Publicite intempestive sur IE7

Logfile of HijackThis v1.99.1
Scan saved at 23:37:29, on 10/02/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Upsmon\Upsag_nt.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Thrustmaster\Thrustmapper\TMTMTSR.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\program files\powerstrip\pstrip.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Cegetel\C-BOX\Wizard\QuickAccess.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Cegetel\C-BOX\Wizard\Agent_WiFi.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\eMule\eMule.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\tony\LOCALS~1\Temp\Rar$EX00.672\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NVRTCLK] C:\WINDOWS\system32\NVRTCLK\NVRTClk.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ThrustTSR] C:\Program Files\Thrustmaster\Thrustmapper\TMTMTSR.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [PowerStrip] c:\program files\powerstrip\pstrip.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [axis ball grey cdrom] C:\Documents and Settings\All Users\Application Data\CAST BITS AXIS BALL\SpamFork.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Configuration de la C-BOX] C:\Program Files\Cegetel\C-BOX\Wizard\QuickAccess.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [TVAgent WiFi] C:\Program Files\Cegetel\C-BOX\Wizard\Agent_WiFi.exe
O4 - HKCU\..\Run: [insidesoftware] C:\DOCUME~1\tony\APPLIC~1\EXITST~1\linkway.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Upsagent - UPS Monitor (Upsagent) - Unknown owner - C:\Program Files\Upsmon\Upsag_nt.exe

voila le resultat

merci d'avance pour ton aide

-------------------------------------------
Rapport Lopxp fait le 11/02/2007
-------------------------------------------

Exécuté dans C:\Documents and Settings\tony\Mes documents\telechargement


/!\ Attention /!\

Les résultats de ce rapport sont sujets à interprétations,
Et ne démontrent pas systématiquement des dossiers infectés...



**************************************************
## Processus



**************************************************
## Recherche prédéterminé dans C:\Program Files



******************************************
## Tâches planifiées

Suspect : C:\WINDOWS\Tasks\AB1A7262938DEC66.job



******************************************
## Répertoires Application Data

Le volume dans le lecteur C n'a pas de nom.
Le num‚ro de s‚rie du volume est 8C61-CCC1

R‚pertoire de C:\Documents and Settings\All Users\Application Data

11/12/2006 00:35 <REP> Adobe
17/12/2006 11:56 <REP> Adobe Systems
07/02/2007 19:01 <REP> CAST BITS AXIS BALL
09/12/2006 15:06 <REP> My Pictures
09/12/2006 18:49 <REP> nView_Profiles
22/12/2006 20:13 <REP> POPWWPROFILES
03/02/2007 09:04 <REP> QuickTime
09/12/2006 15:05 <REP> Sony Ericsson
21/01/2007 09:59 <REP> Spybot - Search & Destroy
24/12/2006 15:08 <REP> Ubisoft
10/12/2006 09:44 <REP> Windows Genuine Advantage
0 fichier(s) 0 octets
11 R‚p(s) 119ÿ069ÿ437ÿ952 octets libres

Le volume dans le lecteur C n'a pas de nom.
Le num‚ro de s‚rie du volume est 8C61-CCC1

R‚pertoire de C:\Documents and Settings\Default User\Application Data


Le volume dans le lecteur C n'a pas de nom.
Le num‚ro de s‚rie du volume est 8C61-CCC1

R‚pertoire de C:\Documents and Settings\LocalService\Application Data

09/12/2006 14:39 <REP> .
09/12/2006 14:39 <REP> ..
10/02/2007 22:47 <REP> Help
0 fichier(s) 0 octets
3 R‚p(s) 119ÿ069ÿ437ÿ952 octets libres

Le volume dans le lecteur C n'a pas de nom.
Le num‚ro de s‚rie du volume est 8C61-CCC1

R‚pertoire de C:\Documents and Settings\NetworkService\Application Data

09/12/2006 14:38 <REP> .
09/12/2006 14:38 <REP> ..
0 fichier(s) 0 octets
2 R‚p(s) 119ÿ069ÿ437ÿ952 octets libres

Le volume dans le lecteur C n'a pas de nom.
Le num‚ro de s‚rie du volume est 8C61-CCC1

R‚pertoire de C:\Documents and Settings\tony\Application Data

11/12/2006 00:35 <REP> Adobe
12/12/2006 22:33 <REP> Ahead
07/02/2007 19:02 <REP> BitDownload
07/02/2007 19:01 <REP> Exit start
12/12/2006 22:11 <REP> Help
09/12/2006 14:40 <REP> Identities
11/12/2006 00:11 <REP> Macromedia
17/12/2006 22:35 <REP> Opera
19/12/2006 23:47 <REP> Sun
14/12/2006 22:43 <REP> vlc
03/02/2007 09:15 <REP> VTC Preferences Folder
0 fichier(s) 0 octets
11 R‚p(s) 119ÿ069ÿ437ÿ952 octets libres



******************************************
## Répertoires de Program files

Le volume dans le lecteur C n'a pas de nom.
Le num‚ro de s‚rie du volume est 8C61-CCC1

R‚pertoire de C:\Program Files

10/02/2007 22:00 <REP> .
10/02/2007 22:00 <REP> ..
25/01/2007 00:15 <REP> Adobe
28/12/2006 06:46 <REP> Alcohol Soft
09/12/2006 14:58 <REP> Alwil Software
14/01/2007 12:15 <REP> Bayo
10/12/2006 14:21 <REP> Bouton Impression Ecran
09/12/2006 19:03 <REP> Canon
31/01/2007 22:50 <REP> CAPCOM
05/02/2007 21:46 <REP> cartes a verifier
14/12/2006 23:45 <REP> CCleaner
10/12/2006 09:12 <REP> Cegetel
10/02/2007 21:50 <REP> coktel
09/12/2006 14:34 <REP> ComPlus Applications
24/12/2006 11:49 <REP> Electronic Arts
11/02/2007 13:48 <REP> eMule
07/02/2007 19:01 <REP> Exit start
28/12/2006 00:00 <REP> Fichiers communs
10/12/2006 10:06 <REP> Internet Explorer
10/02/2007 11:08 <REP> Java
14/12/2006 22:49 <REP> Lavalys
20/12/2006 22:24 <REP> MadOnion.com
10/12/2006 09:46 <REP> Messenger
09/12/2006 14:36 <REP> microsoft frontpage
28/12/2006 00:00 <REP> Microsoft Office
28/12/2006 00:00 <REP> Microsoft Visual Studio
28/12/2006 00:00 <REP> Microsoft Works
27/12/2006 23:59 <REP> Microsoft.NET
09/12/2006 14:34 <REP> Movie Maker
07/01/2007 19:18 <REP> MSN
09/12/2006 14:33 <REP> MSN Gaming Zone
10/12/2006 09:54 <REP> MSXML 4.0
08/02/2007 21:10 <REP> Multi_Media_France
16/12/2006 23:08 <REP> Nero
09/12/2006 14:34 <REP> NetMeeting
19/12/2006 23:30 <REP> OCCT
09/12/2006 14:33 <REP> Online Services
14/12/2006 21:57 <REP> Outlook Express
21/12/2006 20:52 <REP> PowerStrip
03/02/2007 09:07 <REP> QuickTime
19/12/2006 00:17 <REP> RivaTuner v2.0 RC 16.2
09/12/2006 14:35 <REP> Services en ligne
13/01/2007 13:21 <REP> SlySoft
09/12/2006 15:04 <REP> Sony Ericsson
21/01/2007 10:03 <REP> Spybot - Search & Destroy
03/02/2007 09:43 <REP> The Adventure Company
31/12/2006 08:54 <REP> THQ
12/12/2006 07:08 <REP> Thrustmaster
22/12/2006 21:20 <REP> Ubisoft
10/02/2007 19:07 <REP> Upsmon
10/02/2007 11:21 <REP> UPSTools
14/12/2006 22:41 <REP> VideoLAN
26/12/2006 20:59 <REP> Windows Media Connect 2
10/12/2006 10:11 <REP> Windows Media Player
09/12/2006 14:33 <REP> Windows NT
12/12/2006 22:15 <REP> WinRAR
09/12/2006 14:36 <REP> xerox
14/12/2006 21:49 <REP> XP Codec Pack
0 fichier(s) 0 octets
58 R‚p(s) 119ÿ069ÿ437ÿ952 octets libres


**************************************************
## Recherche dans le registre


# Startup :

* HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
axis ball grey cdrom REG_SZ C:\Documents and Settings\All Users\Application Data\CAST BITS AXIS BALL\SpamFork.exe

* HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
insidesoftware REG_SZ C:\DOCUME~1\tony\APPLIC~1\EXITST~1\linkway.exe


# Clé suspecte:

* [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\More bend site]

- Label "CiD Help" dans Ajout/Supression de Programmes
- Chemin de désinstallation en invite de commande : C:\DOCUME~1\tony\APPLIC~1\EXITST~1\linkway.exe -uninstall


# Popups autorisées

* Internet Explorer

! REG.EXE VERSION 3.0

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\New Windows\Allow

* Mozilla Firefox (1 autorisé 2 interdit)

* Suite Mozilla / SeaMonkey (1 autorisé 2 interdit)


******************************************
## Zones de sécurité

* HKCU Domains (4)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\searchweb2.com]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\searchweb2.com\www]

* P3P History (5)

voila le nouveau contenu du bloc note
merci
a+

Logfile of HijackThis v1.99.1
Scan saved at 17:18:46, on 11/02/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Upsmon\Upsag_nt.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Thrustmaster\Thrustmapper\TMTMTSR.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\program files\powerstrip\pstrip.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Cegetel\C-BOX\Wizard\QuickAccess.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Cegetel\C-BOX\Wizard\Agent_WiFi.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\tony\LOCALS~1\Temp\Rar$EX00.625\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NVRTCLK] C:\WINDOWS\system32\NVRTCLK\NVRTClk.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ThrustTSR] C:\Program Files\Thrustmaster\Thrustmapper\TMTMTSR.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [PowerStrip] c:\program files\powerstrip\pstrip.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Configuration de la C-BOX] C:\Program Files\Cegetel\C-BOX\Wizard\QuickAccess.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [TVAgent WiFi] C:\Program Files\Cegetel\C-BOX\Wizard\Agent_WiFi.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Upsagent - UPS Monitor (Upsagent) - Unknown owner - C:\Program Files\Upsmon\Upsag_nt.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"axis ball grey cdrom"=-

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"insidesoftware"=-

[-HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\More bend site]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\searchweb2.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\searchweb2.com\www]
"*"=dword:00000004

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"axis ball grey cdrom"=-

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"insidesoftware"=-

[-HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\More bend site]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\searchweb2.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\searchweb2.com\www]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\searchweb2.com]
"*"=dword:00000004

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\searchweb2.com\www]
"*"=dword:00000004

j'ai supprimé le dossier bitdownload
voila le rapport de hijackthis
et le dossier reg qui etait dans c:\documents and settings\tony\mes documents\telechargement
a bientot

les deux clés ont pour valeur 0x00000004
oui je crois que j'ai lancé lopxp 2 fois de suite
je ne sais pas a quoi servent ces valeurs de clés
mais depuis je n'ai plus de fenetre de pub qui s'ouvre
merci beaucoup a bientot

encore merci a+