iTunes\iTunesHelper.exe"
                                avast5 REG_SZ C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
                                SNPSTD2 REG_SZ C:\WINDOWS\vsnpstd2.exe

                                [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]

                                [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]

                                =====================
                                Other Keys
                                =====================

                                [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
                                dontdisplaylastusername REG_DWORD 0 (0x0)
                                legalnoticecaption REG_SZ
                                legalnoticetext REG_SZ
                                shutdownwithoutlogon REG_DWORD 1 (0x1)
                                undockwithoutlogon REG_DWORD 1 (0x1)
                                InstallVisualStyle REG_EXPAND_SZ C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
                                InstallTheme REG_EXPAND_SZ C:\WINDOWS\Resources\Themes\Royale.theme
                                DisableRegistryTools REG_DWORD 0 (0x0)

                                ===============

                                [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
                                NoDriveTypeAutoRun REG_DWORD 323 (0x143)
                                NoDriveAutoRun REG_DWORD 67108863 (0x3ffffff)
                                NoDrives REG_DWORD 0 (0x0)

                                ===============

                                [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
                                HonorAutoRunSetting REG_DWORD 1 (0x1)
                                NoDriveAutoRun REG_DWORD 67108863 (0x3ffffff)
                                NoDriveTypeAutoRun REG_DWORD 323 (0x143)
                                NoDrives REG_DWORD 0 (0x0)

                                ===============

                                [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

                                ===============

                                [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
                                AutoRestartShell REG_DWORD 1 (0x1)
                                DefaultUserName REG_SZ HP_Administrateur
                                LegalNoticeCaption REG_SZ
                                LegalNoticeText REG_SZ
                                PowerdownAfterShutdown REG_SZ 0
                                ReportBootOk REG_SZ 1
                                Shell REG_SZ Explorer.exe
                                ShutdownWithoutLogon REG_SZ 0
                                System REG_SZ
                                Userinit REG_SZ C:\WINDOWS\system32\userinit.exe,
                                VmApplet REG_SZ rundll32 shell32,Control_RunDLL "sysdm.cpl"
                                SfcQuota REG_DWORD -1 (0xffffffff)
                                allocatecdroms REG_SZ 0
                                allocatedasd REG_SZ 0
                                allocatefloppies REG_SZ 0
                                cachedlogonscount REG_SZ 10
                                forceunlocklogon REG_DWORD 0 (0x0)
                                passwordexpirywarning REG_DWORD 14 (0xe)
                                scremoveoption REG_SZ 0
                                AllowMultipleTSSessions REG_DWORD 1 (0x1)
                                UIHost REG_EXPAND_SZ logonui.exe
                                LogonType REG_DWORD 1 (0x1)
                                Background REG_SZ 0 0 0
                                DebugServerCommand REG_SZ no
                                SFCDisable REG_DWORD 0 (0x0)
                                WinStationsDisabled REG_SZ 0
                                HibernationPreviouslyEnabled REG_DWORD 1 (0x1)
                                ShowLogonOptions REG_DWORD 0 (0x0)
                                AltDefaultUserName REG_SZ HP_Administrateur
                                AltDefaultDomainName REG_SZ ATTI
                                DefaultDomainName REG_SZ ATTI
                                AutoAdminLogon REG_SZ 0
                                ChangePasswordUseKerberos REG_DWORD 1 (0x1)
                                1. Alice
                                  ===============

                                  [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\AtiExtEvent]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\crypt32chain]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cryptnet]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cscdll]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ScCertProp]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Schedule]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sclgntfy]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SensLogn]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\termsrv]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WgaLogon]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wlballoon]

                                  ===============

                                  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
                                  {AEB6717E-7E19-11d0-97EE-00C04FD91972} REG_SZ

                                  ===============

                                  [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
                                  %windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
                                  C:\Program Files\Messenger\msmsgs.exe REG_SZ C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger
                                  C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe REG_SZ C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger
                                  C:\Program Files\Bonjour\mDNSResponder.exe REG_SZ C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour
                                  C:\Program Files\iTunes\iTunes.exe REG_SZ C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes
                                  C:\Program Files\Windows Live\Messenger\wlcsdk.exe REG_SZ C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call
                                  C:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
                                  C:\Program Files\LimeWire\LimeWire.exe REG_SZ C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire
                                  %windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
                                  C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe REG_SZ C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe
                                  C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe REG_SZ C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe
                                  C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe REG_SZ C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe
                                  C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe REG_SZ C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe
                                  C:\Program Files\HP\Digital Imaging\bin\hposid01.exe REG_SZ C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe
                                  C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe REG_SZ C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe
                                  C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe REG_SZ C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe
                                  C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe REG_SZ C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe
                                  C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe REG_SZ C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe
                                  C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe REG_SZ C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe
                                  C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe REG_SZ C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe
                                  C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe REG_SZ C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe
                                  C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe REG_SZ C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe
                                  C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe REG_SZ C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe:*:Enabled:hpqnrs08.exe

                                  [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
                                  %windir%\system32\sessmgr.exe REG_SZ %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019
                                  C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe REG_SZ C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger
                                  C:\Program Files\MSN Messenger\msncall.exe REG_SZ C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)
                                  C:\Program Files\MSN Messenger\livecall.exe REG_SZ C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)
                                  C:\Program Files\Windows Live\Messenger\wlcsdk.exe REG_SZ C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call
                                  C:\Program Files\Windows Live\Messenger\msnmsgr.exe REG_SZ C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
                                  %windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000

                                  ===============
                                  ActivX controls
                                  ===============

                                  [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{2250C29C-C5E9-4F55-BE4E-01E45A40FCF1}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8AD9C840-044E-11D1-B3E9-00805F499D93}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}]

                                  ===============
                                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\KB910393]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{166B1BCA-3F9C-11CF-8075-444553540000}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{1BC46932-21B2-4130-86E0-B4EB4F7A7A7B}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{283807B5-2C60-11D0-A31D-00AA00B92C03}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2A202491-F00D-11cf-87CC-0020AFEECF20}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{407408d4-94ed-4d86-ab69-a7f649d112ee}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{411EDCF7-755D-414E-A74B-3DCD6583F589}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4278c270-a269-11d1-b5bf-0000f8051515}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f216970-c90c-11d1-b5c7-0000f8051515}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5A8D6EE0-3E18-11D0-821E-444553540000}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{73FA19D0-2D75-11D2-995D-00C04F98BBC9}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8b15971b-5355-4c82-8c07-7e181ea07608}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{94de52c8-2d59-4f1b-883e-79663d2d9a8c}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9A394342-4A68-4EBA-85A6-55B559F4E700}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{BDE0FA43-6952-4BA8-8C58-09AF690F88E1}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CC2A9BA0-3BDD-11D0-821E-444553540000}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{DAA94A2A-2A8D-4D3B-9DB8-56FBECED082D}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E8EA5BD6-D931-4001-ABF6-81BAA500360A}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{EA29D410-CE41-4953-A862-2DE706A1DAD7}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{FDC11A6F-17D1-48f9-9EA3-9051954BAA24}]

                                  ==============
                                  BHO :
                                  ======

                                  [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
                                  [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]

                                  ===
                                  DNS
                                  ===

                                  DNS Server Search Order: 16.81.3.243
                                  DNS Server Search Order: 16.118.3.243
                                  Description: Wireless LAN PCI 802.11 a/b/g adapter WN5401A - Miniport d'ordonnancement de paquets
                                  DNS Server Search Order: 192.168.1.1
                                  DNS Server Search Order: 192.168.1.1
                                  Description: Intel(R) PRO/100 VE Network Connection - Miniport d'ordonnancement de paquets
                                  DNS Server Search Order: 192.168.1.1
                                  DNS Server Search Order: 192.168.1.1
                                  HKLM\SYSTEM\CCS\Services\Tcpip\..\{1CEDAE29-FA41-4AE6-BD3D-D3CBBA6A701C}: DhcpNameServer=16.92.3.242 16.92.3.243 16.81.3.243 16.118.3.243
                                  HKLM\SYSTEM\CCS\Services\Tcpip\..\{2482883E-014B-4579-972A-BF3317300B01}: DhcpNameServer=192.168.1.1 192.168.1.1
                                  HKLM\SYSTEM\CCS\Services\Tcpip\..\{DE03D22A-70DF-4A94-9169-209D8353ACF2}: DhcpNameServer=192.168.1.1 192.168.1.1
                                  HKLM\SYSTEM\CS1\Services\Tcpip\..\{1CEDAE29-FA41-4AE6-BD3D-D3CBBA6A701C}: DhcpNameServer=16.92.3.242 16.92.3.243 16.81.3.243 16.118.3.243
                                  HKLM\SYSTEM\CS1\Services\Tcpip\..\{2482883E-014B-4579-972A-BF3317300B01}: DhcpNameServer=192.168.1.1 192.168.1.1
                                  HKLM\SYSTEM\CS1\Services\Tcpip\..\{DE03D22A-70DF-4A94-9169-209D8353ACF2}: DhcpNameServer=192.168.1.1 192.168.1.1
                                  HKLM\SYSTEM\CS2\Services\Tcpip\..\{1CEDAE29-FA41-4AE6-BD3D-D3CBBA6A701C}: DhcpNameServer=16.92.3.242 16.92.3.243 16.81.3.243 16.118.3.243
                                  HKLM\SYSTEM\CS2\Services\Tcpip\..\{2482883E-014B-4579-972A-BF3317300B01}: DhcpNameServer=192.168.1.1 192.168.1.1
                                  HKLM\SYSTEM\CS2\Services\Tcpip\..\{2482883E-014B-4579-972A-BF3317300B01}: NameServer=194.117.200.10,194.117.200.15
                                  HKLM\SYSTEM\CS2\Services\Tcpip\..\{DE03D22A-70DF-4A94-9169-209D8353ACF2}: DhcpNameServer=192.168.1.1 192.168.1.1
                                  HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 192.168.1.1
                                  HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 192.168.1.1
                                  HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 192.168.1.1

                                  ================
                                  Internet Explorer :
                                  ================

                                  [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
                                  Start Page REG_SZ https://www.msn.com/fr-fr
                                  Local Page REG_EXPAND_SZ %SystemRoot%\system32\blank.htm
                                  Default_Search_URL REG_SZ http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
                                  Default_Page_URL REG_SZ http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
                                  Search Page REG_SZ http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

                                  [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
                                  Start Page REG_SZ https://www.msn.com/fr-fr
                                  Local Page REG_SZ C:\WINDOWS\system32\blank.htm

                                  ========
                                  Services
                                  ========

                                  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]

                                  Ndisuio : 0x3 ( OK = 3 )
                                  EapHost : 0x3 ( OK = 2 )
                                  SharedAccess : 0x2 ( OK = 2 )
                                  wuauserv : 0x2 ( OK = 2 )

                                  ========
                                  Safemode
                                  ========

                                  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot : OK !!
                                  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal : OK !!
                                  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network : OK !!

                                  =========
                                  Atapi.sys
                                  =========

                                  C:\WINDOWS\$NtServicePackUninstall$\atapi.sys :
                                  MD5 :: [cdfe4411a69c224bd1d11b2da92dac51]
                                  SHA256 :: [0e6b23a80f171550575bebc56f7500cd87a5cf03b2b9fdc49bc3de96282cd69d]

                                  C:\WINDOWS\ERDNT\cache\atapi.sys :
                                  MD5 :: [9f3a2f5aa6875c72bf062c712cfa2674]
                                  SHA256 :: [b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9]

                                  C:\WINDOWS\ServicePackFiles\i386\atapi.sys :
                                  MD5 :: [9f3a2f5aa6875c72bf062c712cfa2674]
                                  SHA256 :: [b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9]

                                  C:\WINDOWS\system32\drivers\atapi.sys :
                                  MD5 :: [9f3a2f5aa6875c72bf062c712cfa2674]
                                  SHA256 :: [b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9]

                                  C:\WINDOWS\system32\ReinstallBackups\0003\DriverFiles\i386\atapi.sys :
                                  MD5 :: [cdfe4411a69c224bd1d11b2da92dac51]
                                  SHA256 :: [0e6b23a80f171550575bebc56f7500cd87a5cf03b2b9fdc49bc3de96282cd69d]

                                  Référence :
                                  ==========

                                  Win 2000_SP2 : ff953a8f08ca3f822127654375786bbe
                                  Win 2000_SP4 : 8c718aa8c77041b3285d55a0ce980867
                                  Win XP_32b : a64013e98426e1877cb653685c5c0009
                                  Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51
                                  Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674
                                  Vista_32b : e03e8c99d15d0381e02743c36afc7c6f
                                  Vista_SP1_32b : 2d9c903dc76a66813d350a562de40ed9
                                  Vista_SP2_32b : 1F05B78AB91C9075565A9D8A4B880BC4
                                  Vista_SP2_64b : 1898FAE8E07D97F2F6C2D5326C633FAC
                                  Windows 7_32b : 80C40F7FDFC376E4C5FEEC28B41C119E
                                  Windows 7_64b : 02062C0B390B7729EDC9E69C680A6F3C
                                  Windows 7_32b_Ultimate : 338c86357871c167a96ab976519bf59e

                                  =======
                                  Drive :
                                  =======

                                  D'fragmenteur de disque Windows
                                  Copyright (c) 2001 Microsoft Corp. et Executive Software International Inc.

                                  Rapport d'analyse
                                  226 Go total, 171 Go libre (75%), 14% fragment' (fragmentation du fichier 29%)

                                  Vous devriez d'fragmenter ce volume.

                                  ¤¤¤¤¤¤¤¤¤¤ Files/folders :

                                  Present !! : C:\Documents and Settings\LocalService\Application Data\wzmjhy.dat
                                  Present !! : C:\WINDOWS\003068_.tmp
                                  Present !! : C:\WINDOWS\DUMP2e14.tmp
                                  Present !! : C:\WINDOWS\DUMP317f.tmp
                                  Present !! : C:\WINDOWS\DUMP31ce.tmp
                                  Present !! : C:\WINDOWS\DUMP3354.tmp
                                  Present !! : C:\WINDOWS\DUMP375b.tmp
                                  Present !! : C:\WINDOWS\DUMP3c3d.tmp
                                  Present !! : C:\WINDOWS\DUMP7213.tmp
                                  Present !! : C:\WINDOWS\DUMP7222.tmp
                                  Present !! : C:\WINDOWS\DUMP7270.tmp
                                  Present !! : C:\WINDOWS\DUMP72de.tmp
                                  Present !! : C:\WINDOWS\DUMP72df.tmp
                                  Present !! : C:\WINDOWS\DUMP733c.tmp
                                  Present !! : C:\WINDOWS\bwUnin-7.2.0.137-8876480SL.exe
                                  Present !! : C:\WINDOWS\Fonts\GRGAREF.TTF
                                  Present !! : C:\WINDOWS\kb913800.exe
                                  Present !! : C:\WINDOWS\System32\drivers\etc\hosts.msn
                                  Present !! : C:\Documents and Settings\HP_Administrateur\Application Data\GDIPFONTCACHEV1.DAT
                                  Present !! : C:\Documents and Settings\HP_Administrateur\Application Data\wklnhst.dat
                                  Present !! : C:\Documents and Settings\HP_Administrateur\Application Data\GdiplusUpgrade_MSIApproach_Wrapper.log
                                  Present !! : C:\Documents and Settings\HP_Administrateur\Application Data\PatchUpdate_HP_CounterReport_Update_HPSU.log
                                  Present !! : C:\Documents and Settings\HP_Administrateur\Application Data\PatchUpdate_HP_ISRegionListUpdatelog_HPSU.log
                                  Present !! : C:\Documents and Settings\HP_Administrateur\Application Data\PatchUpdate_InstantShareJPG.log
                                  Present !! : C:\Documents and Settings\HP_Administrateur\Application Data\GDIPFONTCACHEV1.DAT
                                  Present !! : C:\Documents and Settings\HP_Administrateur\Application Data\wklnhst.dat
                                  Present !! : C:\Documents and Settings\HP_Administrateur\LOCAL Settings\Temp\Perflib_Perfdata_2e4.dat
                                  Present !! : C:\Documents and Settings\HP_Administrateur\LOCAL Settings\Temp\Perflib_Perfdata_58c.dat
                                  Present !! : C:\Documents and Settings\HP_Administrateur\LOCAL Settings\Temp\IadHide5.dll

                                  ¤¤¤¤¤¤¤¤¤¤ Keys :

                                  Present !! : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}
                                  Present !! : HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives
                                  Present !! : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives
                                  Present !! : HKEY_USERS\S-1-5-21-3823090183-2926167141-2296028189-1007\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives
                                  Present !! : "HKCU\software\microsoft\internet explorer\searchscopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}"
                                  Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
                                  Present !! : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"
                                  Present !! : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D27CDB6E-AE6D-11CF-96B8-444553540000}\iexplore
                                  Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\0E12F736682067FDE4D1158D5940A82E
                                  Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\1A24B5BB8521B03E0C8D908F5ABC0AE6
                                  Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\2B0D56C4F4C46D844A57FFED6F0D2852
                                  Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\49D4375FE41653242AEA4C969E4E65E0
                                  Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\6AA0923513360135B272E8289C5F13FA
                                  Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\6F7467AF8F29C134CBBAB394ECCFDE96
                                  Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\741B4ADF27276464790022C965AB6DA8
                                  Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\7DE196B10195F5647A2B21B761F3DE01
                                  Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\922525DCC5199162F8935747CA3D8E59
                                  Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\9D4F5849367142E4685ED8C25E44C5ED
                                  Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\A5875B04372C19545BEB90D4D606C472
                                  Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\A876D9E80B896EC44A8620248CC79296
                                  Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\B66FFAB725B92594C986DE826A867888
                                  Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\BCDA179D619B91648538E3394CAC94CC
                                  Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\D677B1A9671D4D4004F6F2A4469E86EA
                                  Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\DD1402A9DD4215A43ABDE169A41AFA0E
                                  Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\E36E114A0EAD2AD46B381D23AD69CDDF
                                  Present !! : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\EF8E618DB3AEDFBB384561B5C548F65E
                                  Present !! : HKLM\SYSTEM\ControlSet001\Enum\Root\Legacy_MEMSWEEP2
                                  Present !! : HKLM\SYSTEM\ControlSet001\Services\MEMSWEEP2
                                  Present !! : HKLM\SYSTEM\CurrentControlSet\Enum\Root\Legacy_MEMSWEEP2
                                  Present !! : HKLM\SYSTEM\CurrentControlSet\Services\MEMSWEEP2

                                  ============

                                  catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                                  Rootkit scan 2010-05-04 22:52:32
                                  Windows 5.1.2600 Service Pack 3 FAT NTAPI

                                  scanning hidden processes ...

                                  scanning hidden services ...

                                  scanning hidden autostart entries ...

                                  scanning hidden files ...

                                  scan completed successfully
                                  hidden processes: 0
                                  hidden services: 0
                                  hidden files: 0

                                  Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

                                  device: opened successfully
                                  user: MBR read successfully
                                  called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll
                                  kernel: MBR read successfully
                                  user & kernel MBR OK

                                  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
                                  FirstRunDisabled REG_DWORD 1 (0x1)
                                  AntiVirusDisableNotify REG_DWORD 0 (0x0)
                                  FirewallDisableNotify REG_DWORD 0 (0x0)
                                  UpdatesDisableNotify REG_DWORD 0 (0x0)
                                  AntiVirusOverride REG_DWORD 0 (0x0)
                                  FirewallOverride REG_DWORD 0 (0x0)

                                  ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

                                  End of scan : 22:52:33,17
                                  1. Alice
                                    Désolé, j'ai du le copier/coller en deux fois, ca ne marchait pas sinon...
                                    1. Utilisateur anonyme
                                      C'est bon
                                      ? Relance List_Kill'em(soit en clic droit pour vista/7),avec le raccourci sur ton bureau.
                                      mais cette fois-ci :

                                      ? choisis l'Option Clean

                                      Ton PC va redemarrer,

                                      Laisse travailler l'outil.

                                      En fin de scan la fenêtre se ferme , et tu as un rapport du nom de Kill'em.txt sur ton bureau ,

                                      ? Colle le contenu dans ta réponse
                                      1. Alice
                                        Kill'em by g3n-h@ckm@n 1.7.3.0

                                        User : HP_Administrateur (Administrateurs)
                                        Update on 04/05/2010 by g3n-h@ckm@n ::::: 04.50
                                        Start at: 23:19:24 | 04/05/2010

                                        Intel(R) Pentium(R) D CPU 2.80GHz
                                        Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
                                        Internet Explorer 6.0.2900.5512
                                        Windows Firewall Status : Enabled
                                        AV : avast! Antivirus 5.0.83886587 [ Enabled | Updated ]

                                        C:\ -> Disque fixe local | 225,87 Go (170,89 Go free) [HP_PAVILION] | NTFS
                                        D:\ -> Disque fixe local | 7 Go (2,06 Go free) [HP_RECOVERY] | FAT32
                                        F:\ -> Disque amovible
                                        G:\ -> Disque amovible
                                        H:\ -> Disque amovible
                                        I:\ -> Disque amovible

                                        ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

                                        C:\WINDOWS\System32\smss.exe
                                        C:\WINDOWS\system32\csrss.exe
                                        C:\WINDOWS\system32\winlogon.exe
                                        C:\WINDOWS\system32\services.exe
                                        C:\WINDOWS\system32\lsass.exe
                                        C:\WINDOWS\system32\Ati2evxx.exe
                                        C:\WINDOWS\system32\svchost.exe
                                        C:\WINDOWS\system32\svchost.exe
                                        C:\WINDOWS\System32\svchost.exe
                                        C:\WINDOWS\system32\svchost.exe
                                        C:\WINDOWS\system32\svchost.exe
                                        C:\WINDOWS\system32\Ati2evxx.exe
                                        C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
                                        C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
                                        C:\WINDOWS\Explorer.EXE
                                        C:\WINDOWS\system32\cmd.exe
                                        C:\WINDOWS\system32\spoolsv.exe
                                        C:\WINDOWS\system32\svchost.exe
                                        C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                                        C:\WINDOWS\arservice.exe
                                        C:\Program Files\Bonjour\mDNSResponder.exe
                                        C:\WINDOWS\system32\drivers\CDAC11BA.EXE
                                        C:\WINDOWS\eHome\ehRecvr.exe
                                        C:\WINDOWS\eHome\ehSched.exe
                                        C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
                                        C:\Program Files\Java\jre6\bin\jqs.exe
                                        C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
                                        C:\WINDOWS\system32\svchost.exe
                                        C:\WINDOWS\system32\svchost.exe
                                        C:\WINDOWS\ehome\mcrdsvc.exe
                                        C:\Program Files\Canon\CAL\CALMAIN.exe
                                        C:\WINDOWS\system32\wuauclt.exe
                                        C:\WINDOWS\system32\wbem\unsecapp.exe
                                        C:\WINDOWS\system32\wbem\wmiprvse.exe
                                        C:\WINDOWS\system32\wbem\wmiprvse.exe
                                        C:\WINDOWS\System32\alg.exe
                                        C:\WINDOWS\system32\dllhost.exe
                                        C:\WINDOWS\system32\WgaTray.exe
                                        C:\Program Files\List_Kill'em\pv.exe

                                        ¤¤¤¤¤¤¤¤¤¤ Files/folders :

                                        Quarantined & Deleted !! : C:\Documents and Settings\LocalService\Application Data\wzmjhy.dat
                                        Quarantined & Deleted !! : C:\WINDOWS\003068_.tmp
                                        Quarantined & Deleted !! : C:\WINDOWS\DUMP2e14.tmp
                                        Quarantined & Deleted !! : C:\WINDOWS\DUMP317f.tmp
                                        Quarantined & Deleted !! : C:\WINDOWS\DUMP31ce.tmp
                                        Quarantined & Deleted !! : C:\WINDOWS\DUMP3354.tmp
                                        Quarantined & Deleted !! : C:\WINDOWS\DUMP375b.tmp
                                        Quarantined & Deleted !! : C:\WINDOWS\DUMP3c3d.tmp
                                        Quarantined & Deleted !! : C:\WINDOWS\DUMP7213.tmp
                                        Quarantined & Deleted !! : C:\WINDOWS\DUMP7222.tmp
                                        Quarantined & Deleted !! : C:\WINDOWS\DUMP7270.tmp
                                        Quarantined & Deleted !! : C:\WINDOWS\DUMP72de.tmp
                                        Quarantined & Deleted !! : C:\WINDOWS\DUMP72df.tmp
                                        Quarantined & Deleted !! : C:\WINDOWS\DUMP733c.tmp
                                        Quarantined & Deleted !! : C:\WINDOWS\bwUnin-7.2.0.137-8876480SL.exe
                                        Quarantined & Deleted !! : C:\WINDOWS\Fonts\GRGAREF.TTF
                                        Quarantined & Deleted !! : C:\WINDOWS\kb913800.exe

                                        Quarantined & Deleted !! : C:\WINDOWS\System32\drivers\etc\hosts.msn
                                        Quarantined & Deleted !! : C:\Documents and Settings\HP_Administrateur\Application Data\GDIPFONTCACHEV1.DAT
                                        Quarantined & Deleted !! : C:\Documents and Settings\HP_Administrateur\Application Data\wklnhst.dat
                                        Quarantined & Deleted !! : C:\Documents and Settings\HP_Administrateur\Application Data\GdiplusUpgrade_MSIApproach_Wrapper.log
                                        Quarantined & Deleted !! : C:\Documents and Settings\HP_Administrateur\Application Data\PatchUpdate_HP_CounterReport_Update_HPSU.log
                                        Quarantined & Deleted !! : C:\Documents and Settings\HP_Administrateur\Application Data\PatchUpdate_HP_ISRegionListUpdatelog_HPSU.log
                                        Quarantined & Deleted !! : C:\Documents and Settings\HP_Administrateur\Application Data\PatchUpdate_InstantShareJPG.log
                                        Quarantined & Deleted !! : C:\Documents and Settings\HP_Administrateur\LOCAL Settings\Temp\IadHide5.dll

                                        =======
                                        Hosts :
                                        =======

                                        127.0.0.1 localhost

                                        ========
                                        Registry
                                        ========

                                        Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0E5CBF21-D15F-11D0-8301-00AA005B4383}
                                        Deleted : HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives
                                        Deleted : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives
                                        Deleted : "HKCU\software\microsoft\internet explorer\searchscopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}"
                                        Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
                                        Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"
                                        Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D27CDB6E-AE6D-11CF-96B8-444553540000}\iexplore
                                        Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\0E12F736682067FDE4D1158D5940A82E
                                        Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\1A24B5BB8521B03E0C8D908F5ABC0AE6
                                        Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\2B0D56C4F4C46D844A57FFED6F0D2852
                                        Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\49D4375FE41653242AEA4C969E4E65E0
                                        Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\6AA0923513360135B272E8289C5F13FA
                                        Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\6F7467AF8F29C134CBBAB394ECCFDE96
                                        Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\741B4ADF27276464790022C965AB6DA8
                                        Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\7DE196B10195F5647A2B21B761F3DE01
                                        Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\922525DCC5199162F8935747CA3D8E59
                                        Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\9D4F5849367142E4685ED8C25E44C5ED
                                        Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\A5875B04372C19545BEB90D4D606C472
                                        Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\A876D9E80B896EC44A8620248CC79296
                                        Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\B66FFAB725B92594C986DE826A867888
                                        Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\BCDA179D619B91648538E3394CAC94CC
                                        Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\D677B1A9671D4D4004F6F2A4469E86EA
                                        Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\DD1402A9DD4215A43ABDE169A41AFA0E
                                        Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\E36E114A0EAD2AD46B381D23AD69CDDF
                                        Deleted : HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\EF8E618DB3AEDFBB384561B5C548F65E
                                        Deleted : HKLM\SYSTEM\ControlSet001\Enum\Root\Legacy_MEMSWEEP2
                                        Deleted : HKLM\SYSTEM\ControlSet001\Services\MEMSWEEP2
                                        =================
                                        Internet Explorer
                                        =================

                                        [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
                                        Start Page REG_SZ https://www.msn.com/fr-fr/?ocid=iehp
                                        Local Page REG_SZ C:\WINDOWS\system32\blank.htm
                                        Default_Search_URL REG_SZ https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                                        Default_Page_URL REG_SZ https://www.msn.com/fr-fr/?ocid=iehp
                                        Search Page REG_SZ https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF

                                        [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
                                        Start Page REG_SZ https://www.google.com/?gws_rd=ssl
                                        Local Page REG_SZ C:\WINDOWS\system32\blank.htm
                                        Search Page REG_SZ http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

                                        ===============
                                        Security Center
                                        ===============

                                        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
                                        FirstRunDisabled REG_DWORD 1 (0x1)
                                        AntiVirusDisableNotify REG_DWORD 0 (0x0)
                                        FirewallDisableNotify REG_DWORD 0 (0x0)
                                        UpdatesDisableNotify REG_DWORD 0 (0x0)
                                        AntiVirusOverride REG_DWORD 1 (0x1)
                                        FirewallOverride REG_DWORD 1 (0x1)

                                        ========
                                        Services
                                        =========

                                        Ndisuio : Start = 3
                                        EapHost : Start = 2
                                        Ip6Fw : Start = 2
                                        SharedAccess : Start = 2
                                        wuauserv : Start = 2
                                        wscsvc : Start = 2

                                        ============
                                        Disk Cleaned
                                        anti-ver blaster : OK
                                        Prefetch cleaned
                                        ================

                                        ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
                                        • 1
                                        • 2

                                        Discussions similaires

                                        Problème avec "PUADIManager:Win32/OfferCore
                                        Knaki

                                        3 réponses
                                        Chrome://newtab
                                        Nova

                                        14 réponses
                                        Softonic,est-ce un virus ?
                                        techmel1

                                        6 réponses
                                        Désinstaller Softonic
                                        Diguimette

                                        5 réponses
                                        PUADlManager:Win32/OfferCore
                                        tenmalade

                                        2 réponses