Pub cid

Salut

Télécharge ceci: (by Moe)
http://sosvirus.changelog.fr/Green_day/Lopxp.exe

Lance Lopxp.bat.
Au menu, choisis l'option 1 "Rechercher / Générer un rapport"
Patiente et lorsque l'on te demande d'appuyer sur une touche, appuie.
Ensuite, le rapport s'ouvre, copie colle le en entier sur le forum.

++

Salut green day
Je te remercie pour ton aide et j'ai suivi ton conseil , j'ai lancé LOPXP.
voici le rapport :
+

_____________ Rapport Lopxp fait le 26/06/2007 à 18:30:59,78 _______________

/!\ Attention /!\

Les résultats de ce rapport sont sujets à interprétations,
Et ne démontrent pas systématiquement des dossiers infectés...

_________________________ Recherche prédéterminé __________________________

_________________________ Recherche heuristique __________________________

C:\Documents and Settings\All Users\Application Data\Load Vc User Thunk
C:\Documents and Settings\fred\Application Data\Flap Defy Soft
C:\Program Files\Flap Defy Soft

___________________________ Tâches planifiées _____________________________

Tâche cachée à l'utilistateur:

C:\WINDOWS\tasks\A6B91C9190D69B69.job
/!\ Fichier lancé: c:\docume~1\fred\applic~1\flapde~1\SeekWinCreative.exe Suspect !

Listing de toutes les tâches planifiées:

A6B91C9190D69B69.job: c:\docume~1\fred\applic~1\flapde~1\SeekWinCreative.exe
HPpromotions journeysoftware.job: C:\Program Files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe /N "journeysoftware" -r

__________ Détection des paramètres de désinstallation du sponsor _________

Sponsor P2P:

Sponsor MSN+:

__________________ Listing des dossiers Application Data __________________

C:\Documents and Settings\All Users\Application Data

Date/heure Création Nom court Nom long

22/06/2007 à 01:22 | LOADVC~1 Load Vc User Thunk
22/06/2007 à 01:22 | MESSEN~1 Messenger Plus!
07/02/2007 à 08:24 | Adobe
27/11/2006 à 17:48 | WINDOW~1 Windows Genuine Advantage
23/11/2006 à 02:39 | YAHOO!~1 Yahoo! Companion
20/11/2006 à 17:17 | Prism
11/02/2006 à 21:07 | HP
21/01/2006 à 02:41 | APPLEC~1 Apple Computer
20/01/2006 à 18:40 | BLUETO~1 Bluetooth
04/11/2005 à 01:01 | Motive
21/02/2005 à 23:51 | SPYBOT~1 Spybot - Search & Destroy
03/01/2005 à 22:24 | Visio
02/12/2004 à 21:27 | NPF
02/12/2004 à 20:59 | Ahead
10/09/2004 à 03:26 | SBSI
10/09/2004 à 03:26 | MICROS~1 Microsoft

C:\Documents and Settings\florian\Application Data

Date/heure Création Nom court Nom long

23/05/2007 à 15:41 | ItsLabel
11/12/2006 à 22:38 | iMesh
02/09/2006 à 12:56 | APPLEC~1 Apple Computer
11/02/2005 à 02:25 | MSNINS~1 MSNInstaller
13/01/2005 à 14:12 | MACROM~1 Macromedia
03/01/2005 à 22:17 | Visio
31/12/2004 à 01:26 | Template
26/12/2004 à 20:01 | Mozilla
26/12/2004 à 17:45 | Creative
23/12/2004 à 17:59 | Real
21/12/2004 à 17:00 | INTERV~1 InterVideo
21/12/2004 à 16:33 | AdobeUM
21/12/2004 à 16:32 | Adobe
21/12/2004 à 16:17 | Help
21/12/2004 à 16:15 | IDENTI~1 Identities
21/12/2004 à 16:15 | MICROS~1 Microsoft
21/12/2004 à 16:15 | Sun

C:\Documents and Settings\florian\Local Settings\Application Data

Date/heure Création Nom court Nom long

03/02/2007 à 03:37 | Google
12/02/2006 à 03:50 | HP
12/02/2006 à 03:48 | APPLIC~1 ApplicationHistory
07/02/2006 à 22:07 | APPLEC~1 Apple Computer
13/12/2005 à 15:49 | MUSICM~1 Musicmatch
06/11/2005 à 20:56 | IM
03/01/2005 à 22:27 | Visio
29/12/2004 à 20:16 | Ahead
25/12/2004 à 17:29 | IDENTI~1 Identities
21/12/2004 à 16:33 | Adobe
21/12/2004 à 16:17 | Help
21/12/2004 à 16:15 | MICROS~1 Microsoft
21/12/2004 à 16:15 | {7148F~1 {7148F0A6-6813-11D6-A77B-00B0D0142030}

C:\Documents and Settings\fred\Application Data

Date/heure Création Nom court Nom long

22/06/2007 à 01:22 | FLAPDE~1 Flap Defy Soft
13/06/2007 à 21:17 | vlc
14/05/2007 à 15:34 | ItsLabel
14/05/2007 à 15:33 | EoRezo
01/12/2006 à 01:19 | iMesh
29/11/2006 à 17:40 | Google
16/09/2006 à 20:36 | Lavasoft
10/04/2006 à 22:34 | MEDIAP~1 Media Player Classic
21/01/2006 à 05:41 | Azureus
21/01/2006 à 02:47 | APPLEC~1 Apple Computer
24/12/2005 à 15:10 | IRFANV~1 IrfanView
11/12/2005 à 01:54 | MUSICM~1 Musicmatch
10/12/2005 à 19:02 | Visio
25/02/2005 à 02:41 | Creative
20/02/2005 à 03:32 | MSNINS~1 MSNInstaller
12/02/2005 à 14:35 | MACROM~1 Macromedia
26/12/2004 à 17:17 | Mozilla
21/12/2004 à 20:42 | Real
21/12/2004 à 20:28 | AdobeUM
21/12/2004 à 20:27 | Adobe
02/12/2004 à 22:11 | Help
02/12/2004 à 21:06 | Ahead
22/11/2004 à 18:51 | INTERV~1 InterVideo
22/11/2004 à 18:35 | Template
22/11/2004 à 18:24 | IDENTI~1 Identities
22/11/2004 à 18:24 | MICROS~1 Microsoft
22/11/2004 à 18:24 | Sun

C:\Documents and Settings\fred\Local Settings\Application Data

Date/heure Création Nom court Nom long

08/12/2006 à 00:24 | Mozilla
29/11/2006 à 17:40 | Google
21/11/2006 à 13:58 | IDENTI~1 Identities
25/05/2006 à 13:31 | ISOLAT~1 IsolatedStorage
12/02/2006 à 19:49 | HP
12/02/2006 à 19:49 | APPLIC~1 ApplicationHistory
09/02/2006 à 19:02 | ratDVD
30/01/2006 à 18:56 | Yahoo
21/01/2006 à 02:47 | APPLEC~1 Apple Computer
11/12/2005 à 01:53 | MUSICM~1 Musicmatch
10/12/2005 à 19:02 | Visio
03/12/2005 à 15:09 | Ahead
12/11/2005 à 16:22 | IM
21/12/2004 à 20:28 | Adobe
02/12/2004 à 22:23 | WMTOOL~1 WMTools Downloaded Files
02/12/2004 à 22:11 | Help
22/11/2004 à 18:24 | MICROS~1 Microsoft
22/11/2004 à 18:24 | {7148F~1 {7148F0A6-6813-11D6-A77B-00B0D0142030}

____________________ Listing du dossier Program Files _____________________

C:\Program Files

Date/heure Création Nom court Nom long

24/06/2007 à 01:32 | CleanUp!
23/06/2007 à 21:22 | Navilog1
23/06/2007 à 20:20 | MSNGAM~1 msn gaming zone
22/06/2007 à 18:58 | CCleaner
22/06/2007 à 01:22 | FLAPDE~1 Flap Defy Soft
13/06/2007 à 21:12 | VideoLAN
14/05/2007 à 15:32 | ITSLAB~1 Its Label
10/05/2007 à 23:11 | OCTOSH~1 Octoshape Streaming Services
08/02/2007 à 02:38 | MICROS~4 Microsoft Windows Vista Upgrade Advisor
03/02/2007 à 03:30 | PALTAL~1 Paltalk Messenger
24/12/2006 à 01:45 | Canon
19/12/2006 à 16:54 | UNINST~1 Uninstall Information
07/12/2006 à 03:05 | ICQLite
06/12/2006 à 01:23 | WINDOW~3 Windows Media Connect 2
29/11/2006 à 17:35 | Google
21/11/2006 à 13:24 | Wanadoo
21/11/2006 à 13:04 | SAGEM
20/11/2006 à 16:21 | SECURI~1 Securitoo
16/09/2006 à 20:35 | Lavasoft
18/06/2006 à 08:06 | TELLME~1 TELL ME MORE CJ
27/04/2006 à 17:55 | FREEAU~1 Free Audio Pack
15/04/2006 à 00:51 | IMESHA~1 iMesh Applications
10/04/2006 à 22:21 | K-LITE~1 K-Lite Codec Pack
11/02/2006 à 21:01 | HEWLET~1 Hewlett-Packard
11/02/2006 à 20:49 | HP
09/02/2006 à 19:01 | ratDVD
07/02/2006 à 19:31 | SOFTWA~1 Software602
07/02/2006 à 19:04 | MEDIAI~1 MediaInfo
04/02/2006 à 00:32 | iVisit
30/01/2006 à 18:55 | Yahoo!
30/01/2006 à 18:04 | CVitae
29/01/2006 à 00:39 | QUICKT~1 QuickTime
29/01/2006 à 00:36 | iPod
29/01/2006 à 00:36 | iTunes
28/01/2006 à 01:27 | SIEMEN~1 Siemens Data Suite
24/01/2006 à 03:31 | ALWILS~1 Alwil Software
23/01/2006 à 12:56 | WinRAR
21/01/2006 à 05:41 | Azureus
20/01/2006 à 18:34 | IVTCOR~1 IVT Corporation
11/12/2005 à 01:54 | MUSICM~1 Musicmatch
03/12/2005 à 15:40 | VViewer
05/11/2005 à 15:05 | IRFANV~1 IrfanView
03/11/2005 à 01:54 | Talkway
26/03/2005 à 18:30 | MINDSC~1 MINDSCAPE
27/02/2005 à 19:22 | MGI
21/02/2005 à 23:51 | SPYBOT~1 Spybot - Search & Destroy
18/02/2005 à 22:24 | ULEADS~1 Ulead Systems
03/01/2005 à 22:17 | Visio
03/01/2005 à 22:10 | MICROS~3 Microsoft Office
01/01/2005 à 18:31 | iMesh
26/12/2004 à 17:43 | Creative
26/12/2004 à 17:17 | MOZILL~1 Mozilla Firefox
21/12/2004 à 20:43 | Real
02/12/2004 à 22:21 | MANAGE~1 Managed DirectX (0901)
02/12/2004 à 22:11 | WinZip
02/12/2004 à 20:59 | Ahead
22/11/2004 à 18:50 | INTERV~1 InterVideo
11/09/2004 à 04:36 | SYNAPT~1 Synaptics
11/09/2004 à 04:29 | Intel
11/09/2004 à 04:28 | INSTAL~1 InstallShield Installation Information
11/09/2004 à 04:28 | Adobe
11/09/2004 à 04:28 | Java
10/09/2004 à 03:27 | xerox
10/09/2004 à 03:27 | WINDOW~2 Windows NT
10/09/2004 à 03:27 | WINDOW~1 Windows Media Player
10/09/2004 à 03:27 | SERVIC~1 Services en ligne
10/09/2004 à 03:27 | OUTLOO~1 Outlook Express
10/09/2004 à 03:27 | ONLINE~1 Online Services
10/09/2004 à 03:27 | NETMEE~1 NetMeeting
10/09/2004 à 03:27 | MOVIEM~1 Movie Maker
10/09/2004 à 03:27 | MICROS~2 Microsoft Works
10/09/2004 à 03:27 | MICROS~1 microsoft frontpage
10/09/2004 à 03:27 | INTERN~1 Internet Explorer
10/09/2004 à 03:27 | FICHIE~1 Fichiers communs

__________________________ Recherche dans le registre _____________________

# Clés de démarrage :

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
user thunk lies road REG_SZ C:\Documents and Settings\All Users\Application Data\Load Vc User Thunk\MemoJugs.exe

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
okay spam REG_SZ C:\DOCUME~1\fred\APPLIC~1\FLAPDE~1\Link free.exe

_____________________ Modification du fichier Hosts _______________________

127.0.0.1= Url bloquée Autre= Redirection

127.0.0.1 bin.errorprotector.com ## added by CiD
127.0.0.1 br.errorsafe.com ## added by CiD
127.0.0.1 br.winantivirus.com ## added by CiD
127.0.0.1 br.winfixer.com ## added by CiD
127.0.0.1 cdn.drivecleaner.com ## added by CiD
127.0.0.1 cdn.errorsafe.com ## added by CiD
127.0.0.1 cdn.winsoftware.com ## added by CiD
127.0.0.1 de.errorsafe.com ## added by CiD
127.0.0.1 de.winantivirus.com ## added by CiD
127.0.0.1 download.cdn.drivecleaner.com ## added by CiD
127.0.0.1 download.cdn.errorsafe.com ## added by CiD
127.0.0.1 download.cdn.winsoftware.com ## added by CiD
127.0.0.1 download.errorsafe.com ## added by CiD
127.0.0.1 download.systemdoctor.com ## added by CiD
127.0.0.1 download.winantispyware.com ## added by CiD
127.0.0.1 download.windrivecleaner.com ## added by CiD
127.0.0.1 download.winfixer.com ## added by CiD
127.0.0.1 drivecleaner.com ## added by CiD
127.0.0.1 dynamique.drivecleaner.com ## added by CiD
127.0.0.1 errorprotector.com ## added by CiD
127.0.0.1 errorsafe.com ## added by CiD
127.0.0.1 es.winantivirus.com ## added by CiD
127.0.0.1 fr.winantivirus.com ## added by CiD
127.0.0.1 fr.winfixer.com ## added by CiD
127.0.0.1 go.drivecleaner.com ## added by CiD
127.0.0.1 go.errorsafe.com ## added by CiD
127.0.0.1 go.winantispyware.com ## added by CiD
127.0.0.1 go.winantivirus.com ## added by CiD
127.0.0.1 hk.winantivirus.com ## added by CiD
127.0.0.1 instlog.errorsafe.com ## added by CiD
127.0.0.1 instlog.winantivirus.com ## added by CiD
127.0.0.1 instlog.winfixer.com ## added by CiD
127.0.0.1 jsp.drivecleaner.com ## added by CiD
127.0.0.1 kb.errorsafe.com ## added by CiD
127.0.0.1 kb.winantivirus.com ## added by CiD
127.0.0.1 nl.errorsafe.com ## added by CiD
127.0.0.1 se.errorsafe.com ## added by CiD
127.0.0.1 secure.drivecleaner.com ## added by CiD
127.0.0.1 secure.errorsafe.com ## added by CiD
127.0.0.1 secure.winantispam.com ## added by CiD
127.0.0.1 secure.winantispy.com ## added by CiD
127.0.0.1 secure.winantivirus.com ## added by CiD
127.0.0.1 support.winantivirus.com ## added by CiD
127.0.0.1 trial.updates.winsoftware.com ## added by CiD
127.0.0.1 ulog.winantivirus.com ## added by CiD
127.0.0.1 utils.errorsafe.com ## added by CiD
127.0.0.1 utils.winantivirus.com ## added by CiD
127.0.0.1 utils.winfixer.com ## added by CiD
127.0.0.1 winantispyware.com ## added by CiD
127.0.0.1 winantivirus.com ## added by CiD
127.0.0.1 winfixer.com ## added by CiD
127.0.0.1 winfixer2006.com ## added by CiD
127.0.0.1 winsoftware.com ## added by CiD
127.0.0.1 www.drivecleaner.com ## added by CiD
127.0.0.1 www.errorprotector.com ## added by CiD
127.0.0.1 www.errorsafe.com ## added by CiD
127.0.0.1 www.systemdoctor.com ## added by CiD
127.0.0.1 www.utils.winfixer.com ## added by CiD
127.0.0.1 www.win-anti-virus-pro.com ## added by CiD
127.0.0.1 www.win-virus-pro.com ## added by CiD
127.0.0.1 www.winantispam.com ## added by CiD
127.0.0.1 www.winantispy.com ## added by CiD
127.0.0.1 www.winantispyware.com ## added by CiD
127.0.0.1 www.winantivirus.com ## added by CiD
127.0.0.1 www.winantiviruspro.com ## added by CiD
127.0.0.1 www.windrivecleaner.com ## added by CiD
127.0.0.1 www.windrivesafe.com ## added by CiD
127.0.0.1 www.winfixer.com ## added by CiD
127.0.0.1 www.winfixer2006.com ## added by CiD
127.0.0.1 www.winsoftware.com ## added by CiD

__________________________ Popups autorisées ______________________________

# Internet Explorer

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\New Windows\Allow

# Mozilla Firefox (1 autorisé 2 interdit)

host popup 1 en-gay-torrents.net

# Suite Mozilla / SeaMonkey (1 autorisé 2 interdit)

___________________________ Zones de sécurité _____________________________

# HKCU Domains (4)

# P3P History (5)

___________________ Suggestion nettoyage registre _______________

(Pour désinfection manuelle)

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"user thunk lies road"=-

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"okay spam"=-

_________________________ Fin du rapport ________________________

Salut

ok, j'oubliais :

Télécharge ceci sur ton bureau :

Lien : hijackthis

Démo : http://pageperso.aol.fr/balltrap34/demohijack.htm

Choisir l'option "do a scan and a logfile", et faire un copier/coller du rapport ainsi générer sur le forum.

++

Salut
voilà le rapport de hijackthis :

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 23:17:46, on 26/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Norman\NVC\BIN\Zanda.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Fichiers communs\Talkway\vmtalk.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Norman\NVC\BIN\ZLH.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\AGRSMMSG.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\MSSQL7\Binn\sqlmangr.exe
C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe
C:\PROGRA~1\Wanadoo\Watch.exe
C:\PROGRA~1\Wanadoo\WOOBrowser\WOOBrowser.exe
C:\Program Files\Azureus\Azureus.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Documents and Settings\fred\Mes documents\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [vmtalk] C:\Program Files\Fichiers communs\Talkway\vmtalk.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\NVC\BIN\ZLH.EXE /LOAD /SPLASH
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [user thunk lies road] C:\Documents and Settings\All Users\Application Data\Load Vc User Thunk\MemoJugs.exe
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [okay spam] C:\DOCUME~1\fred\APPLIC~1\FLAPDE~1\Link free.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe
O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Gestionnaire de services SQL Server.lnk = C:\MSSQL7\Binn\sqlmangr.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - C:\Program Files\Paltalk Messenger\Paltalk.exe (file missing)
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20070501/qtinstall.info.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - https://live365.com/
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1BD126C7-CBBF-4E86-9A99-2B7F79B8C7A5}: NameServer = 80.10.246.2,80.10.246.129
O18 - Filter hijack: text/html - (no CLSID) - (no file)
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Fax - Unknown owner - C:\WINDOWS\system32\fxssvc.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe
O23 - Service: MSSQLServer - Unknown owner - C:\MSSQL7\binn\sqlservr.exe
O23 - Service: Norman ZANDA - Unknown owner - C:\Norman\NVC\BIN\Zanda.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: SQLServerAgent - Unknown owner - C:\MSSQL7\binn\sqlagent.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe
O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe

ok,

Lancer HijackThis et cliquer sur [Do a system scan only]
cocher la case au début des lignes suivantes :

O4 - HKLM\..\Run: [user thunk lies road] C:\Documents and Settings\All Users\Application Data\Load Vc User Thunk\MemoJugs.exe

O4 - HKCU\..\Run: [okay spam] C:\DOCUME~1\fred\APPLIC~1\FLAPDE~1\Link free.exe

Valider en cliquant sur le bouton [Fix Checked]

-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_

Ensuite, fais Démarrer > Exécuter. Tape cmd puis valide avec OK.
Dans la fenêtre qui va s'ouvrir, copie et colle ceci :

del /a C:\WINDOWS\tasks\A6B91C9190D69B69.job

et valide en appuyant sur Entrée

ensuite, fais ce qui est indiqué ici stp :

virus methode preliminaire de desinfection version fr

@+

salut green day
j'ai fait tout ce que tu m'as dit jusqu'à l'étape cmd : et dans la fenêtre il dit que: impossible de trouver le chemin C:\WINDOWS\tasks\A6B91C9190D69B69.job

à plus

Salut

ok, pas grave, continue !

++

re
je reçois toujours les fenêtres publicitaires cid. j'ai suivi le lien que tu m'as laissé pour la désinfection (apparemment il faut obligatoirement faire dans l'ordre ) mais impossible de télécharger le fichier AVG anti-spyware le téléchargement n'a pas lancé automatiquement et j'ai passer par le lien ftp et il dit que le fichier n'est pas à son emplacement , tu connais un autre site pour le télécharger ou pas, merci à toi.
à +

re

essaye ici : https://www.01net.com/telecharger/

++

re
voici les rapports de la désinfection dans l'ordre :

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\Messenger.UIAutomation]
@="Messenger Object"

[HKEY_CLASSES_ROOT\Messenger.UIAutomation\CLSID]
@="{B69003B3-C55E-4b48-836C-BC5946FC3B28}"

[HKEY_CLASSES_ROOT\Messenger.UIAutomation\CurVer]
@="Messenger.UIAutomation.1"

[HKEY_CLASSES_ROOT\Messenger.UIAutomation.1]
@="Messenger.UIAutomation"

[HKEY_CLASSES_ROOT\Messenger.UIAutomation.1\CLSID]
@="{B69003B3-C55E-4b48-836C-BC5946FC3B28}"

[HKEY_CLASSES_ROOT\MessengerPrivate.MessengerPriv]
@="Messenger Private Object"

[HKEY_CLASSES_ROOT\MessengerPrivate.MessengerPriv\CLSID]
@="{AB1D8565-40E9-4616-984D-98465687E82C}"

[HKEY_CLASSES_ROOT\MessengerPrivate.MessengerPriv\CurVer]
@="MessengerPrivate.MessengerPriv.1"

[HKEY_CLASSES_ROOT\MessengerPrivate.MessengerPriv.1]
@="MessengerPrivate.MessengerPriv"

[HKEY_CLASSES_ROOT\MessengerPrivate.MessengerPriv.1\CLSID]
@="{AB1D8565-40E9-4616-984D-98465687E82C}"

_____________________________________________________________________________________

AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

+ Créé à: 18:43:34 27/06/2007

+ Résultat de l'analyse:

:mozilla.57:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.247realmedia : Nettoyé.
:mozilla.58:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.247realmedia : Nettoyé.
:mozilla.59:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.247realmedia : Nettoyé.
:mozilla.60:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.247realmedia : Nettoyé.
:mozilla.321:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.328:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.329:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.330:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.331:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.332:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.589:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.719:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Ad-logics : Nettoyé.
:mozilla.713:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Adrevolver : Nettoyé.
:mozilla.723:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Adrevolver : Nettoyé.
:mozilla.40:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Adtech : Nettoyé.
:mozilla.41:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Adtech : Nettoyé.
:mozilla.53:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.54:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.55:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.56:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.228:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Atdmt : Nettoyé.
:mozilla.229:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Atdmt : Nettoyé.
:mozilla.511:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Bfast : Nettoyé.
:mozilla.52:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Bluestreak : Nettoyé.
:mozilla.712:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Bluestreak : Nettoyé.
C:\Documents and Settings\fred\Cookies\fred@bluestreak[1].txt -> TrackingCookie.Bluestreak : Nettoyé.
:mozilla.522:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Burstnet : Nettoyé.
:mozilla.523:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Burstnet : Nettoyé.
:mozilla.390:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Casalemedia : Nettoyé.
:mozilla.559:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Casinotropez : Nettoyé.
:mozilla.611:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Centrport : Nettoyé.
:mozilla.695:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Com : Nettoyé.
:mozilla.696:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Com : Nettoyé.
C:\Documents and Settings\fred\Cookies\fred@com[1].txt -> TrackingCookie.Com : Nettoyé.
:mozilla.424:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Comclick : Nettoyé.
:mozilla.425:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Comclick : Nettoyé.
:mozilla.426:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Comclick : Nettoyé.
:mozilla.449:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Coremetrics : Nettoyé.
:mozilla.739:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Dealtime : Nettoyé.
:mozilla.50:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Doubleclick : Nettoyé.
:mozilla.677:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Esomniture : Nettoyé.
:mozilla.24:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Estat : Nettoyé.
:mozilla.141:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Falkag : Nettoyé.
:mozilla.143:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Falkag : Nettoyé.
:mozilla.146:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Falkag : Nettoyé.
:mozilla.149:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Falkag : Nettoyé.
:mozilla.150:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Falkag : Nettoyé.
:mozilla.15:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Falkag : Nettoyé.
:mozilla.16:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Falkag : Nettoyé.
:mozilla.389:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Fastclick : Nettoyé.
:mozilla.270:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Googleadservices : Nettoyé.
:mozilla.281:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Googleadservices : Nettoyé.
:mozilla.380:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Hitbox : Nettoyé.
:mozilla.381:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Hitbox : Nettoyé.
:mozilla.486:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Hitbox : Nettoyé.
:mozilla.487:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Hitbox : Nettoyé.
:mozilla.751:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Hitbox : Nettoyé.
:mozilla.314:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Imrworldwide : Nettoyé.
:mozilla.315:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Imrworldwide : Nettoyé.
:mozilla.610:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Ivwbox : Nettoyé.
:mozilla.554:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Liveperson : Nettoyé.
:mozilla.161:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Mediaplex : Nettoyé.
:mozilla.162:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Mediaplex : Nettoyé.
:mozilla.684:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Msn : Nettoyé.
:mozilla.515:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Onestat : Nettoyé.
:mozilla.518:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Onestat : Nettoyé.
:mozilla.239:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Overture : Nettoyé.
:mozilla.240:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Overture : Nettoyé.
:mozilla.521:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Paypal : Nettoyé.
:mozilla.725:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Pointroll : Nettoyé.
:mozilla.727:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Pointroll : Nettoyé.
:mozilla.730:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Pointroll : Nettoyé.
:mozilla.731:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Pointroll : Nettoyé.
:mozilla.664:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Real : Nettoyé.
:mozilla.492:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Realmedia : Nettoyé.
:mozilla.133:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Reliablestats : Nettoyé.
:mozilla.134:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Reliablestats : Nettoyé.
:mozilla.135:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Reliablestats : Nettoyé.
:mozilla.136:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Reliablestats : Nettoyé.
:mozilla.137:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Reliablestats : Nettoyé.
:mozilla.283:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Revenue : Nettoyé.
:mozilla.427:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.428:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.429:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.430:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.431:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.432:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.344:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Sitestat : Nettoyé.
:mozilla.395:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Sitestat : Nettoyé.
:mozilla.396:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Sitestat : Nettoyé.
:mozilla.441:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Sitestat : Nettoyé.
:mozilla.442:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Sitestat : Nettoyé.
:mozilla.699:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Sitestat : Nettoyé.
:mozilla.748:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Sitestat : Nettoyé.
:mozilla.66:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.67:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.68:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.69:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
C:\Documents and Settings\fred\Cookies\fred@www.smartadserver[1].txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.682:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Specificclick : Nettoyé.
:mozilla.233:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Statcounter : Nettoyé.
:mozilla.234:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Statcounter : Nettoyé.
:mozilla.235:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Statcounter : Nettoyé.
:mozilla.236:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Statcounter : Nettoyé.
:mozilla.237:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Statcounter : Nettoyé.
:mozilla.524:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Tacoda : Nettoyé.
:mozilla.525:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Tacoda : Nettoyé.
:mozilla.624:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Thunderdownloads : Nettoyé.
:mozilla.625:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Thunderdownloads : Nettoyé.
:mozilla.33:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Tradedoubler : Nettoyé.
:mozilla.34:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Tradedoubler : Nettoyé.
:mozilla.35:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Tradedoubler : Nettoyé.
:mozilla.36:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Tradedoubler : Nettoyé.
:mozilla.37:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Tradedoubler : Nettoyé.
:mozilla.38:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Tradedoubler : Nettoyé.
:mozilla.39:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Tradedoubler : Nettoyé.
C:\Documents and Settings\fred\Cookies\fred@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Nettoyé.
:mozilla.116:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Valueclick : Nettoyé.
:mozilla.117:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Valueclick : Nettoyé.
:mozilla.249:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
:mozilla.250:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
:mozilla.251:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
:mozilla.252:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
:mozilla.253:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
:mozilla.306:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
C:\Documents and Settings\fred\Cookies\fred@weborama[1].txt -> TrackingCookie.Weborama : Nettoyé.
:mozilla.452:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Webtrendslive : Nettoyé.
:mozilla.453:C:\Documents and Settings\florian\Application Data\Mozilla\Firefox\Profiles\3uvwyjbc.default\cookies.txt -> TrackingCookie.Webtrendslive : Nettoyé.
C:\Documents and Settings\fred\Cookies\fred@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Nettoyé.
C:\Documents and Settings\All Users\Application Data\Load Vc User Thunk\MemoJugs.exe -> Trojan.Obfuscated.en : Nettoyé.

Fin du rapport

_____________________________________________________________________________________

BitDefender Online Scanner

Scan report generated at: Wed, Jun 27, 2007 - 19:49:25

Scan path: C:\;D:\;

Statistics

Time
01:02:11

Files
214228

Folders
6350

Boot Sectors
2

Archives
8357

Packed Files
11052

Results

Identified Viruses
4

Infected Files
4

Suspect Files
0

Warnings
0

Disinfected
0

Deleted Files
4

Engines Info

Virus Definitions
584317

Engine build
AVCORE v1.0 (build 2410) (i386) (Jun 12 2007 21:08:27)

Scan plugins
14

Archive plugins
38

Unpack plugins
6

E-mail plugins
6

System plugins
1

Scan Settings

First Action
Disinfect

Second Action
Delete

Heuristics
Yes

Enable Warnings
Yes

Scanned Extensions
*;

Exclude Extensions

Scan Emails
Yes

Scan Archives
Yes

Scan Packed
Yes

Scan Files
Yes

Scan Boot
Yes

Scanned File
Status

C:\Documents and Settings\fred\Mes documents\Matrix3DSetup.exe=>wise0019
Infected with: Dropped:Trojan.Dloader.HK

C:\Documents and Settings\fred\Mes documents\Matrix3DSetup.exe=>wise0019
Disinfection failed

C:\Documents and Settings\fred\Mes documents\Matrix3DSetup.exe=>wise0019
Deleted

C:\Documents and Settings\fred\Mes documents\Matrix3DSetup.exe
Update failed

C:\Documents and Settings\fred\Mes documents\Matrix3DSetup.exe=>wise0020
Infected with: Dropped:Application.Adware.NewDotNet.A

C:\Documents and Settings\fred\Mes documents\Matrix3DSetup.exe=>wise0020
Disinfection failed

C:\Documents and Settings\fred\Mes documents\Matrix3DSetup.exe=>wise0020
Deleted

C:\Documents and Settings\fred\Mes documents\Matrix3DSetup.exe
Update failed

C:\Documents and Settings\fred\Mes documents\Matrix3DSetup.exe=>wise0022
Infected with: Dropped:Application.ProcKill.Jk

C:\Documents and Settings\fred\Mes documents\Matrix3DSetup.exe=>wise0022
Disinfection failed

C:\Documents and Settings\fred\Mes documents\Matrix3DSetup.exe=>wise0022
Deleted

C:\Documents and Settings\fred\Mes documents\Matrix3DSetup.exe
Update failed

C:\System Volume Information\_restore{20F508DD-556D-4780-869F-D1CE4C742FF6}\RP378\A0065116.exe
Infected with: Trojan.FatObfus.Gen

C:\System Volume Information\_restore{20F508DD-556D-4780-869F-D1CE4C742FF6}\RP378\A0065116.exe
Disinfection failed

C:\System Volume Information\_restore{20F508DD-556D-4780-869F-D1CE4C742FF6}\RP378\A0065116.exe
Deleted

____________________________________________________________________________________
Logfile of HijackThis v1.99.1
Scan saved at 20:32:14, on 27/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Norman\NVC\BIN\Zanda.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Fichiers communs\Talkway\vmtalk.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Norman\NVC\BIN\ZLH.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\AGRSMMSG.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\MSSQL7\Binn\sqlmangr.exe
C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe
C:\PROGRA~1\Wanadoo\Watch.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\PROGRA~1\Wanadoo\WOOBrowser\WOOBrowser.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\CCleaner\ccleaner.exe
C:\Program Files\CCleaner\ccleaner.exe
C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [vmtalk] C:\Program Files\Fichiers communs\Talkway\vmtalk.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\NVC\BIN\ZLH.EXE /LOAD /SPLASH
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe
O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Gestionnaire de services SQL Server.lnk = C:\MSSQL7\Binn\sqlmangr.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - C:\Program Files\Paltalk Messenger\Paltalk.exe (file missing)
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20070501/qtinstall.info.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - https://live365.com/
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1BD126C7-CBBF-4E86-9A99-2B7F79B8C7A5}: NameServer = 80.10.246.2,80.10.246.129
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter: text/html - (no CLSID) - (no file)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norman ZANDA - Unknown owner - C:\Norman\NVC\BIN\Zanda.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

Salut

ok,
o Prendre connaissance du contenu du lien suivant: http://www.f-secure.com/products/license-terms/eult_fra.pdf
o Vous avez donc pris connaissance et accepté les conditions d'utilisations du programme blacklight qui est inclus dans le dossier compressé navilog1.zip que vous allez télécharger.
o Faire un clic droit sur ce lien : http://perso.orange.fr/il.mafioso/Navifix/Navilog1.zip
o Enregistrez la cible (du lien) sous... et enregistrez-le sur le bureau.
o Faire un clic droit sur navilog1.zip et choisir "tout extraire"
o Double-cliquez sur navilog1.bat
o Arriver au menu principal, choisir l'option 1 et valider.
o Patientez jusqu'au message : Analyse Termine le ...
o Le rapport sera en outre sauvegardé à la racine du disque (fixnavi.txt), poste le stp

++

salut
suite à ton dernier conseil , voilà le rapport :
( ces derniers jours je n'ai pas reçu des pubs cid je me demande si le " spyware " en question est toujours caché quelque part sur le disque ou a été viré ??? )

Search Navipromo version 2.0.3 commencé le 02/07/2007 à 16:45:59,23

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Poster ce rapport sur le forum pour le faire analyser !!!
!!! Ne pas lancer la partie désinfection sans l'avis d'un spécialiste !!!

Fix lancé depuis C:\Program Files\navilog1
Mise a jour le 08.06.2007 a 17h00 by IL-MAFIOSO

Executé en mode normal

*** Recherche Programmes installes ***

*** Recherche dossiers dans C:\WINDOWS ***

*** Recherche dossiers dans C:\Program Files ***

*** Recherche dossiers dans C:\Documents and Settings\All Users\Application Data ***

*** Recherche dossiers dans C:\Documents and Settings\fred\Application Data ***

*** Recherche avec BlackLight Engine/F-secure ***
BlackLight Engine est un produit de F-secure, pour + d'infos :
https://www.f-secure.com/en

F-SECURE BLACKLIGHT ROOTKIT ELIMINATOR
======================================

Copyright 2005-2006 F-Secure Corporation. All rights reserved.
This is a beta version. It will expire on 1st of April, 2007.
Version information: 2.2.1061.

[+] Started on 07/02/07 at 16:46:01.
[+] Initializing ...
[+] Starting scan, press Ctrl-C to abort.
[+] Scanning for hidden items ...........................................................................................................
[+] Scan complete.
[+] Summary: 0 hidden item(s) found, 0 scheduled for renaming.
[+] Exited on 07/02/07 at 16:58:18 (return code = 0).

*** Recherche fichiers ***

*** Recherche cles registre ***

Recherche dans [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs]

Recherche dans [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage]

Recherche Clé Magic Control

*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche fichiers connus:

2)Recherche Heuristique :
*
**
***
****
*****
******
*******
********

*** Analyse Terminé le 02/07/2007 à 16:58:56,33 ***

merci à toi
+++

ok, tu as encore des pages cid ???

++

salut green day,
ces derniers temps , je ne reçois plus de pages publicitaires cid, donc je ne sais pas si le spyware a été viré ou pas? en tout cas, je te remercie bien pour ton aide et tes conseils ;-)
à bientôt

Salut

très bien !

dernier détail :

# Création d'un point propre

* Cliquez sur le bouton Démarrer
* tous les programmes
* accessoires
* outils systemes
* restauration du systeme
* creer un point de restauration ==> nomme le, et valide

ensuite installe un parefeu !!!

voir ici :

securite proteger un ordinateur contre les malwares d internet

++