Mon PC rame - besoin d'aide

bonjour, mon pc rame énormément dès que je travaille dessus et aussi sur internet. j'espère que quelqu'un pourra prendre quelques secondes pour jeter un coup d'oeil à mon hijackthis ci-dessous et me dire les fichiers à supprimer et surtout la procédure car je ne suis pas très calé. merci d'avance.

Logfile of HijackThis v1.99.1
Scan saved at 21:38:24, on 29/11/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Messenger\msmsgs.exe
c:\progra~1\intern~1\iexplore.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\MSNMES~1\msnmsgr.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\AOL 9.0a\waol.exe
C:\Program Files\AOL 9.0a\shellmon.exe
C:\WINDOWS\System32\rsvp.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Documents and Settings\All Users\Application Data\amentitleinternetabout\Help media.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\dwwin.exe
C:\DOCUME~1\Didier\APPLIC~1\INTERU~1\TEAMFR~1.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Aol\aoltpspd.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Didier\Bureau\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.wvmgacqvtzlffiizxq.com/9mVOb77Hx/_qKKhKchrLNxIi2/4hji7Kgo5gPdIlzpy5G5R8_UVUJT1/dzmf0INl.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wkqvwmrrsbodcvwhsmflrqc.com/9mVOb77Hx/8/4X67dL5Y5f/FMu0mXnUkOhUhAuoGAMY.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = file://C:\APPS\IE\offline\fr.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\ycomp5_5_7_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {D14BE967-59CE-A18D-5F10-85B312017313} - C:\DOCUME~1\Didier\APPLIC~1\STOREL~1\Browsepoke.exe
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [AOLSAV] C:\PROGRA~1\TECHCI~1\AOLSAV\AOLAgent.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Internetaboutmanagerphone] C:\Documents and Settings\All Users\Application Data\amentitleinternetabout\Help media.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [Instant Access] rundll32.exe EGDACCESS_1070.dll,InstantAccess
O4 - HKCU\..\Run: [audioload] C:\DOCUME~1\Didier\APPLIC~1\INTERU~1\Team Frag.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRA~1\MSNMES~1\msnmsgr.exe" /background
O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {1CD49DC9-FD88-41FA-B892-47E037267D45} - http://akamai.downloadv3.com/binaries/EGDAccess/EGDACCESS_1059_XP.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {31DDC1FD-CEA3-4837-A6DC-87E67015ADC9} - http://akamai.downloadv3.com/binaries/IA/svcsysnet32_FR_XP.cab
O16 - DPF: {54C75FB0-6B8B-4278-BF7B-77036F15A69E} - http://akamai.downloadv3.com/binaries/P2EClient/EGAUTH_1041_FR_XP.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B2B0AEDF-7CDF-4792-BB67-7654AD1E1B13} - http://scripts.downloadv3.com/binaries/IA/sysinetsvc32_FR_XP.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {BA749BC1-143E-430D-B1DA-1D2AF67A3658} - http://scripts.downloadv3.com/binaries/EGDAccess/EGDACCESS_1069_XP.cab
O16 - DPF: {BD3653E4-884B-43C4-970B-670802501B7F} - http://akamai.downloadv3.com/binaries/P2EClient/EGAUTH_1043_FR_XP.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
O16 - DPF: {BFC9677B-8006-4336-9D49-2C797AEFCB9E} - http://akamai.downloadv3.com/binaries/EGDAccess/EGDACCESS_1058_XP.cab
O16 - DPF: {C6760A07-A574-4705-B113-7856315922C3} - http://akamai.downloadv3.com/binaries/IA/sysnetsvc32_FR_XP.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3086FA0E-F04D-4302-B5F9-8EEF5EF13F13}: NameServer = 205.188.146.145
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe

merci d'avance.

26 réponses

Résumé de la discussion

Un PC lent sous Windows XP est analysé à partir d’un log HijackThis et une procédure de nettoyage est demandée pour identifier les fichiers à supprimer. Des étapes pratiques sont proposées: télécharger Clean Up 4.0, redémarrer en mode sans échec, afficher les fichiers cachés, puis lancer HijackThis et fixer les éléments indésirables. Plusieurs recommandations ciblent la suppression manuelle de dossiers et fichiers tels que amentitleinternetabout, Browsepoke.exe et des entrées de navigateur modifiant la page d’accueil, ainsi que le nettoyage des temporaires. D'autres éléments évoquent l’utilisation d’un outil comme SmitFraudFix et la nécessité de poster un nouveau rapport pour confirmer la progression, sans tirer de conclusion définitive sur l’état du système.

Bobot (l’IA à votre service)
  1. Contributeur
    Bonsoir,

    en attendant que je regarde ton log, peux tu tester ce fichier :
    C:\WINDOWS\System32\rsvp.exe
    C:\WINDOWS\system32\dwwin.exe

    sur ce site :
    http://www.virustotal.com/xhtml/virustotal_en.html

    tu cliques sur le bouton parcourir, tu selectionnes le fichier et tu cliques sur Send.

    Colles les rapports des scan ici.

    Et précise moi où en sont tes soucis.

    A+
    1. merci beaucoup de m'aider, j'ai suivi ce que tu m'as dit, et voilà les résultats des deux fichiers :

      This is a report processed by VirusTotal on 12/01/2005 at 08:35:27 (CET) after scanning the file "rsvp.exe" file.
      Antivirus Version Update Result
      AntiVir 6.32.0.6 11.30.2005 no virus found
      Avast 4.6.695.0 11.29.2005 no virus found
      AVG 718 11.29.2005 no virus found
      Avira 6.32.0.6 11.30.2005 no virus found
      BitDefender 7.2 12.01.2005 no virus found
      CAT-QuickHeal 8.00 11.30.2005 no virus found
      ClamAV devel-20051108 11.29.2005 no virus found
      DrWeb 4.33 11.30.2005 no virus found
      eTrust-Iris 7.1.194.0 12.01.2005 no virus found
      eTrust-Vet 11.9.1.0 12.01.2005 no virus found
      Fortinet 2.48.0.0 12.01.2005 no virus found
      F-Prot 3.16c 11.30.2005 no virus found
      Ikarus 0.2.59.0 11.30.2005 no virus found
      Kaspersky 4.0.2.24 12.01.2005 no virus found
      McAfee 4640 11.30.2005 no virus found
      NOD32v2 1.1309 11.30.2005 no virus found
      Norman 5.70.10 11.30.2005 no virus found
      Panda 8.02.00 11.30.2005 no virus found
      Sophos 4.00.0 12.01.2005 no virus found
      Symantec 8.0 12.01.2005 no virus found
      TheHacker 5.9.1.047 12.01.2005 no virus found
      VBA32 3.10.5 11.30.2005 no virus found

      VirusTotal is a free service offered by Hispasec Sistemas. There are no guarantees about the availability and continuity of this service. Although the detection rate afforded by the use of multiple antivirus engines is far superior to that offered by just one product, these results DO NOT guarantee the harmlessness of a file. Currently, there is not any solution that offers a 100% effectiveness rate for detecting viruses and malware.> Go to: Home Contact En español
      --------------------------------------------------------------------------------
      www.virustotal.com :: ©Hispasec Sistemas 2004,05 :: e-mail info@virustotal.com

      This is a report processed by VirusTotal on 12/01/2005 at 08:39:26 (CET) after scanning the file "dwwin.exe" file.
      Antivirus Version Update Result
      AntiVir 6.32.0.6 11.30.2005 no virus found
      Avast 4.6.695.0 11.29.2005 no virus found
      AVG 718 11.29.2005 no virus found
      Avira 6.32.0.6 11.30.2005 no virus found
      BitDefender 7.2 12.01.2005 no virus found
      CAT-QuickHeal 8.00 11.30.2005 no virus found
      ClamAV devel-20051108 11.29.2005 no virus found
      DrWeb 4.33 11.30.2005 no virus found
      eTrust-Iris 7.1.194.0 12.01.2005 no virus found
      eTrust-Vet 11.9.1.0 12.01.2005 no virus found
      Fortinet 2.48.0.0 12.01.2005 no virus found
      F-Prot 3.16c 11.30.2005 no virus found
      Ikarus 0.2.59.0 11.30.2005 no virus found
      Kaspersky 4.0.2.24 12.01.2005 no virus found
      McAfee 4640 11.30.2005 no virus found
      NOD32v2 1.1309 11.30.2005 no virus found
      Norman 5.70.10 11.30.2005 no virus found
      Panda 8.02.00 11.30.2005 no virus found
      Sophos 4.00.0 12.01.2005 no virus found
      Symantec 8.0 12.01.2005 no virus found
      TheHacker 5.9.1.047 12.01.2005 no virus found
      VBA32 3.10.5 11.30.2005 no virus found

      VirusTotal is a free service offered by Hispasec Sistemas. There are no guarantees about the availability and continuity of this service. Although the detection rate afforded by the use of multiple antivirus engines is far superior to that offered by just one product, these results DO NOT guarantee the harmlessness of a file. Currently, there is not any solution that offers a 100% effectiveness rate for detecting viruses and malware.> Go to: Home Contact En español
      --------------------------------------------------------------------------------
      www.virustotal.com :: ©Hispasec Sistemas 2004,05 :: e-mail info@virustotal.com

      qu'en penses-tu ?
      1. bonjour Incognito02,
        j'ai essayé ton fichier, mais je comprends pas, après l'avoir enregistrer, il apparaît en quatre fichiers, pass2, reboot, reg, process, et smifraudfix ; quand je clique sur le dernier, voici le message que j'ai :
        "SmitFraudFix v2.01
        Fichier process.exe absent !
        Dézippez la totalité de l'archive dans un fichier c:\fix\
        Appuyer sur une touche pour continuer...."

        j'appuie donc sur une touche et le fichier se ferme. Pourquoi ne x'exécute-t-il pas comme les autres ? à bientôt.
        1. Contributeur
          Didier,

          tu dois mettre les fichiers dans un dossier (par exemple c:\fix)
          ensuite tu pourras faire un double clic sur smitfraud.cmd.

          j'espère avoir été assez clair, car pas evident à décrire cette manip ! ;-)

          A+

          1. salut incognito02,
            je suis désolé, j'ai essayé mais ça me met le même message,ou alors je m'y prends mal, j'y comprends rien.

            à +
            1. Contributeur
              Bonsoir Didier,

              Re Télécharge ceci: (merci a S!RI pour ce petit programme).
              http://siri.urz.free.fr/Fix/SmitfraudFix.zip

              Et surtout tu crée un dossier dans lequel tu mets smitfraudfix.zip.

              ensuite tu decompresses les fichiers dans ce même dossier.

              enfin tu cliques sur smitfraudfix.cmd.
              et tu choisis l'option 1
              colles le rapport ici stp.

              Tiens moi au courant.

              Bon courage.

              A+

              1. salut
                lorsque tu le telecharge
                tu te rend sur le dossier, clik droit < extraire tout
                apres tu le lance, ca devrait fonctionner

                a+
                1. ok incognito02, j'y suis arrivé et voilà le rapport :
                  SmitFraudFix v2.01

                  Rapport fait à 20:17:59,56 le 02/12/2005
                  Executé à partir de C:\Documents and Settings\Didier\Bureau\SmitfraudFix\SmitfraudFix
                  OS: Microsoft Windows XP [version 5.1.2600]

                  »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\

                  »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS

                  »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system

                  »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\Web

                  »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system32

                  »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\Documents and Settings\Didier\Application Data

                  »»»»»»»»»»»»»»»»»»»»»»»» Recherche Menu Démarrer

                  »»»»»»»»»»»»»»»»»»»»»»»» Recherche Bureau

                  »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\Program Files

                  »»»»»»»»»»»»»»»»»»»»»»»» Recherche présence de clés corrompues

                  »»»»»»»»»»»»»»»»»»»»»»»» Recherche éléments du bureau

                  [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
                  "Source"="About:Home"
                  "SubscribedURL"="About:Home"
                  "FriendlyName"="Ma page d'accueil"

                  »»»»»»»»»»»»»»»»»»»»»»»» Recherche Sharedtaskscheduler

                  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
                  "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pr‚-chargeur Browseui"
                  "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="D‚mon de cache des cat‚gories de composant"

                  »»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

                  »»»»»»»»»»»»»»»»»»»»»»»» Fin du rapport

                  à +. merci aussi à régis59.
                  1. Contributeur
                    Re,

                    Relance smitfraudfix avec l'option 2
                    colle le rapport ici.

                    et relance hijackthis et repostes le log.

                    Bon courage.

                    A+
                    1. bonjour incognito02, voici les deux rapports :

                      SmitFraudFix v2.01

                      Rapport fait à 8:30:24,87 le 03/12/2005
                      Executé à partir de C:\Documents and Settings\Didier\Bureau\SmitfraudFix\SmitfraudFix
                      OS: Microsoft Windows XP [version 5.1.2600]

                      »»»»»»»»»»»»»»»»»»»»»»»» Arret des processus

                      »»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés

                      »»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre

                      Nettoyage terminé.

                      »»»»»»»»»»»»»»»»»»»»»»»» Fin du rapport

                      Logfile of HijackThis v1.99.1
                      Scan saved at 08:31:32, on 03/12/2005
                      Platform: Windows XP SP2 (WinNT 5.01.2600)
                      MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

                      Running processes:
                      C:\WINDOWS\System32\smss.exe
                      C:\WINDOWS\system32\winlogon.exe
                      C:\WINDOWS\system32\services.exe
                      C:\WINDOWS\system32\lsass.exe
                      C:\WINDOWS\system32\svchost.exe
                      C:\WINDOWS\System32\svchost.exe
                      C:\WINDOWS\system32\spoolsv.exe
                      C:\PROGRA~1\TECHCI~1\AOLSAV\AOLAgent.exe
                      C:\Program Files\MessengerPlus! 3\MsgPlus.exe
                      C:\Program Files\QuickTime\qttask.exe
                      C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                      C:\WINDOWS\system32\rundll32.exe
                      c:\progra~1\intern~1\iexplore.exe
                      C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
                      C:\Program Files\Internet Explorer\iexplore.exe
                      C:\PROGRA~1\MSNMES~1\msnmsgr.exe
                      C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                      C:\Program Files\Alwil Software\Avast4\ashServ.exe
                      C:\WINDOWS\system32\drivers\CDAC11BA.EXE
                      C:\WINDOWS\system32\drivers\KodakCCS.exe
                      C:\WINDOWS\system32\slserv.exe
                      C:\WINDOWS\System32\svchost.exe
                      C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                      C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                      C:\Program Files\AOL 9.0a\waol.exe
                      C:\Program Files\AOL 9.0a\shellmon.exe
                      C:\Program Files\Fichiers communs\Aol\aoltpspd.exe
                      C:\WINDOWS\explorer.exe
                      C:\Documents and Settings\Didier\Bureau\HijackThis.exe

                      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://dlbhbvtclpniuxnekfyf.net/9mVOb77Hx/_qKKhKchrLNxIi2/4hji7Kgo5gPdIlzpyyuhLUEN3Rmz1/dzmf0INl.cgi
                      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell
                      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                      O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\ycomp5_5_7_0.dll
                      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
                      O2 - BHO: (no name) - {D14BE967-59CE-A18D-5F10-85B312017313} - C:\DOCUME~1\Didier\APPLIC~1\STOREL~1\Browsepoke.exe
                      O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
                      O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\ycomp5_5_7_0.dll
                      O4 - HKLM\..\Run: [AOLSAV] C:\PROGRA~1\TECHCI~1\AOLSAV\AOLAgent.exe
                      O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
                      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                      O4 - HKLM\..\Run: [Internetaboutmanagerphone] C:\Documents and Settings\All Users\Application Data\amentitleinternetabout\Help media.exe
                      O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                      O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
                      O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
                      O4 - HKCU\..\Run: [Instant Access] rundll32.exe EGDACCESS_1071.dll,InstantAccess
                      O4 - HKCU\..\Run: [audioload] C:\DOCUME~1\Didier\APPLIC~1\INTERU~1\Team Frag.exe
                      O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRA~1\MSNMES~1\msnmsgr.exe" /background
                      O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
                      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
                      O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
                      O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
                      O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
                      O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
                      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                      O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
                      O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
                      O16 - DPF: {04CCFF26-7D52-4E42-BF6A-F8ECE0896EB7} - http://scripts.downloadv3.com/binaries/EGDAccess/EGDACCESS_1071_XP.cab
                      O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
                      O16 - DPF: {1CD49DC9-FD88-41FA-B892-47E037267D45} - http://akamai.downloadv3.com/binaries/EGDAccess/EGDACCESS_1059_XP.cab
                      O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
                      O16 - DPF: {31DDC1FD-CEA3-4837-A6DC-87E67015ADC9} - http://akamai.downloadv3.com/binaries/IA/svcsysnet32_FR_XP.cab
                      O16 - DPF: {54C75FB0-6B8B-4278-BF7B-77036F15A69E} - http://akamai.downloadv3.com/binaries/P2EClient/EGAUTH_1041_FR_XP.cab
                      O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
                      O16 - DPF: {B2B0AEDF-7CDF-4792-BB67-7654AD1E1B13} - http://scripts.downloadv3.com/binaries/IA/sysinetsvc32_FR_XP.cab
                      O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
                      O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
                      O16 - DPF: {BA749BC1-143E-430D-B1DA-1D2AF67A3658} - http://scripts.downloadv3.com/binaries/EGDAccess/EGDACCESS_1069_XP.cab
                      O16 - DPF: {BD3653E4-884B-43C4-970B-670802501B7F} - http://akamai.downloadv3.com/binaries/P2EClient/EGAUTH_1043_FR_XP.cab
                      O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
                      O16 - DPF: {BFC9677B-8006-4336-9D49-2C797AEFCB9E} - http://akamai.downloadv3.com/binaries/EGDAccess/EGDACCESS_1058_XP.cab
                      O16 - DPF: {C6760A07-A574-4705-B113-7856315922C3} - http://akamai.downloadv3.com/binaries/IA/sysnetsvc32_FR_XP.cab
                      O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
                      O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
                      O17 - HKLM\System\CCS\Services\Tcpip\..\{3086FA0E-F04D-4302-B5F9-8EEF5EF13F13}: NameServer = 205.188.146.145
                      O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
                      O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
                      O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                      O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                      O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
                      O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
                      O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
                      O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
                      O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
                      O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
                      O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe

                      alors qu'en penses-tu ? merci à toi. à +
                      1. salut

                        1/telecharge ceci:
                        http://cjoint.com/?lntQWitwMi

                        2/Clik droit sur le dossier < extraire tout.

                        3/Demarre en sans echec

                        4/lance fix.bat

                        5/suis la procedure a l ecran

                        Remarque: à la fin du nettoyage une fenêtre du prog bfu.exe s'ouvre, il faut juste cliquer sur exit pour la refermer.

                        Redemarre en mode normal et remet un hijack this

                        a+

                        1. voilà incognito02 encore un hijackthis :

                          Logfile of HijackThis v1.99.1
                          Scan saved at 12:10:10, on 03/12/2005
                          Platform: Windows XP SP2 (WinNT 5.01.2600)
                          MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

                          Running processes:
                          C:\WINDOWS\System32\smss.exe
                          C:\WINDOWS\system32\winlogon.exe
                          C:\WINDOWS\system32\services.exe
                          C:\WINDOWS\system32\lsass.exe
                          C:\WINDOWS\system32\svchost.exe
                          C:\WINDOWS\System32\svchost.exe
                          C:\WINDOWS\system32\spoolsv.exe
                          C:\WINDOWS\Explorer.EXE
                          C:\PROGRA~1\TECHCI~1\AOLSAV\AOLAgent.exe
                          C:\Program Files\MessengerPlus! 3\MsgPlus.exe
                          C:\Program Files\QuickTime\qttask.exe
                          C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                          C:\Program Files\Messenger\msmsgs.exe
                          C:\Program Files\Internet Explorer\iexplore.exe
                          c:\progra~1\intern~1\iexplore.exe
                          C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
                          C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                          C:\Program Files\Alwil Software\Avast4\ashServ.exe
                          C:\PROGRA~1\MSNMES~1\msnmsgr.exe
                          C:\WINDOWS\system32\drivers\CDAC11BA.EXE
                          C:\WINDOWS\system32\drivers\KodakCCS.exe
                          C:\WINDOWS\system32\slserv.exe
                          C:\WINDOWS\System32\svchost.exe
                          C:\Documents and Settings\Didier\Bureau\HijackThis.exe
                          C:\WINDOWS\System32\imapi.exe

                          R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://dlbhbvtclpniuxnekfyf.net/9mVOb77Hx/_qKKhKchrLNxIi2/4hji7Kgo5gPdIlzpyyuhLUEN3Rmz1/dzmf0INl.cgi
                          R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell
                          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                          O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\ycomp5_5_7_0.dll
                          O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
                          O2 - BHO: (no name) - {D14BE967-59CE-A18D-5F10-85B312017313} - C:\DOCUME~1\Didier\APPLIC~1\STOREL~1\Browsepoke.exe
                          O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
                          O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\ycomp5_5_7_0.dll
                          O4 - HKLM\..\Run: [AOLSAV] C:\PROGRA~1\TECHCI~1\AOLSAV\AOLAgent.exe
                          O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
                          O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                          O4 - HKLM\..\Run: [Internetaboutmanagerphone] C:\Documents and Settings\All Users\Application Data\amentitleinternetabout\Help media.exe
                          O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                          O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
                          O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
                          O4 - HKCU\..\Run: [audioload] C:\DOCUME~1\Didier\APPLIC~1\INTERU~1\Team Frag.exe
                          O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRA~1\MSNMES~1\msnmsgr.exe" /background
                          O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
                          O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
                          O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
                          O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
                          O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
                          O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
                          O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                          O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                          O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
                          O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
                          O16 - DPF: {04CCFF26-7D52-4E42-BF6A-F8ECE0896EB7} - http://scripts.downloadv3.com/binaries/EGDAccess/EGDACCESS_1071_XP.cab
                          O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
                          O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
                          O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
                          O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
                          O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
                          O16 - DPF: {BA749BC1-143E-430D-B1DA-1D2AF67A3658} - http://scripts.downloadv3.com/binaries/EGDAccess/EGDACCESS_1069_XP.cab
                          O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
                          O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
                          O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
                          O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
                          O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
                          O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                          O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                          O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
                          O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
                          O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
                          O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
                          O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
                          O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
                          O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe

                          y-at-il encore du nettoyage à faire ? à bientôt.
                          1. Désolé régis59, j'étais persuadé quec'étais la même personne qui me répondait, accepte toutes mes excuses pour cette erreur d'étourderie.

                            poste 12 ? quoi t'es-ceque ?
                            1. Contributeur
                              Bonsoir Didier,

                              Le post N°12 est un peu plus haut dans les messages.
                              c'est ça le post 12 :
                              ------------------------------------------------------------------------------
                              < 12 > - mon PC rame - besoin d'aide
                              Membre CCMAjouté par regis59 (03/12/2005 à 11:01 GMT+1)

                              salut

                              1/telecharge ceci:
                              http://cjoint.com/?lntQWitwMi

                              2/Clik droit sur le dossier < extraire tout.

                              3/Demarre en sans echec

                              4/lance fix.bat

                              5/suis la procedure a l ecran

                              Remarque: à la fin du nettoyage une fenêtre du prog bfu.exe s'ouvre, il faut juste cliquer sur exit pour la refermer.

                              Redemarre en mode normal et remet un hijack this

                              a+

                              --
                              Chouchou-Chouchou, alias Mister Chouchou² (copyright © Bansheestyle
                              1. salut incognito et didier

                                c est pas grave.....

                                Reposte un hijack this des que tu l as fait, merci

                                a+
                                1. okkkkkkkkkkkkk oui je l'ai fait et j'ai mis un hijackthis en résultat au poste 13, là où je croyais que c'étais incognito02 qui m'avait répondu.

                                  à +
                                  1. voilà c'est fait. qu'en penses-tu ? à +

                                    Logfile of HijackThis v1.99.1
                                    Scan saved at 14:18:14, on 04/12/2005
                                    Platform: Windows XP SP2 (WinNT 5.01.2600)
                                    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

                                    Running processes:
                                    C:\WINDOWS\System32\smss.exe
                                    C:\WINDOWS\system32\winlogon.exe
                                    C:\WINDOWS\system32\services.exe
                                    C:\WINDOWS\system32\lsass.exe
                                    C:\WINDOWS\system32\svchost.exe
                                    C:\WINDOWS\System32\svchost.exe
                                    C:\WINDOWS\system32\spoolsv.exe
                                    C:\WINDOWS\Explorer.EXE
                                    C:\PROGRA~1\TECHCI~1\AOLSAV\AOLAgent.exe
                                    C:\Program Files\MessengerPlus! 3\MsgPlus.exe
                                    C:\Program Files\QuickTime\qttask.exe
                                    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                                    C:\Program Files\Messenger\msmsgs.exe
                                    c:\progra~1\intern~1\iexplore.exe
                                    C:\Program Files\Internet Explorer\iexplore.exe
                                    C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
                                    C:\PROGRA~1\MSNMES~1\msnmsgr.exe
                                    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                                    C:\Program Files\Alwil Software\Avast4\ashServ.exe
                                    C:\WINDOWS\system32\drivers\CDAC11BA.EXE
                                    C:\WINDOWS\system32\drivers\KodakCCS.exe
                                    C:\WINDOWS\system32\slserv.exe
                                    C:\WINDOWS\System32\svchost.exe
                                    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                                    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                                    C:\Program Files\AOL 9.0a\waol.exe
                                    C:\Program Files\AOL 9.0a\shellmon.exe
                                    C:\Program Files\Fichiers communs\Aol\aoltpspd.exe
                                    C:\Documents and Settings\Didier\Bureau\HijackThis.exe

                                    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://dlbhbvtclpniuxnekfyf.net/9mVOb77Hx/_qKKhKchrLNxIi2/4hji7Kgo5gPdIlzpyyuhLUEN3Rmz1/dzmf0INl.cgi
                                    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell
                                    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                                    O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\ycomp5_5_7_0.dll
                                    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
                                    O2 - BHO: (no name) - {D14BE967-59CE-A18D-5F10-85B312017313} - C:\DOCUME~1\Didier\APPLIC~1\STOREL~1\Browsepoke.exe
                                    O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
                                    O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\ycomp5_5_7_0.dll
                                    O4 - HKLM\..\Run: [AOLSAV] C:\PROGRA~1\TECHCI~1\AOLSAV\AOLAgent.exe
                                    O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
                                    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                                    O4 - HKLM\..\Run: [Internetaboutmanagerphone] C:\Documents and Settings\All Users\Application Data\amentitleinternetabout\Help media.exe
                                    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                                    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
                                    O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
                                    O4 - HKCU\..\Run: [audioload] C:\DOCUME~1\Didier\APPLIC~1\INTERU~1\Team Frag.exe
                                    O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRA~1\MSNMES~1\msnmsgr.exe" /background
                                    O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
                                    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
                                    O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
                                    O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
                                    O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
                                    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
                                    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                                    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                                    O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
                                    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
                                    O16 - DPF: {04CCFF26-7D52-4E42-BF6A-F8ECE0896EB7} - http://scripts.downloadv3.com/binaries/EGDAccess/EGDACCESS_1071_XP.cab
                                    O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
                                    O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
                                    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
                                    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
                                    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
                                    O16 - DPF: {BA749BC1-143E-430D-B1DA-1D2AF67A3658} - http://scripts.downloadv3.com/binaries/EGDAccess/EGDACCESS_1069_XP.cab
                                    O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
                                    O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
                                    O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
                                    O17 - HKLM\System\CCS\Services\Tcpip\..\{3086FA0E-F04D-4302-B5F9-8EEF5EF13F13}: NameServer = 205.188.146.145
                                    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
                                    O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
                                    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                                    O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                                    O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
                                    O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
                                    O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
                                    O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
                                    O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
                                    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
                                    O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
                                    • 1
                                    • 2