Problemes de virus!!!! help

voici les deux resultats :
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 17:03:50, on 19/04/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\WINDOWS\system32\hphmon05.exe
C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Messenger\Msmsgs.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\isabelle coutand\Bureau\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - (no file)
O2 - BHO: (no name) - {1557B435-8242-4686-9AA3-9265BF7525A4} - C:\WINDOWS\system32\ktyxtjtf.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {733FD72F-103E-4B9E-BCB9-A76064AF3C72} - C:\WINDOWS\system32\khfdedb.dll (file missing)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O2 - BHO: (no name) - {D67CEE81-E659-4505-92A4-DC1192975D99} - C:\WINDOWS\system32\osouwlqe.dll
O2 - BHO: (no name) - {F9CD9132-3371-458F-BE86-02E8F526A918} - C:\WINDOWS\system32\ssqpn.dll (file missing)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [Muscbrigade] c:\Musicbrigade\Musicbrigade.exe check
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [Clock Creative That Okay] C:\Documents and Settings\All Users\Application Data\dalesectclockcreative\Dart Slow.exe
O4 - HKLM\..\Run: [WinFlyer32.dll] "rundll32.exe" C:\WINDOWS\system32\WinFlyer32.dll,Run
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [fsc-reminder.exe] C:\WINDOWS\reminder\fsc-reminder.exe 2454047 6
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [Play math] C:\DOCUME~1\ISABEL~1\APPLIC~1\SIGNON~1\plan rect.exe
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\Msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: @c:\Program Files\Messenger\Msgslang.dll,-61144 - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @c:\Program Files\Messenger\Msgslang.dll,-61144 - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C9DE252F-2880-4898-BC96-0C1C1A1DED70}: NameServer = 192.168.1.1
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Fax - Unknown owner - C:\WINDOWS\system32\fxssvc.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe
O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe

voici le rapport :


Rapport GenProc 0.46 [1] effectué le 20/04/2007 à 10:44:29,26 - SystemRoot = C:\WINDOWS

Dans CCleaner, clique sur "Options", "Avancé" et décoche la case "Effacer uniquement les fichiers, du dossier Temp de Windows, plus vieux que 48 heures". Par la suite, laisse-le avec ses réglages par défaut. C'est tout.

# Etape 1/ Télécharge :

- lopxpMH2 http://www.alt-shift-return.org/Info/Fichiers/lopxpMH2.zip sur ton bureau.
Dézippe-le (clic droit -> "Extraire ici") et double clique sur le fichier lopxpMH.bat.

Dans ta prochaine réponse, poste :
- le contenu du rapport qui va s'ouvrir ;
- un nouveau rapport GenProc.

voici mon rapport, genproc.bat :

Rem GenProc.bat 03/03/2007 - Narco4 & jean-chretien1
Rem Merci Ó S!RI pour la detÚction des Rootkits!
@echo off
color 1f
if exist %SystemDrive%\GenProc.txt del %SystemDrive%\GenProc.txt

Rem *** Verifications ***

set CheminBatch=%cd%

if not exist "%CheminBatch%\Canned\Bagle_Dl.txt" goto ManqueFichiers
if not exist "%CheminBatch%\Canned\FixWareOut_Dl.txt" goto ManqueFichiers
if not exist "%CheminBatch%\Canned\bfu_Dl.txt" goto ManqueFichiers
if not exist "%CheminBatch%\Canned\CCleaner_Dl.txt" goto ManqueFichiers
if not exist "%CheminBatch%\Canned\egdaccess_bfu_Dl.txt" goto ManqueFichiers
if not exist "%CheminBatch%\Canned\Lop_Dl.txt" goto ManqueFichiers
if not exist "%CheminBatch%\Canned\Navipromo_Dl.txt" goto ManqueFichiers
if not exist "%CheminBatch%\Canned\Navipromo_Exec.txt" goto ManqueFichiers
if not exist "%CheminBatch%\Canned\SmitfraudFix_Dl.txt" goto ManqueFichiers
if not exist "%CheminBatch%\Canned\SmitfraudFix_Exec.txt" goto ManqueFichiers
if not exist "%CheminBatch%\Canned\SDfix_Dl.txt" goto ManqueFichiers
if not exist "%CheminBatch%\Canned\SDfix_Exec.txt" goto ManqueFichiers
if not exist "%CheminBatch%\Canned\Vundo_Dl.txt" goto ManqueFichiers
if not exist "%CheminBatch%\Canned\Vundo_Exec.txt" goto ManqueFichiers
if not exist "%CheminBatch%\Canned\Winsoftware_bfu_Dl.txt" goto ManqueFichiers
if not exist "%CheminBatch%\Canned\Winsoftware_bfu_Exec.txt" goto ManqueFichiers
if not exist "%CheminBatch%\Canned\Toolbar_bfu_Dl.txt" goto ManqueFichiers
if not exist "%CheminBatch%\Canned\Toolbar_bfu_Exec.txt" goto ManqueFichiers
if not exist "%CheminBatch%\Canned\FixWebHancer_Dl.txt" goto ManqueFichiers
if not exist "%CheminBatch%\Canned\FixWebHancer_Exec.txt" goto ManqueFichiers
if not exist "%CheminBatch%\Canned\RemGAIN_Dl.txt" goto ManqueFichiers
if not exist "%CheminBatch%\Canned\RemGAIN_Exec.txt" goto ManqueFichiers
if not exist "%CheminBatch%\Canned\FxNdotN_Dl.txt" goto ManqueFichiers
if not exist "%CheminBatch%\Canned\FxNdotN_Exec.txt" goto ManqueFichiers
if not exist "%CheminBatch%\Canned\Look2me_Dl.txt" goto ManqueFichiers
if not exist "%CheminBatch%\Canned\Look2me_Exec.txt" goto ManqueFichiers
if not exist "%CheminBatch%\Canned\rustock_Dl.txt" goto ManqueFichiers
if not exist "%CheminBatch%\Canned\Purity_Dl.txt" goto ManqueFichiers
if not exist "%CheminBatch%\Canned\Purity_Exec.txt" goto ManqueFichiers
if not exist "%CheminBatch%\Canned\MSNfix_Dl.txt" goto ManqueFichiers
if not exist "%CheminBatch%\Canned\MSNfix_Exec.txt" goto ManqueFichiers
if not exist "%CheminBatch%\Arguments" goto ManqueFichiers
if not exist "%CheminBatch%\outil" goto ManqueFichiers
if not exist "%CheminBatch%\Canned\Flash_Disinfector_Dl.txt" goto ManqueFichiers
if not exist "%CheminBatch%\Canned\Flash_Disinfector_Exec.txt" goto ManqueFichiers
if not exist "%CheminBatch%\Canned\Haxfix_Dl.txt" goto ManqueFichiers

goto ManqueFichiers2

:ManqueFichiers
cls
echo.
echo.
echo.
echo.
echo Il manque un ou plusieurs fichiers
echo necessaires au fonctionnement du programme.
echo.
echo.
echo Veuillez :
echo.
echo.
echo 1 - Fermer cette fenetre
echo 2 - Supprimer la totalite du dossier GenProc ainsi que le fichier GenProc.zip
echo 3 - Suivre ces indications :
echo http://www.alt-shift-return.org/Info/GenProc-HowTo.html
echo.
echo.
echo.
echo.
pause
exit

:ManqueFichiers2
if not exist "%CheminBatch%\GenProc.bat" (
cls
echo.
echo.
echo.
echo.
echo Attention, le dossier GenProc doit se trouver sur le bureau,
echo et les fichiers qu'il contient ne doivent pas se situer dans un sous-dossier :
echo Bureau\GenProc\GenProc.
echo.
echo Veuillez deplacer le dossier GenProc qui contient les fichiers
echo directement sur votre bureau.
echo.
echo Si un remplacement de dossier est propose, acceptez.
echo Le programme va ensuite fermer, reprenez la procedure a ce moment la
echo.
echo.
echo.
pause
exit
)
cls
echo.
echo.
echo.
echo.
echo Vous etes sur le point d'executer le fichier GenProc.bat
echo.
echo.
echo Il est important de ne le lancer qu'une seule fois
echo meme si le rapport s'ouvre tres rapidement
echo dans le cas contraire vous risqueriez de fausser les resultats
echo.
echo.
echo.
echo.
echo.
echo.
echo.
echo.
pause

Rem ***crÚation de my document,copie de swreg.exe dans system32
if not exist %SystemRoot%\system32\swreg.exe copy "%CheminBatch%\outil\swreg.exe" %SystemRoot%\system32\swreg.exe >NUL
@chcp 1252>nul
cd %CheminBatch%
swreg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v "Personal" > "%CheminBatch%\path.txt"
findstr "Personal" path.txt > path2.txt
for /f "tokens=3 delims= " %%a in (path2.txt) do (set Documents=%%a)
if exist "%CheminBatch%\path?.txt" del "%CheminBatch%\path?.txt"
)
set Compte=%userprofile:~26%
set MSE=***** Copie ce qui suit dans un fichier texte et redÚmarre en mode sans Úchec comme indiquÚ ici https://docs.microsoft.com/en-us/?mfr=true (choisis ta session courante "%Compte%") *****
set ComptProc=1

if not exist %SystemRoot%\system32\swreg.exe copy "%CheminBatch%\outil\swreg.exe" %SystemRoot%\system32\swreg.exe >NUL

if exist "%CheminBatch%\outil\FixWareOutOK.txt" (
swreg query "HKLM\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces" /s | find "85.255" 2>NUL
if errorlevel 1 del "%CheminBatch%\outil\FixWareOutOK.txt"
)

Rem *** Nombre de lancements de GenProc ***
cd "%CheminBatch%\outil"
for /f %%a in ('dir /b [*].txt') do (set nbre=%%a)
set nbre2=%nbre:~1,-5%
set /a nbre3=%nbre2%+1
if exist [*].txt del [*].txt
echo. > [%nbre3%].txt

Rem *** Argument.txt ***
echo.>> "%CheminBatch%\Arguments\Argument.txt"
echo # DÚtections %date% %time% - %cd% >> "%CheminBatch%\Arguments\Argument.txt"
echo.>> "%CheminBatch%\Arguments\Argument.txt"

cls
echo.
echo [ GenProc - Narco4 ~ jean-chretien1 ]
echo.
echo.
echo.
echo.
echo.
echo.
echo.
echo.
echo Veuillez patienter pendant que le programme teste diverses infections...
echo.
echo.

Rem *** TÚlÚchargements ***

echo Rapport GenProc 0.46 [%nbre3%] effectuÚ le %date% Ó %time% - SystemRoot = %SystemRoot%>> %SystemDrive%\GenProc.txt
echo.>> %SystemDrive%\GenProc.txt

if not exist "%CheminBatch%\outil\CCleanerOK.txt" (
cd "%PROGRAMFILES%\CCleaner" 2>NUL
if not errorlevel 1 ((
echo Dans CCleaner, clique sur "Options", "AvancÚ" et dÚcoche la case "Effacer uniquement les fichiers, du dossier Temp de Windows, plus vieux que 48 heures". Par la suite, laisse-le avec ses rÚglages par dÚfaut. C'est tout.
) >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
echo CCleanerOk >> "%CheminBatch%\outil\CCleanerOK.txt"
))

if exist "%CheminBatch%\outil\FixWareOutOK.txt" (
echo ## WareOut semble toujours prÚsent, consultez le fichier journal ##>> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
)

:Telech

echo # Etape %ComptProc%/ TÚlÚcharge : >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
if not exist "%CheminBatch%\outil\CCleanerOK.txt" (
cd "%PROGRAMFILES%\CCleaner" 2>NUL
if errorlevel 1 (
type "%CheminBatch%\Canned\CCleaner_Dl.txt" >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
echo CCleanerOk >> "%CheminBatch%\outil\CCleanerOK.txt"
))

Rem *** Tests infections ***


:rustock_Test
set Comptrustock=0


if EXIST "%CheminBatch%\outil\tmp.hiv" del "%CheminBatch%\outil\tmp.hiv"
swreg add "HKLM\System\CurrentControlSet\Services\pe386" >nul
swreg save "HKLM\System\CurrentControlSet\Services\pe386" "%CheminBatch%\outil\tmp.hiv" >nul
swreg delete "HKLM\System\CurrentControlSet\Services\pe386" >nul
if NOT EXIST "%CheminBatch%\outil\tmp.hiv" (
type "%CheminBatch%\Canned\rustock_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Rootkit: le %date% Ó %time% pe386 present! >> "%CheminBatch%\Arguments\Argument.txt"
set /a Comptrustock=%Comptrustock%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto Notepad
)
if EXIST "%CheminBatch%\outil\tmp.hiv" del "%CheminBatch%\outil\tmp.hiv"
swreg add "HKLM\System\CurrentControlSet\Services\huy32" >nul
swreg save "HKLM\System\CurrentControlSet\Services\huy32" "%CheminBatch%\outil\tmp.hiv" >nul
swreg delete "HKLM\System\CurrentControlSet\Services\huy32">nul
if NOT EXIST "%CheminBatch%\outil\tmp.hiv" (
type "%CheminBatch%\Canned\rustock_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Rootkit: le %date% Ó %time% huy32 present! >> "%CheminBatch%\Arguments\Argument.txt"
set /a Comptrustock=%Comptrustock%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto Notepad
)
if EXIST "%CheminBatch%\outil\tmp.hiv" del "%CheminBatch%\outil\tmp.hiv"
swreg add "HKLM\System\CurrentControlSet\Services\lzx32" >nul
swreg save "HKLM\System\CurrentControlSet\Services\lzx32" "%CheminBatch%\outil\tmp.hiv" >nul
swreg delete "HKLM\System\CurrentControlSet\Services\lzx32" >nul
if NOT EXIST "%CheminBatch%\outil\tmp.hiv" (
type "%CheminBatch%\Canned\rustock_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Rootkit: le %date% Ó %time% lzx32 present! >> "%CheminBatch%\Arguments\Argument.txt"
set /a Comptrustock=%Comptrustock%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto Notepad
)
if EXIST "%CheminBatch%\outil\tmp.hiv" del "%CheminBatch%\outil\tmp.hiv"
swreg add "HKLM\System\CurrentControlSet\Services\msguard" >nul
swreg save "HKLM\System\CurrentControlSet\Services\msguard" "%CheminBatch%\outil\tmp.hiv" >nul
swreg delete "HKLM\System\CurrentControlSet\Services\msguard" >nul
if NOT EXIST "%CheminBatch%\outil\tmp.hiv" (
type "%CheminBatch%\Canned\rustock_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Rootkit: le %date% Ó %time% msguard present! >> "%CheminBatch%\Arguments\Argument.txt"
set /a Comptrustock=%Comptrustock%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto Notepad
)
if EXIST "%CheminBatch%\outil\tmp.hiv" del "%CheminBatch%\outil\tmp.hiv"



:Bagle_Test
set ComptBagle=0

if exist "%SystemRoot%\system32\wintems.exe" (
type "%CheminBatch%\Canned\Bagle_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Bagle:le %date% Ó %time% %SystemRoot%\system32\wintems.exe >> "%CheminBatch%\Arguments\Argument.txt"
set /a ComptBagle=%ComptBagle%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto Notepad
)
if exist "%SystemRoot%\system32\hldrrr.exe" (
type "%CheminBatch%\Canned\Bagle_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Bagle:le %date% Ó %time% %SystemRoot%\system32\hldrrr.exe >> "%CheminBatch%\Arguments\Argument.txt"
set /a ComptBagle=%ComptBagle%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto Notepad
)
cd "%APPDATA%\hidires" 2>NUL
if not errorlevel 1 (
type "%CheminBatch%\Canned\Bagle_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Bagle:le %date% Ó %time% %APPDATA%\hidires >> "%CheminBatch%\Arguments\Argument.txt"
set /a ComptBagle=%ComptBagle%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto Notepad
)
cd "%SystemRoot%\exefld" 2>NUL
if not errorlevel 1 (
type "%CheminBatch%\Canned\Bagle_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Bagle:le %date% Ó %time% %SystemRoot%\exefld >> "%CheminBatch%\Arguments\Argument.txt"
set /a ComptBagle=%ComptBagle%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto Notepad
)

:WareOut_Test
set ComptWareOut=0

if exist "%CheminBatch%\outil\FixWareOutOK.txt" (
for /f "tokens=8 delims=\" %%a in ('reg query "HKLM\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces"'
) do (
swreg query "HKLM\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\%%a" /s | find "85.255" 2>NUL
if not errorlevel 1 (
echo WareOut:le %date% Ó %time% >> "%CheminBatch%\Arguments\Argument.txt"
echo [HKLM\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\%%a] >>"%CheminBatch%\Arguments\Argument.txt"
reg query "HKLM\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\%%a" /s | find "85.255" >>"%CheminBatch%\Arguments\Argument.txt"
)
goto Haxfix_Test
))
swreg query "HKLM\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces" /s | find /i "85.255" 2>NUL
if not errorlevel 1 (
type "%CheminBatch%\Canned\FixWareOut_Dl.txt" >> %SystemDrive%\GenProc.txt
echo WareOut:le %date% Ó %time% HKLM\....\85.255... >> "%CheminBatch%\Arguments\Argument.txt"
set /a ComptWareOut=%ComptWareOut%+1
echo WareOut >> "%CheminBatch%\outil\FixWareOutOK.txt"
goto Notepad
)
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins" 2>NUL
if not errorlevel 1 (
type "%CheminBatch%\Canned\FixWareOut_Dl.txt" >> %SystemDrive%\GenProc.txt
echo WareOut:le %date% Ó %time% HKLM\....\ruins >> "%CheminBatch%\Arguments\Argument.txt"
set /a ComptWareOut=%ComptWareOut%+1
echo WareOut >> "%CheminBatch%\outil\FixWareOutOK.txt"
goto Notepad
)
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls" 2>NUL
if not errorlevel 1 (
type "%CheminBatch%\Canned\FixWareOut_Dl.txt" >> %SystemDrive%\GenProc.txt
echo WareOut:le %date% Ó %time% HKLM\....\Urls >> "%CheminBatch%\Arguments\Argument.txt"
set /a ComptWareOut=%ComptWareOut%+1
echo WareOut >> "%CheminBatch%\outil\FixWareOutOK.txt"
goto Notepad
)

:Haxfix_Test
set ComptHaxfix=0
if exist "%CheminBatch%\outil\HaxfixOK.txt" goto lop_test

if exist "%SystemRoot%\userinit.exe" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\userinit.exe >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\agpbrdg0.dll" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\agpbrdg0.dll >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\armdvc.sys" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\armdvc.sys >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\arprmdg0.dll" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\arprmdg0.dll >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\asusrx20.dll" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\asusrx20.dll >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\avload32.dll" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\avload32.dll >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\avpe32.dll" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\avpe32.dll >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\avpe64.sys" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\avpe64.sys >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\avpi32.dll" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\avpi32.dll >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\avpp32.dll" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\avpp32.dll >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\avpu32.dll" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\avpu32.dll >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\avpx32.dll" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\avpx32.dll >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\axdebugl?.???" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\axdebugl?.??? >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\axxt32.dll" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\axxt32.dll >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\bmtdhh.dll" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\bmtdhh.dll >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\bmtdhk.sys" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\bmtdhk.sys >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\bt848rom.dll" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\bt848rom.dll >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\cdscsix3.dll" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\cdscsix3.dll >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\cdscsix3r.sys" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\cdscsix3r.sys >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\cert32.dll" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\cert32.dll >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\cpudev.sys" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\cpudev.sys >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\CsdDriver.sys" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\CsdDriver.sys >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\ddirectxt.sys" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\ddirectxt.sys >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\ddirectz.dll" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\ddirectz.dll >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\debugg.dll" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\debugg.dll >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\directprt.sys" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\directprt.sys >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\directpt.dll" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\directpt.dll >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\directut.dll" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\directut.dll >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\docent0.dll" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\docent0.dll >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\docent2.dll" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\docent2.dll >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\dvb03a.dll" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\dvb03a.dll >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\dvd4free.dll" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\dvd4free.dll >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\dxtpdh.sys" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\dxtpdh.sys >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\dxtpdx.dll" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\dxtpdx.dll >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\dxtpdx.sys" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\dxtpdx.sys >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\eetvpn.dll" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\eetvpn.dll >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\eexvpn.sys" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\eexvpn.sys >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\emldvc.dll" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\emldvc.dll >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\emul37.sys" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\emul37.sys >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\emul65.dll" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\emul65.dll >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\emul65.sys" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\emul65.sys >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\epsn2sys.sys" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\epsn2sys.sys >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\epsonsys.sys" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\epsonsys.sys >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\extfpu.dll" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\extfpu.dll >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\extxerox.dll" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\extxerox.dll >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\fanxctrl.dll" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\fanxctrl.dll >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\flashdrvr.dll" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\flashdrvr.dll >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\fuxx32.dll" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\fuxx32.dll >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\gatexkey.dll" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\gatexkey.dll >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\gdiwxp.dll" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\gdiwxp.dll >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\gdwxp3.dll" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\gdwxp3.dll >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\hpprintdrv.sys" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\hpprintdrv.sys >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\hpprintx.dll" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\hpprintx.dll >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\ideusr50.dll" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\ideusr50.dll >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\ies4dll.dll" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\ies4dll.dll >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\iesdl4l.dll" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\iesdl4l.dll >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\ipudpb2.sys" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\ipudpb2.sys >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\k53lock.sys" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\k53lock.sys >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\ke7dnl.sys" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\ke7dnl.sys >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\kednld.sys" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\kednld.sys >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\ksapgh.dll" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\ksapgh.dll >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\lanH32.dll" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\lanH32.dll >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\lanH64.sys" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\lanH64.sys >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\lanmui.dll" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\lanmui.dll >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\lannui.sys" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\lannui.sys >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\lgn1216a.dll" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\lgn1216a.dll >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\logon032.dll" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\logon032.dll >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\logon16x.dll" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\logon16x.dll >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\lsd_f3.dll" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\lsd_f3.dll >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\mcfCC4.dll" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\mcfCC4.dll >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\mcfdrv.sys" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\mcfdrv.sys >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\mcfG7A.dll" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\mcfG7A.dl >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\mdfpro.dll" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\mdfpro.dll >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\MemMan.dll" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\MemMan.dll >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\mi5035a0.dll" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\mi5035a0.dll >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\mi5035a5.sys" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\mi5035a5.sys >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\mm77lgn.sys" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\mm77lgn.sys >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\mmccrd.sys" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\mmccrd.sys >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\mmcdll.dll" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\mmcdll.dll >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\mmx17g.dll" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\mmx17g.dll >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\mmx19g.sys" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\mmx19g.sys >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\mmx19g.sys" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\mmx19g.sys >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\mmx432.dll" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\mmx432.dll >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\mmx464.sys" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\mmx464.sys >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\mmx4xm.sys" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\mmx4xm.sys >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\mmx4xt.dll" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\mmx4xt.dll >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\mmxeroxk.dll" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\mmxeroxk.dll >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\mmxF32.dll" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\mmxF32.dll >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\mmxF64.sys" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\mmxF64.sys >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\MSplg7.dll" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\MSplg7.dll >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\msrdr2.sys" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\msrdr2.sys >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\msvcrl.dll" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\msvcrl.dll >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\nclaby.sys" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\nclaby.sys >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\nclabydll.dll" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\nclabydll.dll >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %SystemDrive%\GenProc.txt
echo. >> %SystemDrive%\GenProc.txt
goto lop_Test
)
if exist "%SystemRoot%\System32\nkcfg.sys" (
type "%CheminBatch%\Canned\Haxfix_Dl.txt" >> %SystemDrive%\GenProc.txt
echo Haxdoor:le %date% Ó %time% %SystemRoot%\System32\nkcfg.sys >> "%CheminBatch%\Arguments\Argument.txt"
echo Haxfix >> "%CheminBatch%\outil\HaxfixOK.txt"
set /a ComptHaxfix=%ComptHaxfix%+1
echo. >> %System

Rapport lopxpMH2 version 2.0 fait à 10:54:49,06 le 20/04/2007
C:\Documents and Settings\isabelle coutand\Bureau\lopxpMH2

******************************************
## Répertoires Application Data

Le volume dans le lecteur C s'appelle 456517
Le numéro de série du volume est 3818-B19C

Répertoire de C:\Documents and Settings\All Users\Application Data

27/06/2006 07:40 <REP> .
27/06/2006 07:40 <REP> ..
30/03/2007 14:19 <REP> Adobe
10/04/2007 11:00 <REP> BVRP Software
07/11/2006 15:19 <REP> dalesectclockcreative
08/11/2006 00:10 <REP> Google
07/11/2006 18:57 <REP> Messenger Plus!
27/06/2006 07:40 <REP> Microsoft
10/11/2006 14:11 <REP> QuickTime
27/06/2006 06:29 <REP> SBSI
01/12/2006 20:14 <REP> SBT
18/04/2007 15:02 <REP> Spybot - Search & Destroy
11/11/2006 15:58 <REP> Ulead Systems
08/11/2006 23:31 <REP> Windows Genuine Advantage
16/04/2007 18:41 <REP> Yahoo! Companion
27/06/2006 07:41 62 desktop.ini
10/11/2006 14:29 212 hpzinstall.log
2 fichier(s) 274 octets
15 Rép(s) 139 929 169 920 octets libres
Le volume dans le lecteur C s'appelle 456517
Le numéro de série du volume est 3818-B19C

Répertoire de C:\Documents and Settings\Custom

Le volume dans le lecteur C s'appelle 456517
Le numéro de série du volume est 3818-B19C

Répertoire de C:\Documents and Settings\Default User\Application Data

27/06/2006 07:40 <REP> .
27/06/2006 07:40 <REP> ..
07/11/2006 13:30 <REP> Identities
07/11/2006 13:30 <REP> Macromedia
27/06/2006 07:40 <REP> Microsoft
27/06/2006 07:41 62 desktop.ini
1 fichier(s) 62 octets
5 Rép(s) 139 929 169 920 octets libres
Le volume dans le lecteur C s'appelle 456517
Le numéro de série du volume est 3818-B19C

Répertoire de C:\Documents and Settings\Default User\Local Settings\Application Data

27/06/2006 07:41 <REP> .
27/06/2006 07:41 <REP> ..
07/11/2006 13:30 <REP> ApplicationHistory
27/06/2006 05:47 <REP> Microsoft
07/11/2006 13:30 135 fusioncache.dat
07/11/2006 13:30 12 328 GDIPFONTCACHEV1.DAT
07/11/2006 13:30 2 155 286 IconCache.db
3 fichier(s) 2 167 749 octets
4 Rép(s) 139 929 169 920 octets libres
Le volume dans le lecteur C s'appelle 456517
Le numéro de série du volume est 3818-B19C

Répertoire de C:\Documents and Settings\Help

Le volume dans le lecteur C s'appelle 456517
Le numéro de série du volume est 3818-B19C

Répertoire de C:\Documents and Settings\images

Le volume dans le lecteur C s'appelle 456517
Le numéro de série du volume est 3818-B19C

Répertoire de C:\Documents and Settings\Inf

Le volume dans le lecteur C s'appelle 456517
Le numéro de série du volume est 3818-B19C

Répertoire de C:\Documents and Settings\isabelle coutand\Application Data

07/11/2006 13:30 <REP> .
07/11/2006 13:30 <REP> ..
14/11/2006 15:05 <REP> Adobe
27/12/2006 14:04 <REP> AdobeUM
12/11/2006 00:30 <REP> DivX
08/11/2006 00:10 <REP> Google
07/11/2006 14:27 <REP> Help
10/11/2006 14:37 <REP> Hewlett-Packard
07/11/2006 13:30 <REP> Identities
11/11/2006 15:51 <REP> InterVideo
03/03/2007 19:59 <REP> Lavasoft
30/03/2007 14:43 <REP> Leadertech
07/11/2006 13:30 <REP> Macromedia
12/11/2006 00:39 <REP> Media Player Classic
07/11/2006 13:30 <REP> Microsoft
01/12/2006 20:08 <REP> Microsoft Web Folders
12/11/2006 00:26 <REP> Mozilla
07/11/2006 14:40 <REP> MSNInstaller
13/03/2007 18:30 <REP> Screenshot Sender
10/11/2006 23:52 <REP> Shareaza
07/11/2006 15:19 <REP> sign once mail
29/03/2007 18:36 <REP> Sun
06/04/2007 13:35 <REP> Talkback
14/11/2006 17:14 <REP> vlc
07/11/2006 13:30 62 desktop.ini
1 fichier(s) 62 octets
24 Rép(s) 139 929 165 824 octets libres
Le volume dans le lecteur C s'appelle 456517
Le numéro de série du volume est 3818-B19C

Répertoire de C:\Documents and Settings\isabelle coutand\Local Settings\Application Data

07/11/2006 13:30 <REP> .
07/11/2006 13:30 <REP> ..
14/11/2006 15:05 <REP> Adobe
07/11/2006 13:30 <REP> ApplicationHistory
10/04/2007 11:03 <REP> BVRP Software
08/11/2006 00:10 <REP> Google
07/11/2006 14:27 <REP> Help
08/11/2006 13:26 <REP> Identities
07/11/2006 13:30 <REP> Microsoft
12/11/2006 00:27 <REP> Mozilla
10/11/2006 23:52 <REP> Shareaza
12/11/2006 00:36 <REP> WMTools Downloaded Files
11/11/2006 01:51 49 152 DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
07/11/2006 13:30 139 fusioncache.dat
07/11/2006 13:30 8 224 GDIPFONTCACHEV1.DAT
07/11/2006 13:30 5 357 760 IconCache.db
4 fichier(s) 5 415 275 octets
12 Rép(s) 139 929 165 824 octets libres
Le volume dans le lecteur C s'appelle 456517
Le numéro de série du volume est 3818-B19C

Répertoire de C:\Documents and Settings\LocalService\Application Data

27/06/2006 05:50 <REP> .
27/06/2006 05:50 <REP> ..
27/06/2006 05:50 <REP> Microsoft
0 fichier(s) 0 octets
3 Rép(s) 139 929 165 824 octets libres
Le volume dans le lecteur C s'appelle 456517
Le numéro de série du volume est 3818-B19C

Répertoire de C:\Documents and Settings\LocalService\Local Settings\Application Data

27/06/2006 05:50 <REP> .
27/06/2006 05:50 <REP> ..
27/06/2006 05:50 <REP> Microsoft
0 fichier(s) 0 octets
3 Rép(s) 139 929 165 824 octets libres
Le volume dans le lecteur C s'appelle 456517
Le numéro de série du volume est 3818-B19C

Répertoire de C:\Documents and Settings\media

Le volume dans le lecteur C s'appelle 456517
Le numéro de série du volume est 3818-B19C

Répertoire de C:\Documents and Settings\NetworkService\Application Data

27/06/2006 05:50 <REP> .
27/06/2006 05:50 <REP> ..
27/06/2006 05:50 <REP> Microsoft
0 fichier(s) 0 octets
3 Rép(s) 139 929 165 824 octets libres
Le volume dans le lecteur C s'appelle 456517
Le numéro de série du volume est 3818-B19C

Répertoire de C:\Documents and Settings\NetworkService\Local Settings\Application Data

27/06/2006 05:50 <REP> .
27/06/2006 05:50 <REP> ..
27/06/2006 05:50 <REP> Microsoft
0 fichier(s) 0 octets
3 Rép(s) 139 929 165 824 octets libres
Le volume dans le lecteur C s'appelle 456517
Le numéro de série du volume est 3818-B19C

Répertoire de C:\Documents and Settings\Rings

Le volume dans le lecteur C s'appelle 456517
Le numéro de série du volume est 3818-B19C

Répertoire de C:\Documents and Settings\Samples

Le volume dans le lecteur C s'appelle 456517
Le numéro de série du volume est 3818-B19C

Répertoire de C:\Documents and Settings\Skins

Le volume dans le lecteur C s'appelle 456517
Le numéro de série du volume est 3818-B19C

Répertoire de C:\Documents and Settings\Sync

Le volume dans le lecteur C s'appelle 456517
Le numéro de série du volume est 3818-B19C

Répertoire de C:\Documents and Settings\Venturi

Le volume dans le lecteur C s'appelle 456517
Le numéro de série du volume est 3818-B19C

Répertoire de C:\Documents and Settings\widcomm

Le volume dans le lecteur C s'appelle 456517
Le numéro de série du volume est 3818-B19C

Répertoire de C:\WINDOWS\system32\config\systemprofile\Application Data

27/06/2006 05:49 <REP> .
27/06/2006 05:49 <REP> ..
07/11/2006 13:30 <REP> Identities
07/11/2006 13:30 <REP> Macromedia
27/06/2006 05:49 <REP> Microsoft
27/06/2006 05:49 62 desktop.ini
1 fichier(s) 62 octets
5 Rép(s) 139 929 161 728 octets libres
Le volume dans le lecteur C s'appelle 456517
Le numéro de série du volume est 3818-B19C

Répertoire de C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data

27/06/2006 05:49 <REP> .
27/06/2006 05:49 <REP> ..
07/11/2006 13:30 <REP> ApplicationHistory
27/06/2006 05:49 <REP> Microsoft
07/11/2006 13:30 135 fusioncache.dat
07/11/2006 13:30 12 328 GDIPFONTCACHEV1.DAT
07/11/2006 13:30 2 155 286 IconCache.db
3 fichier(s) 2 167 749 octets
4 Rép(s) 139 929 161 728 octets libres

******************************************
Recherche des taches planifiées dans C:\WINDOWS\tasks


C:\WINDOWS\Tasks\AE1AB316918123C2.job


n!¥0L³¹
Aö£lÅF î <
s  "€!×    8 c : \ d o c u m e ~ 1 \ i s a b e l ~ 1 \ a p p l i c ~ 1 \ s i g n o n ~ 1 \ C h i n e n c g p l . e x e  i s a b e l l e c o u t a n d 
0 Ë   <



C:\WINDOWS\Tasks\HP
HP inexploitable


C:\WINDOWS\Tasks\HP
HP inexploitable

******************************************
## Répertoires de C:\Program Files

Le volume dans le lecteur C s'appelle 456517
Le numéro de série du volume est 3818-B19C

Répertoire de C:\Program Files

19/04/2007 20:21 <REP> .
19/04/2007 20:21 <REP> ..
02/04/2007 12:47 <REP> Adobe
07/11/2006 15:22 <REP> Adverts
07/11/2006 14:47 <REP> Alwil Software
08/03/2007 18:09 <REP> Casperlab Software
16/04/2007 18:16 <REP> CCleaner
27/06/2006 05:45 <REP> ComPlus Applications
12/11/2006 00:56 <REP> DivX
04/03/2007 13:45 <REP> eMule
03/04/2007 18:13 <REP> Fichiers communs
20/01/2007 15:04 <REP> GameSpy Arcade
29/01/2007 10:20 <REP> Google
10/11/2006 14:34 <REP> Hewlett-Packard
10/11/2006 14:34 <REP> HP
15/02/2007 16:30 <REP> Internet Explorer
11/11/2006 15:52 <REP> InterVideo
07/11/2006 14:11 <REP> Inventel
01/03/2007 15:39 <REP> Java
11/11/2006 15:18 <REP> K-Lite Codec Pack
18/04/2007 13:47 <REP> Lavasoft
01/03/2007 15:39 <REP> LimeWire
10/04/2007 11:01 <REP> LiveUpdate
07/11/2006 22:13 <REP> Logitech
26/02/2007 20:02 <REP> Ludiclub
27/06/2006 06:27 <REP> Messenger
13/03/2007 18:30 <REP> Messenger Plus! Live
07/11/2006 15:22 <REP> MessengerPlus! 3
01/12/2006 20:13 <REP> microsoft frontpage
01/12/2006 20:14 <REP> Microsoft Office
01/12/2006 20:10 <REP> Microsoft Visual Studio
27/06/2006 05:45 <REP> Movie Maker
20/04/2007 10:25 <REP> Mozilla Firefox
07/11/2006 14:39 <REP> MSN
07/11/2006 15:12 <REP> MSN Apps
27/06/2006 05:44 <REP> MSN Gaming Zone
13/03/2007 18:30 <REP> MSN Messenger
18/11/2006 04:01 <REP> MSXML 4.0
27/06/2006 05:45 <REP> NetMeeting
27/06/2006 05:44 <REP> Online Services
15/12/2006 17:09 <REP> Outlook Express
10/11/2006 14:18 <REP> QuickTime
07/11/2006 13:30 <REP> Raccourcis de programmes
09/11/2006 17:52 <REP> Securitoo
27/06/2006 05:46 <REP> Services en ligne
13/03/2007 18:30 <REP> sign once mail
01/12/2006 20:14 <REP> Snapshot Viewer
18/04/2007 15:09 <REP> Spybot - Search & Destroy
14/11/2006 17:14 <REP> VideoLAN
20/04/2007 10:24 <REP> Wanadoo
30/03/2007 15:03 <REP> Windows Media Connect 2
13/01/2007 18:54 <REP> Windows Media Player
27/06/2006 05:44 <REP> Windows NT
27/06/2006 05:47 <REP> xerox
16/04/2007 18:15 <REP> Yahoo!
0 fichier(s) 0 octets
55 Rép(s) 139 929 165 824 octets libres

******************************************
## Popups autorisées

* Internet Explorer

! REG.EXE VERSION 3.0

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\New Windows\Allow

* Mozilla Firefox (1 autorisé 2 interdit)

---------- C:\DOCUMENTS AND SETTINGS\ISABELLE COUTAND\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\YCR15IRJ.DEFAULT\HOSTPERM.1

******************************************
## Registre

* [HKEY_CURRENT_USER\\Software\Microsoft\Internet Explorer\Main]
Search Bar REG_SZ http://www.google.com/toolbar/ie8/sidebar.html

* [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
Clock Creative That Okay REG_SZ C:\Documents and Settings\All Users\Application Data\dalesectclockcreative\Dart Slow.exe

* [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
Play math REG_SZ C:\DOCUME~1\ISABEL~1\APPLIC~1\SIGNON~1\plan rect.exe

******************************************
## Zones de sécurité

* HKCU Domains (4)

* P3P History (5)

******************************************
## Recherche C:\WINDOWS\*.htm, "C:\WINDOWS\*.gif"


*************** Fin du rapport ****************

par contre je n'arrive pas a avoir le rapport genproc

enfete je crois ke g rien compris ?!?
mon ordi a des virus, il rame et en plus il ya kelkun ki fe des commande de viagras sur mon ordi !!!!
kece ke je peut faire pliz, merci d avance ...

papyber, je te remercie pour l'aide que tu m'aporte, j'ai effectué les manipe que tu m'as dit, je n'ai plus de virus qui apparait quand je demarre mon ordi mai j'ai toujours les deux fenetres qui souvre


desktop.ini et le message dedans : [.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787


et desktop.ini et le message : [.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787

et j'ai aussi le resseau local 4 qui est non branché c apparu quan je me sui connecté (estce que c normal?)

merci encore pour ton aide.


ci joint mon rapport :

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 17:57:42, on 20/04/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\WINDOWS\system32\hphmon05.exe
C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Messenger\Msmsgs.exe
C:\WINDOWS\System32\NOTEPAD.EXE
C:\WINDOWS\System32\NOTEPAD.EXE
C:\WINDOWS\System32\FTRTSVC.exe
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\PROGRA~1\Wanadoo\Watch.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\isabelle coutand\Bureau\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - (no file)
O2 - BHO: (no name) - {1557B435-8242-4686-9AA3-9265BF7525A4} - C:\WINDOWS\system32\ktyxtjtf.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {733FD72F-103E-4B9E-BCB9-A76064AF3C72} - C:\WINDOWS\system32\khfdedb.dll (file missing)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O2 - BHO: (no name) - {D67CEE81-E659-4505-92A4-DC1192975D99} - C:\WINDOWS\system32\osouwlqe.dll
O2 - BHO: (no name) - {F9CD9132-3371-458F-BE86-02E8F526A918} - C:\WINDOWS\system32\ssqpn.dll (file missing)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [Muscbrigade] c:\Musicbrigade\Musicbrigade.exe check
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [Clock Creative That Okay] C:\Documents and Settings\All Users\Application Data\dalesectclockcreative\Dart Slow.exe
O4 - HKLM\..\Run: [WinFlyer32.dll] "rundll32.exe" C:\WINDOWS\system32\WinFlyer32.dll,Run
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [fsc-reminder.exe] C:\WINDOWS\reminder\fsc-reminder.exe 2454047 6
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [Play math] C:\DOCUME~1\ISABEL~1\APPLIC~1\SIGNON~1\plan rect.exe
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\Msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: @c:\Program Files\Messenger\Msgslang.dll,-61144 - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @c:\Program Files\Messenger\Msgslang.dll,-61144 - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C9DE252F-2880-4898-BC96-0C1C1A1DED70}: NameServer = 192.168.1.1
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Fax - Unknown owner - C:\WINDOWS\system32\fxssvc.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe
O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe

pour papyber :

encore dsl mais c la 1er fois ke je v sur un forum je ne metrise pas encore...
je poste d'ou ?
et merci "pour polo"

voici les rapports :

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 19:11:45, on 20/04/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\WINDOWS\system32\hphmon05.exe
C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Messenger\Msmsgs.exe
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Documents and Settings\isabelle coutand\Bureau\HiJackThis_v2.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\Wanadoo\Watch.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZENG09.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O2 - BHO: (no name) - {D67CEE81-E659-4505-92A4-DC1192975D99} - C:\WINDOWS\system32\osouwlqe.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [Muscbrigade] c:\Musicbrigade\Musicbrigade.exe check
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [WinFlyer32.dll] "rundll32.exe" C:\WINDOWS\system32\WinFlyer32.dll,Run
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [fsc-reminder.exe] C:\WINDOWS\reminder\fsc-reminder.exe 2454047 6
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\Msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: @c:\Program Files\Messenger\Msgslang.dll,-61144 - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @c:\Program Files\Messenger\Msgslang.dll,-61144 - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C9DE252F-2880-4898-BC96-0C1C1A1DED70}: NameServer = 192.168.1.1
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Fax - Unknown owner - C:\WINDOWS\system32\fxssvc.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe
O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe

bonjour papyber, je n'ai pas reussi a avoir le rapport vundofix.

voici le rapport hijackthis :

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 17:41:44, on 21/04/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\WINDOWS\system32\hphmon05.exe
C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Messenger\Msmsgs.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\PROGRA~1\Wanadoo\Watch.exe
C:\WINDOWS\system32\svchost.exe
C:\Documents and Settings\isabelle coutand\Bureau\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O2 - BHO: (no name) - {D67CEE81-E659-4505-92A4-DC1192975D99} - C:\WINDOWS\system32\osouwlqe.dll (file missing)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [Muscbrigade] c:\Musicbrigade\Musicbrigade.exe check
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [WinFlyer32.dll] "rundll32.exe" C:\WINDOWS\system32\WinFlyer32.dll,Run
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [fsc-reminder.exe] C:\WINDOWS\reminder\fsc-reminder.exe 2454047 6
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\Msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: @c:\Program Files\Messenger\Msgslang.dll,-61144 - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @c:\Program Files\Messenger\Msgslang.dll,-61144 - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C9DE252F-2880-4898-BC96-0C1C1A1DED70}: NameServer = 192.168.1.1
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Fax - Unknown owner - C:\WINDOWS\system32\fxssvc.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe
O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe

bonjour voici le rapport :

This action will cancel the scan
Are you sure you want to cancel the scan?

Español | English Sign in | Sign up | My account | Exit Home| What is TotalScan?| My opinion| FAQ Quick scan: Searching for malicious software
Scanning
Searching 881,531 viruses, spyware, Trojans and other threats. It also uses heuristic technologies to detect unknown viruses.

100%


Item in progress:
Items scanned:
3807

Viruses, spyware, Trojans... detected:
4

Suspicious files detected:
1

Results
Suspicious files detected
There is no detected any viruses, spyware, Trojans, or any other ACTIVE or LATENT threats in your PC. However, cookies have been detected that could be spying on your PC.
1 suspicious file
We detected that avast! antivirus 4.7.986 [VPS 000735-1] is disabled.
El texto que corresponda en cada momento

It seems that you have registered previously and your account is still active. You cannot register again with the same account. Enter your account using your email address and password. Forgotten your password?

Email address
Mandatory

Password
Mandatory

Repeat password
Mandatory

Remember my email and password

Yes, I want to receive marketing information from Panda Software and/or its International Representatives via email or other equivalent forms of electronic communication.
No, I don't want to receive marketing information from Panda Software and/or its International Representatives via email or other equivalent forms of electronic communication.
Have you forgotten your data access?

You have not registered yet? Register now FREE

After a quick scan of your PC, we have not detected any ACTIVE or LATENT malicious software.
< Back to home
Scan details
High danger level (0)

Medium danger level (0)

Low danger level (4)
Cookie/Doublec... Tracking Cookie Latent Show + Info
C:\Documents and Settings...outand@doubleclick[2].txt
Cookie/Atlas D... Tracking Cookie Latent Show + Info
C:\Documents and Settings...elle coutand@atdmt[2].txt
Cookie/Weboram... Tracking Cookie Latent Show + Info
C:\Documents and Settings...e coutand@weborama[1].txt
Cookie/Mediapl... Tracking Cookie Latent Show + Info
C:\Documents and Settings... coutand@mediaplex[1].txt

Do you want to disinfect? You must be a registered user

Register free or ENTER in your account you are registered as a user

<<
1
2
3
4
5
>>

Suspicious files (1)
C:\WINDOWS\SYSTEM32\WINFLYER32.DLL

<<
1
2
3
4
5
>>
Recommendations
Disinfect
Send suspicious files to laboratory
Install permanent protection
Enable your permanent protection

We detected that avast! antivirus 4.7.986 [VPS 000735-1] is disabled.
Update your permanent protection

You should periodically carry out a FULL scan of your PC with TotalScan. In this way you will reduce the chances of infection.

How can I do this?


El % of other users' computers were infected and we have disinfected %
Check the Key features and the minimum requirementsUse of TotalScan is subject to acceptance of the Terms and conditions of use
This is a Panda project

bonjour papyber, je n'arrive pas a supprimer se que tu m 'as demandé

il marque accés refusé, verifier que le disque n'est pas plein ou protégé en ecriture, et que le fichier n'est pas utilisé actuellement.

j'ai fait en mode sans echec et j'ai reussi et quan j'ai ralumé mon ordi les deux fenetres "bloc notes sont toujours" et en plus j'ai une fenetre qui m'indique que winflyer32.dll le module est introuvables.

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 18:58:41, on 23/04/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\WINDOWS\system32\hphmon05.exe
C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Messenger\Msmsgs.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Wanadoo\GestionnaireInternet.exe
C:\Program Files\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\Program Files\Wanadoo\Watch.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\isabelle coutand\Bureau\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [Muscbrigade] c:\Musicbrigade\Musicbrigade.exe check
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [WinFlyer32.dll] "rundll32.exe" C:\WINDOWS\system32\WinFlyer32.dll,Run
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [fsc-reminder.exe] C:\WINDOWS\reminder\fsc-reminder.exe 2454047 6
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\Msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: @c:\Program Files\Messenger\Msgslang.dll,-61144 - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @c:\Program Files\Messenger\Msgslang.dll,-61144 - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} (Installer Class) - https://www.pandasecurity.com/en/homeusers/online-antivirus/?ref=activescan
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C9DE252F-2880-4898-BC96-0C1C1A1DED70}: NameServer = 192.168.1.1
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Fax - Unknown owner - C:\WINDOWS\system32\fxssvc.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe
O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe

j'ai toujour les deux fenetres bloc notes qui apparait mais put celle qui me dit que winflyer 32 est introuvable

bonjour, voila ce que dise les fenetres


[.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787



[.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787

c deux fenetres differente mais il y a le meme message!!!!

jai effectué les manipe; et quand jai rallumer mon ordi aucune des fenetres non apparu c'est super!!! merci encore pour ton aide sans toi j'y serai jamais arrivé.

j'ai effectué se que tu m'as dit, je te remercie encore pour ton aide et tes conseils. @+