Virus introuvable connexion au net impossible

Re,
OK. Des traces anciennes ou en quarantaine.

1/ Ferme toutes les applications.
2/ Ouvre Hijackthis>"Do a scan only" et coche ceci :
O17 - HKLM\System\CCS\Services\Tcpip\..\{0ADFB544-E512-449A-8814-D82C82F4E75D}: NameServer = 208.254.4.3
O17 - HKLM\System\CCS\Services\Tcpip\..\{53FE03FF-8418-4350-AF58-38F3E97626DA}: NameServer = 208.254.4.3
O17 - HKLM\System\CCS\Services\Tcpip\..\{57B75F4D-3445-49A7-AB18-EC8C51CE6C1D}: NameServer = 208.254.4.3
O17 - HKLM\System\CCS\Services\Tcpip\..\{98064786-F020-4B58-8674-EA4FF46D6517}: NameServer = 208.254.4.3
O17 - HKLM\System\CCS\Services\Tcpip\..\{AA63B722-7AF4-4E30-B0AC-EB660492C41F}: NameServer = 208.254.4.3
O17 - HKLM\System\CS1\Services\Tcpip\..\{0ADFB544-E512-449A-8814-D82C82F4E75D}: NameServer = 208.254.4.3

Clique sur fix/réparer.

2/ * Télécharge DiagHelp.zip sur ton bureau(Merci Malekal) : http://www.malekal.com/download/DiagHelp.zip
Tuto : http://www.malekal.com/DiagHelp/DiagHelp.php
* Ne double-clique pas dessus !! Fais un clic droit sur le fichier et extraire tout.
* Un nouveau dossier chercher va être créé.
* Ouvre le et double-clic sur go.cmd (le .cmd peut ne pas apparaître)
* Une fenêtre va s'ouvrir, choisis l'option 1
* L'analyse va commencer, ceci peut durer quelques minutes, laisse faire et appuie sur une touche quand on te le demande.
* Pendant l'analyse après le rapport CATCHME sur l'écran rouge, tu dois appuyer sue entrée pour que l'outil continue ses recherches. Suis les consignes écrites.
* Une fenêtre avec le rapport s'ouvre alors. Copie/colle son contenu. (Il se trouve aussi ici : c:\resultat.txt)
* Double-clique sur ce fichier, Fais CTRL+A puis CTRL+C.
* Dans ta prochaine réponse, colle le rapport en faisant CTRL+V.

3/ Edite le rapport Diaghelp et un nouveau rapport Hijackthis.

La connexion est toujours impossible après redémarrage du PC ?

FillPCA

Bonjour,

En effet.

Quel est votre fournisseur d'accès ?
Les 17 pointent ici. C'est normal ?

1/ Télécharge Ccleaner Basic https://www.ccleaner.com/ccleaner/download

Ouvre Ccleaner, clique sur "lancer le nettoyage".

2/ Télécharge AVGantispyware : https://www.avg.com/en-ww/free-antivirus-download
Tu l'installes.
Lance AVG Anti-Spyware et clique sur le bouton Mise à jour. Patiente.

Clique sur le bouton Analyse (de la barre d'outils)
Puis sur l'onglets Comment réagir, clique sur Actions recommandées. Sélectionne Quarantaine.
Reviens à l'onglet Analyse. Clique sur Analyse complète du système.
A la fin du scan, choisis l'option " Appliquer toutes les actions " en bas. Ensuite.
Clique sur "Enregistrer le rapport". Ceci génère un rapport en fichier texte qui se trouve dans le dossier Reports du dossier d'AVG Anti-Spyware.

Edite le rapport AVG -antispy et un nouveau rapport Hijackthis.

FillPCA

OK je fais sa et je te met le rapport!!

voici le rapport de c cleaner:

---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

+ Créé à: 19:30:00 15/09/2007

+ Résultat de l'analyse:

HKLM\SOFTWARE\Gator.com -> Adware.Gator : Nettoyé et sauvegardé (mise en quarantaine).
HKLM\SOFTWARE\Gator.com\AppInfo -> Adware.Gator : Nettoyé et sauvegardé (mise en quarantaine).
HKLM\SOFTWARE\Gator.com\CMEII -> Adware.Gator : Nettoyé et sauvegardé (mise en quarantaine).
HKLM\SOFTWARE\Gator.com\Gator -> Adware.Gator : Nettoyé et sauvegardé (mise en quarantaine).
HKLM\SOFTWARE\Gator.com\Gator\dyn -> Adware.Gator : Nettoyé et sauvegardé (mise en quarantaine).
HKLM\SOFTWARE\Gator.com\Gator\dyn\GCH -> Adware.Gator : Nettoyé et sauvegardé (mise en quarantaine).
HKLM\SOFTWARE\Gator.com\Gator\dyn\GCH\_gs -> Adware.Gator : Nettoyé et sauvegardé (mise en quarantaine).
HKLM\SOFTWARE\Gator.com\trickles -> Adware.Gator : Nettoyé et sauvegardé (mise en quarantaine).
HKLM\SOFTWARE\Gator.com\trickles\TRICKLER_6106 -> Adware.Gator : Nettoyé et sauvegardé (mise en quarantaine).
HKLM\SOFTWARE\Gator.com\trickles\TRICKLER_6106\Trickler -> Adware.Gator : Nettoyé et sauvegardé (mise en quarantaine).
HKLM\SOFTWARE\Gator.com\trickles\TRICKLER_6106\Trickler\trickle.gator.com:80/download/trickler6.cfg -> Adware.Gator : Nettoyé et sauvegardé (mise en quarantaine).
C:\Program Files\Hotbar -> Adware.HotBar : Nettoyé et sauvegardé (mise en quarantaine).
HKLM\SOFTWARE\Classes\HbTools.HbtTravelCompareBar -> Adware.HotBar : Nettoyé et sauvegardé (mise en quarantaine).
HKLM\SOFTWARE\Classes\HbTools.HbtTravelCompareBar.1 -> Adware.HotBar : Nettoyé et sauvegardé (mise en quarantaine).
HKLM\SOFTWARE\Classes\HbTools.HbtTravelCompareBar\CLSID -> Adware.HotBar : Nettoyé et sauvegardé (mise en quarantaine).
HKLM\SOFTWARE\Classes\HbTools.HbtTravelCompareBar\CurVer -> Adware.HotBar : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\All Users\Application Data\Starware -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\All Users\Application Data\Starware\SimpleUpdate -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\All Users\Application Data\Starware\SimpleUpdate\ProductMessagingConfig.xml -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\All Users\Application Data\Starware\SimpleUpdate\ProductMessagingConfig.xml.backup -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\All Users\Application Data\Starware\SimpleUpdate\SimpleUpdateConfig.xml -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\All Users\Application Data\Starware\SimpleUpdate\SimpleUpdateConfig.xml.backup -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\All Users\Application Data\Starware\SimpleUpdate\TimerManagerConfig.xml -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\All Users\Application Data\Starware\SimpleUpdate\TimerManagerConfig.xml.backup -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\All Users\Application Data\Starware\U00035F48.exe -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\All Users\Application Data\Starware\buttons -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\All Users\Application Data\Starware\buttons\416_button_1b_def.bmp -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\All Users\Application Data\Starware\buttons\416_button_1b_def.pinkcorners.bmp -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\All Users\Application Data\Starware\buttons\416_button_1b_over.bmp -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\All Users\Application Data\Starware\buttons\416_button_1b_over.pinkcorners.bmp -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\All Users\Application Data\Starware\buttons\416_button_8b_def.png -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\All Users\Application Data\Starware\buttons\416_button_8b_over.png -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\All Users\Application Data\Starware\buttons\417_button_1b_def.bmp -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\All Users\Application Data\Starware\buttons\417_button_1b_over.bmp -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\All Users\Application Data\Starware\buttons\417_button_8b_def.png -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\All Users\Application Data\Starware\buttons\417_button_8b_over.png -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\All Users\Application Data\Starware\buttons\FindIt.bmp -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\All Users\Application Data\Starware\buttons\FindItHot.bmp -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\All Users\Application Data\Starware\buttons\Highlight.bmp -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\All Users\Application Data\Starware\buttons\HighlightHot.bmp -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\All Users\Application Data\Starware\buttons\PopupBlocker.bmp -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\All Users\Application Data\Starware\buttons\PopupBlockerHot.bmp -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\All Users\Application Data\Starware\buttons\blocker.cur -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\All Users\Application Data\Starware\buttons\brand.bmp -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\All Users\Application Data\Starware\buttons\findithotxp.png -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\All Users\Application Data\Starware\buttons\finditxp.png -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\All Users\Application Data\Starware\buttons\highlighthotxp.png -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\All Users\Application Data\Starware\buttons\highlightxp.png -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\All Users\Application Data\Starware\buttons\logo.bmp -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\All Users\Application Data\Starware\buttons\logoxp.bmp -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\All Users\Application Data\Starware\buttons\popupblockerhotxp.png -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\All Users\Application Data\Starware\buttons\popupblockerxp.png -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\All Users\Application Data\Starware\contexts -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\All Users\Application Data\Starware\contexts\Related.xml -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\All Users\Application Data\Starware\contexts\error.xml -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\All Users\Application Data\Starware\contexts\travel.xml -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\a\Application Data\Starware -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\a\Application Data\Starware\BrowserSearch -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\a\Application Data\Starware\BrowserSearch\BrowserSearch.xml -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\a\Application Data\Starware\BrowserSearch\BrowserSearch.xml.backup -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\a\Application Data\Starware\ErrorSearch -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\a\Application Data\Starware\ErrorSearch\ErrorSearchOptions.xml -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\a\Application Data\Starware\ErrorSearch\ErrorSearchOptions.xml.backup -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\a\Application Data\Starware\Layouts -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\a\Application Data\Starware\Layouts\PreferencesLayout.xml -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\a\Application Data\Starware\Layouts\PreferencesLayout.xml.backup -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\a\Application Data\Starware\Layouts\ToolbarLayout.xml -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\a\Application Data\Starware\Layouts\ToolbarLayout.xml.backup -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\a\Application Data\Starware\Manager -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\a\Application Data\Starware\Manager\ManagerOptions.xml -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\a\Application Data\Starware\Manager\ManagerOptions.xml.backup -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\a\Application Data\Starware\PopupBlocker -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\a\Application Data\Starware\PopupBlocker\PopupBlockerOptions.xml -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\a\Application Data\Starware\PopupBlocker\PopupBlockerOptions.xml.backup -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\a\Application Data\Starware\Recipes -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\a\Application Data\Starware\Recipes\RecipesOptions.xml -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\a\Application Data\Starware\Recipes\RecipesOptions.xml.backup -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\a\Application Data\Starware\Reference -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\a\Application Data\Starware\Reference\ReferenceOptions.xml -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\a\Application Data\Starware\Reference\ReferenceOptions.xml.backup -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\a\Application Data\Starware\RelatedSearch -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\a\Application Data\Starware\RelatedSearch\RelatedSearchOptions.xml -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\a\Application Data\Starware\RelatedSearch\RelatedSearchOptions.xml.backup -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\a\Application Data\Starware\SearchMatch -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\a\Application Data\Starware\SearchMatch\SearchMatchOptions.xml -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\a\Application Data\Starware\SearchMatch\SearchMatchOptions.xml.backup -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\a\Application Data\Starware\Toolbar -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\a\Application Data\Starware\ToolbarLogo -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\a\Application Data\Starware\ToolbarLogo\ToolbarLogoOptions.xml -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\a\Application Data\Starware\ToolbarLogo\ToolbarLogoOptions.xml.backup -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\a\Application Data\Starware\ToolbarSearch -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\a\Application Data\Starware\ToolbarSearch\ToolbarSearchOptions.xml -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\a\Application Data\Starware\ToolbarSearch\ToolbarSearchOptions.xml.backup -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\a\Application Data\Starware\Toolbar\TBProductsOptions.xml -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\a\Application Data\Starware\Toolbar\TBProductsOptions.xml.backup -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Program Files\Starware -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Program Files\Starware\StarwareConfig.xml -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Program Files\Starware\StarwareUninstall.exe -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Program Files\Starware\bin -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Program Files\Starware\brand.bmp -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Program Files\Starware\icons -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Starware -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
HKU\S-1-5-21-963801106-855365778-997184809-1004\Software\Starware -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
HKU\S-1-5-21-963801106-855365778-997184809-1004\Software\Starware\Options -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
HKU\S-1-5-21-963801106-855365778-997184809-1004\Software\Starware\OriginalSearchAssistant -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
HKU\S-1-5-21-963801106-855365778-997184809-1004\Software\Starware\OriginalURLSearchHooks -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
HKU\S-1-5-21-963801106-855365778-997184809-1004\Software\Starware\SearchAssistant -> Adware.Starware : Nettoyé et sauvegardé (mise en quarantaine).
C:\Program Files\Fichiers communs\WinSoftware\PCheck.dll -> Adware.Winfixer : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{26F829D9-4CFF-4392-B7FE-D56FB7721EB8}\RP494\A0102427.exe -> Dialer.Generic : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\nsupdate.Vexe -> Dialer.Generic : Nettoyé et sauvegardé (mise en quarantaine).
HKU\S-1-5-21-963801106-855365778-997184809-1004\Software\GlobalCS -> Dialer.Generic : Nettoyé et sauvegardé (mise en quarantaine).

Fin du rapport

et voici celui de hijackthis :

Logfile of HijackThis v1.99.1
Scan saved at 19:32:08, on 15/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\PROGRA~1\LAUNCH~1\LManager.EXE
C:\Program Files\Ulead Systems\Ulead Video@Home 2.0\monitor.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\DOCUME~1\a\LOCALS~1\Temp\winlogon.exe
C:\PROGRA~1\WANADOO\TaskBarIcon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Documents and Settings\a\Bureau\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://home.neuf.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://as.starware.com/dp/search?x=wKX1ILEOi+Vh7AfA98Gm4Nh4mHWDdShFq0rj6sVvCfYBIMUSTnCpFYuFsVL/PAMxkaKSmMmgzbfPhtb7KPfEh+20iHAeGElvknz/yyHYaAVGHiUX7Xl9KvP7ltP/+bwm3hPn9hRmvGfJ/VLLvBDpJzBsuUIcJsZBbjttwnXjdDrdbV5UcELGyshPnpOsz+oW
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\WANADOO\SEARCH~1.DLL
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O2 - BHO: Starware - {F7C7AA47-BCA6-451D-8DBC-C10A8F75C8C7} - C:\Program Files\Starware\bin\Starware.dll (file missing)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Starware - {9839B3B7-3F99-4498-884D-6CFCCD251AB1} - C:\Program Files\Starware\bin\Starware.dll (file missing)
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.EXE
O4 - HKLM\..\Run: [Ulead Video@Home Scheduling Wizard] C:\Program Files\Ulead Systems\Ulead Video@Home 2.0\monitor.exe
O4 - HKLM\..\Run: [BO1HelperStartUp] C:\PROGRA~1\BUTTER~1\BO1HEL~1.EXE /partner BO1
O4 - HKLM\..\Run: [NsUpdate] C:\WINDOWS\NsUpdate.exe UPDATE
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\WANADOO\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\WANADOO\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Configuration de la neuf Box] C:\Program Files\neuf telecom\neuf Box\Wizard\QuickAccess.exe
O4 - HKCU\..\Run: [Firewall auto setup] C:\DOCUME~1\a\LOCALS~1\Temp\winlogon.exe
O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697516} (NsvPlayX Control) - http://www.nullsoft.com/nsv/embed/nsvplayx_vp6_mp3.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0ADFB544-E512-449A-8814-D82C82F4E75D}: NameServer = 208.254.4.3
O17 - HKLM\System\CCS\Services\Tcpip\..\{53FE03FF-8418-4350-AF58-38F3E97626DA}: NameServer = 208.254.4.3
O17 - HKLM\System\CCS\Services\Tcpip\..\{57B75F4D-3445-49A7-AB18-EC8C51CE6C1D}: NameServer = 208.254.4.3
O17 - HKLM\System\CCS\Services\Tcpip\..\{98064786-F020-4B58-8674-EA4FF46D6517}: NameServer = 208.254.4.3
O17 - HKLM\System\CCS\Services\Tcpip\..\{AA63B722-7AF4-4E30-B0AC-EB660492C41F}: NameServer = 208.254.4.3
O17 - HKLM\System\CS1\Services\Tcpip\..\{0ADFB544-E512-449A-8814-D82C82F4E75D}: NameServer = 208.254.4.3
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: printers - {A21C6637-385D-4580-BB36-C0861850BFC6} - notiffy.dll (file missing)
O23 - Service: Notebook Manager Service (anbmService) - Unknown owner - C:\Acer\eManager\anbmServ.exe (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: MS Internet Countermeasures Framework (ICF) - Unknown owner - C:\WINDOWS\system32\icf.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

Re,

OK. J'examine ceci.

Ta connexion pointe vers cette adresse : https://whois.domaintools.com/208.254.4.3
Ca te dit quelquechose ? Tu sembles être chez 9telecom.

FillPCA

Re,

# Télécharge SDFix (créé par Andy Manchesta) et sauvegarde le sur ton Bureau : http://downloads.andymanchesta.com/RemovalTools/SDFix.exe
# Imprime ceci.
# Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici :

* Redémarre ton ordinateur.
* Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (ou F5).
* A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.
* Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".
* Choisis ton compte.

# Déroule la liste des instructions ci-dessous :

* En mode sans échec, double-clique sur le fichier SDFix.exe et clique sur install,
* Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script.
* Appuie sur Y pour commencer le script.
* Il va supprimer les services de certains trojans, effectuera aussi quelques réparations du Registre et il te demandera d'appuyer sur une touche pour redémarrer.
* Appuie sur une touche pour redémarrer le PC.
* Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
* Après le chargement du Bureau, l'outil terminera son travail et affichera Finished
* Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
* Enfin, ouvre le dossier de SDFix sur ton Bureau et copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum, avec un nouveau log Hijackthis !

FillPCA

alors les amis voici mon rapport SDFIX :

SDFix: Version 1.104

Run by a on 15/09/2007 at 21:34

Microsoft Windows XP [version 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:

Name:
ICF
SysLibrary

ImagePath:
C:\WINDOWS\system32\icf.exe
\??\C:\WINDOWS\system32\DefLib.sys

ICF - Deleted
SysLibrary - Deleted

Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...

Normal Mode:
Checking Files:

Trojan Files Found:

C:\53C.TMP - Deleted
C:\53E.TMP - Deleted
C:\53F.TMP - Deleted
C:\540.TMP - Deleted
C:\543.TMP - Deleted
C:\544.TMP - Deleted
C:\545.TMP - Deleted
C:\556.TMP - Deleted
C:\557.TMP - Deleted
C:\558.TMP - Deleted
C:\55A.TMP - Deleted
C:\55C.TMP - Deleted
C:\55E.TMP - Deleted
C:\55F.TMP - Deleted
C:\564.TMP - Deleted
C:\565.TMP - Deleted
C:\566.TMP - Deleted
C:\567.TMP - Deleted
C:\548.TMP - Deleted
C:\570.TMP - Deleted
C:\571.TMP - Deleted
C:\572.TMP - Deleted
C:\582.TMP - Deleted
C:\583.TMP - Deleted
C:\586.TMP - Deleted
C:\58C.TMP - Deleted
C:\58D.TMP - Deleted
C:\58E.TMP - Deleted
C:\1.TMP - Deleted
C:\2.TMP - Deleted
C:\4.TMP - Deleted
C:\5.TMP - Deleted
C:\7.TMP - Deleted
C:\8.TMP - Deleted
C:\54E.TMP - Deleted
C:\554.TMP - Deleted
C:\56F.TMP - Deleted
C:\574.TMP - Deleted
C:\575.TMP - Deleted
C:\578.TMP - Deleted
C:\577.TMP - Deleted
C:\57A.TMP - Deleted
C:\57B.TMP - Deleted
C:\57C.TMP - Deleted
C:\57D.TMP - Deleted
C:\580.TMP - Deleted
C:\584.TMP - Deleted
C:\585.TMP - Deleted
C:\588.TMP - Deleted
C:\590.TMP - Deleted
C:\591.TMP - Deleted
C:\592.TMP - Deleted
C:\593.TMP - Deleted
C:\596.TMP - Deleted
C:\597.TMP - Deleted
C:\598.TMP - Deleted
C:\599.TMP - Deleted
C:\59C.TMP - Deleted
C:\59D.TMP - Deleted
C:\59E.TMP - Deleted
C:\59F.TMP - Deleted
C:\5A0.TMP - Deleted
C:\5A1.TMP - Deleted
C:\5A2.TMP - Deleted
C:\5A9.TMP - Deleted
C:\5A4.TMP - Deleted
C:\5A5.TMP - Deleted
C:\5A8.TMP - Deleted
C:\5AA.TMP - Deleted
C:\5AD.TMP - Deleted
C:\5AE.TMP - Deleted
C:\5AF.TMP - Deleted
C:\5B0.TMP - Deleted
C:\5B1.TMP - Deleted
C:\5B2.TMP - Deleted
C:\5B3.TMP - Deleted
C:\5B4.TMP - Deleted
C:\5BD.TMP - Deleted
C:\5B7.TMP - Deleted
C:\5B8.TMP - Deleted
C:\5BA.TMP - Deleted
C:\5BB.TMP - Deleted
C:\5BF.TMP - Deleted
C:\5C5.TMP - Deleted
C:\5C6.TMP - Deleted
C:\5C7.TMP - Deleted
C:\9.TMP - Deleted
C:\10.TMP - Deleted
C:\C.TMP - Deleted
C:\E.TMP - Deleted
C:\11.TMP - Deleted
C:\13.TMP - Deleted
C:\17.TMP - Deleted
C:\18.TMP - Deleted
C:\19.TMP - Deleted
C:\1A.TMP - Deleted
C:\20.TMP - Deleted
C:\21.TMP - Deleted
C:\22.TMP - Deleted
C:\2A.TMP - Deleted
C:\2D.TMP - Deleted
C:\2F.TMP - Deleted
C:\31.TMP - Deleted
C:\32.TMP - Deleted
C:\33.TMP - Deleted
C:\38.TMP - Deleted
C:\39.TMP - Deleted
C:\3A.TMP - Deleted
C:\46.TMP - Deleted
C:\4B.TMP - Deleted
C:\4C.TMP - Deleted
C:\4F.TMP - Deleted
C:\56.TMP - Deleted
C:\57.TMP - Deleted
C:\59.TMP - Deleted
C:\5A.TMP - Deleted
C:\5B.TMP - Deleted
C:\61.TMP - Deleted
C:\63.TMP - Deleted
C:\66.TMP - Deleted
C:\68.TMP - Deleted
C:\6B.TMP - Deleted
C:\72.TMP - Deleted
C:\77.TMP - Deleted
C:\78.TMP - Deleted
C:\79.TMP - Deleted
C:\80.TMP - Deleted
C:\85.TMP - Deleted
C:\86.TMP - Deleted
C:\87.TMP - Deleted
C:\8D.TMP - Deleted
C:\92.TMP - Deleted
C:\93.TMP - Deleted
C:\94.TMP - Deleted
C:\9A.TMP - Deleted
C:\9F.TMP - Deleted
C:\A0.TMP - Deleted
C:\A1.TMP - Deleted
C:\AE.TMP - Deleted
C:\B3.TMP - Deleted
C:\B4.TMP - Deleted
C:\B5.TMP - Deleted
C:\BC.TMP - Deleted
C:\C1.TMP - Deleted
C:\C2.TMP - Deleted
C:\C3.TMP - Deleted
C:\CA.TMP - Deleted
C:\CF.TMP - Deleted
C:\D0.TMP - Deleted
C:\D1.TMP - Deleted
C:\E2.TMP - Deleted
C:\E7.TMP - Deleted
C:\E8.TMP - Deleted
C:\E9.TMP - Deleted
C:\54F.TMP - Deleted
C:\594.TMP - Deleted
C:\5A3.TMP - Deleted
C:\5A7.TMP - Deleted
C:\5AB.TMP - Deleted
C:\5C2.TMP - Deleted
C:\5C3.TMP - Deleted
C:\5C8.TMP - Deleted
C:\5C9.TMP - Deleted
C:\5CE.TMP - Deleted
C:\5CF.TMP - Deleted
C:\5D0.TMP - Deleted
C:\5D1.TMP - Deleted
C:\5D3.TMP - Deleted
C:\5D6.TMP - Deleted
C:\5D8.TMP - Deleted
C:\5D9.TMP - Deleted
C:\5DA.TMP - Deleted
C:\5DC.TMP - Deleted
C:\5E0.TMP - Deleted
C:\5E1.TMP - Deleted
C:\5E2.TMP - Deleted
C:\5E3.TMP - Deleted
C:\5E8.TMP - Deleted
C:\5E9.TMP - Deleted
C:\5EA.TMP - Deleted
C:\5EB.TMP - Deleted
C:\5ED.TMP - Deleted
C:\5F0.TMP - Deleted
C:\5F2.TMP - Deleted
C:\5F3.TMP - Deleted
C:\5F4.TMP - Deleted
C:\5F6.TMP - Deleted
C:\5F9.TMP - Deleted
C:\5FB.TMP - Deleted
C:\5FC.TMP - Deleted
C:\5FD.TMP - Deleted
C:\5FF.TMP - Deleted
C:\602.TMP - Deleted
C:\604.TMP - Deleted
C:\605.TMP - Deleted
C:\607.TMP - Deleted
C:\60C.TMP - Deleted
C:\60D.TMP - Deleted
C:\60E.TMP - Deleted
C:\60F.TMP - Deleted
C:\614.TMP - Deleted
C:\615.TMP - Deleted
C:\616.TMP - Deleted
C:\617.TMP - Deleted
C:\61C.TMP - Deleted
C:\61D.TMP - Deleted
C:\61E.TMP - Deleted
C:\61F.TMP - Deleted
C:\624.TMP - Deleted
C:\625.TMP - Deleted
C:\626.TMP - Deleted
C:\627.TMP - Deleted
C:\62C.TMP - Deleted
C:\62D.TMP - Deleted
C:\62E.TMP - Deleted
C:\A.TMP - Deleted
C:\1D.TMP - Deleted
C:\1E.TMP - Deleted
C:\23.TMP - Deleted
C:\6.TMP - Deleted
C:\26.TMP - Deleted
C:\27.TMP - Deleted
C:\28.TMP - Deleted
C:\29.TMP - Deleted
C:\3B.TMP - Deleted
C:\3C.TMP - Deleted
C:\3D.TMP - Deleted
C:\Documents and Settings\a\new.txt - Deleted
C:\Documents and Settings\a\spooldr.ini - Deleted
C:\DOCUME~1\a\LOCALS~1\Temp\winlogon.exe - Deleted
C:\A.tmp - Deleted
C:\WINDOWS\antiv.exe - Deleted
C:\WINDOWS\system32\DefLib.sys - Deleted
C:\WINDOWS\system32\icf.exe - Deleted
C:\WINDOWS\system32\svcp.csv - Deleted
C:\WINDOWS\system32\windows_log.txt - Deleted
C:\WINDOWS\system32\winsub.xml - Deleted

Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.

Final Check:

Remaining Services:
------------------

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule"
"C:\\Program Files\\Sop Cast\\SopCast.exe"="C:\\Program Files\\Sop Cast\\SopCast.exe:*:Enabled:SopCast"
"C:\\Program Files\\Fichiers communs\\Synacast\\SynaLive\\PE.exe"="C:\\Program Files\\Fichiers communs\\Synacast\\SynaLive\\PE.exe:*:Enabled:SynacastPE"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.0"
"C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"
"C:\\WINDOWS\\spooldr.exe"="C:\\WINDOWS\\spooldr.exe:*:Enabled:enable"
"C:\\Documents and Settings\\a\\Local Settings\\Temp\\winlogon.exe"="C:\\Documents and Settings\\a\\Local Settings\\Temp\\winlogon.exe:*:Disabled:winlogon"
"C:\\WINDOWS\\system32\\svchost.exe"="C:\\WINDOWS\\system32\\svchost.exe:*:Enabled:svchost"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.0"
"C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

Remaining Files:
---------------

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes:

C:\WINDOWS\system32\NTICDMK32.dll
C:\WINDOWS\system32\NTIMPEG2.dll
C:\WINDOWS\system32\ntiembed.dll
C:\Program Files\Canon\Canon iP90 Setup Utility\uinstrsc.dll
C:\Program Files\Canon\Canon iP90 Setup Utility\Maint.exe
C:\WINDOWS\SoftwareDistribution\Download\60ca6af11040112be1355236afadeb90\BIT42.tmp
C:\Documents and Settings\a\Mes documents\~WRL0498.tmp
C:\Documents and Settings\a\Mes documents\~WRL2892.tmp
C:\Documents and Settings\a\Mes documents\cv\~WRL0002.tmp

Finished!

OK.

Peux-tu éditer un nouveau rapport Hijackthis ?

FillPCA

dernier hijackthis :

Logfile of HijackThis v1.99.1
Scan saved at 21:54:37, on 15/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\PROGRA~1\LAUNCH~1\LManager.EXE
C:\Program Files\Ulead Systems\Ulead Video@Home 2.0\monitor.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\PROGRA~1\WANADOO\TaskBarIcon.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\eMule\emule.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Documents and Settings\a\Bureau\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://home.neuf.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://as.starware.com/dp/search?x=wKX1ILEOi+Vh7AfA98Gm4Nh4mHWDdShFq0rj6sVvCfYBIMUSTnCpFYuFsVL/PAMxkaKSmMmgzbfPhtb7KPfEh+20iHAeGElvknz/yyHYaAVGHiUX7Xl9KvP7ltP/+bwm3hPn9hRmvGfJ/VLLvBDpJzBsuUIcJsZBbjttwnXjdDrdbV5UcELGyshPnpOsz+oW
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\WANADOO\SEARCH~1.DLL
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O2 - BHO: Starware - {F7C7AA47-BCA6-451D-8DBC-C10A8F75C8C7} - C:\Program Files\Starware\bin\Starware.dll (file missing)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Starware - {9839B3B7-3F99-4498-884D-6CFCCD251AB1} - C:\Program Files\Starware\bin\Starware.dll (file missing)
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.EXE
O4 - HKLM\..\Run: [Ulead Video@Home Scheduling Wizard] C:\Program Files\Ulead Systems\Ulead Video@Home 2.0\monitor.exe
O4 - HKLM\..\Run: [BO1HelperStartUp] C:\PROGRA~1\BUTTER~1\BO1HEL~1.EXE /partner BO1
O4 - HKLM\..\Run: [NsUpdate] C:\WINDOWS\NsUpdate.exe UPDATE
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\WANADOO\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\WANADOO\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Configuration de la neuf Box] C:\Program Files\neuf telecom\neuf Box\Wizard\QuickAccess.exe
O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697516} (NsvPlayX Control) - http://www.nullsoft.com/nsv/embed/nsvplayx_vp6_mp3.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0ADFB544-E512-449A-8814-D82C82F4E75D}: NameServer = 208.254.4.3
O17 - HKLM\System\CCS\Services\Tcpip\..\{53FE03FF-8418-4350-AF58-38F3E97626DA}: NameServer = 208.254.4.3
O17 - HKLM\System\CCS\Services\Tcpip\..\{57B75F4D-3445-49A7-AB18-EC8C51CE6C1D}: NameServer = 208.254.4.3
O17 - HKLM\System\CCS\Services\Tcpip\..\{98064786-F020-4B58-8674-EA4FF46D6517}: NameServer = 208.254.4.3
O17 - HKLM\System\CCS\Services\Tcpip\..\{AA63B722-7AF4-4E30-B0AC-EB660492C41F}: NameServer = 208.254.4.3
O17 - HKLM\System\CS1\Services\Tcpip\..\{0ADFB544-E512-449A-8814-D82C82F4E75D}: NameServer = 208.254.4.3
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Notebook Manager Service (anbmService) - Unknown owner - C:\Acer\eManager\anbmServ.exe (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

Re,

Peux-tu fermer Emule, au moins le temps du nettoyage ?

1/ Place Hijackthis dans un répertoire dédié comme C/\HJT

2/ Ouvre Hijackthis>"Do a scan only" et coche ceci :
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://as.starware.com/
O2 - BHO: Starware - {F7C7AA47-BCA6-451D-8DBC-C10A8F75C8C7} - C:\Program Files\Starware\bin\Starware.dll (file missing)
O3 - Toolbar: Starware - {9839B3B7-3F99-4498-884D-6CFCCD251AB1} - C:\Program Files\Starware\bin\Starware.dll (file missing)
O4 - HKLM\..\Run: [NsUpdate] C:\WINDOWS\NsUpdate.exe UPDATE

Clique sur fix/réparer.

3/ * Télécharger smitfraudfix (de S!Ri) sur le bureau : http://siri.urz.free.fr/Fix/SmitfraudFix.exe
* Clique sur smitfraudfix.exe
* Choisis l'option 1 et colle dans ta réponse le rapport généré par smitfraudfix. Ce rapport se trouve dans la fenêtre du bloc-note qui s’ouvre.
* Ferme l'application en tapant sur la touche Q.

Je vais sans doute décrocher ce soir, mais je regarde cela demain pour qu'on termine.

Tu ne m'a pas répondu concernant les lignes 17 et l'adresse vers laquelle elles pointent. Ca te dit quelquechose ?
https://whois.domaintools.com/208.254.4.3

FillPCA

Concernat les lignes 17 aucune idées, je c pa si c normal et pour l'adresse sa dit rien a ma femme !! voici le rapport :

SmitFraudFix v2.224

Rapport fait à 22:21:45,40, 15/09/2007
Executé à partir de C:\Documents and Settings\a\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est FAT32
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\PROGRA~1\LAUNCH~1\LManager.EXE
C:\Program Files\Ulead Systems\Ulead Video@Home 2.0\monitor.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\PROGRA~1\WANADOO\TaskBarIcon.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\a

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\a\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\a\Favoris

»»»»»»»»»»»»»»»»»»»»»»»» Bureau

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» Rustock

»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{0ADFB544-E512-449A-8814-D82C82F4E75D}: NameServer=208.254.4.3
HKLM\SYSTEM\CCS\Services\Tcpip\..\{53FE03FF-8418-4350-AF58-38F3E97626DA}: NameServer=208.254.4.3
HKLM\SYSTEM\CCS\Services\Tcpip\..\{57B75F4D-3445-49A7-AB18-EC8C51CE6C1D}: NameServer=208.254.4.3
HKLM\SYSTEM\CCS\Services\Tcpip\..\{92A85EDE-5E85-45C6-8B48-2A70F5B88A2E}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{98064786-F020-4B58-8674-EA4FF46D6517}: NameServer=208.254.4.3
HKLM\SYSTEM\CCS\Services\Tcpip\..\{AA63B722-7AF4-4E30-B0AC-EB660492C41F}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{AA63B722-7AF4-4E30-B0AC-EB660492C41F}: NameServer=208.254.4.3
HKLM\SYSTEM\CS1\Services\Tcpip\..\{0ADFB544-E512-449A-8814-D82C82F4E75D}: NameServer=208.254.4.3
HKLM\SYSTEM\CS1\Services\Tcpip\..\{53FE03FF-8418-4350-AF58-38F3E97626DA}: NameServer=208.254.4.3
HKLM\SYSTEM\CS1\Services\Tcpip\..\{57B75F4D-3445-49A7-AB18-EC8C51CE6C1D}: NameServer=208.254.4.3
HKLM\SYSTEM\CS1\Services\Tcpip\..\{92A85EDE-5E85-45C6-8B48-2A70F5B88A2E}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{98064786-F020-4B58-8674-EA4FF46D6517}: NameServer=208.254.4.3
HKLM\SYSTEM\CS1\Services\Tcpip\..\{AA63B722-7AF4-4E30-B0AC-EB660492C41F}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{AA63B722-7AF4-4E30-B0AC-EB660492C41F}: NameServer=208.254.4.3
HKLM\SYSTEM\CS3\Services\Tcpip\..\{0ADFB544-E512-449A-8814-D82C82F4E75D}: NameServer=208.254.4.3
HKLM\SYSTEM\CS3\Services\Tcpip\..\{53FE03FF-8418-4350-AF58-38F3E97626DA}: NameServer=208.254.4.3
HKLM\SYSTEM\CS3\Services\Tcpip\..\{57B75F4D-3445-49A7-AB18-EC8C51CE6C1D}: NameServer=208.254.4.3
HKLM\SYSTEM\CS3\Services\Tcpip\..\{92A85EDE-5E85-45C6-8B48-2A70F5B88A2E}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{98064786-F020-4B58-8674-EA4FF46D6517}: NameServer=208.254.4.3
HKLM\SYSTEM\CS3\Services\Tcpip\..\{AA63B722-7AF4-4E30-B0AC-EB660492C41F}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{AA63B722-7AF4-4E30-B0AC-EB660492C41F}: NameServer=208.254.4.3
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1

»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

»»»»»»»»»»»»»»»»»»»»»»»» Fin

Bonjour,

1/ * Télécharge OTMoveIt (de Old_Timer) sur ton bureau : http://download.bleepingcomputer.com/oldtimer/OTMoveIt.exe
* Double-clique sur OTMoveIt.exe pour lancer le programme,
* Copie la liste de fichiers ou de dossiers ci-dessous et colle-la dans la fenêtre du programme "Paste List Of Files/Folders to be moved" :

C:\WINDOWS\NsUpdate.exe

* Clique sur MoveIt! pour lancer la suppression,
* Le résultat appraraîtra dans le cadre Results.
* Clique sur Exit pour fermer le programme.
* Poste le rapport qui est situé ici : C:\\\_OTMoveIt\MovedFiles
* Il te sera peut-être demandé de redémarrer ton PC. Dans ce cas, clique sur Yes.

2/ Désactive temporairement Avast. Il est incompatible avec le scan en ligne Panda.

3/ * Fais un scan en ligne en cliquant ici : http://assiste.com.free.fr/...
* Choisis Panda.
* Tu dois réaliser le scan en utilisant Internet explorer. Une information apparait en haut, près de la barre d'état. Tu dois accepter et installer l'activeX proposé. La mise à jour de l'antivirus se lance.
* Réalise un scan complet du système.
* Sauvegarde le rapport en mode texte à l'issue du scan.

4/ Réactive Avast.

5/ Edite le rapport Panda.

FillPCA

Salut! ben j'ai pa trouvé le dossier ou le fichier nsupdate. Et pour le scan en ligne l'ordi de ma femme ne connecte plu au net. Que faire ?? Que faire ???

Re,

J'avais zappé le fait que tu ne parviens plus à te connecter au net.

Ca confirme mes doutes sur les 17.

1/
* Télécharge FixWareout d'un de ces deux sites sur le bureau:

http://downloads.subratam.org/Fixwareout.exe
http://swandog46.geekstogo.com/Fixwareout.exe

* Lance le fix: clique sur Next, puis Install, puis assure toi que "Run fixit" est activé puis clique sur Finish.
* Le fix va commencer, suis les messages à l'écran.
* Il te sera demandé de redémarrer ton ordinateur, fais le. Ton système mettra un peu plus de temps au démarrage, c'est normal.
* Poste (Copie/colle) le contenu du rapport qui va s'afficher à l'écran (report.txt)

2/ Edite aussi un rapport Hijackthis et dis-moi si la connexion au net est possible.

FillPCA

Ben g toujours pa le net, voici le rapport de fixwareout :

Username "a" - 16/09/2007 9:45:44 [Fixwareout edited 9/01/2007]

~~~~~ Prerun check

System was rebooted successfully.

~~~~~ Postrun check
HKLM\SOFTWARE\~\Winlogon\ "System"=""
....
....
~~~~~ Misc files.
....
~~~~~ Checking for older varients.
....

~~~~~ Current runs (hklm hkcu "run" Keys Only)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\\WINDOWS\\system32\\igfxtray.exe"
"HotKeysCmds"="C:\\WINDOWS\\system32\\hkcmd.exe"
"LaunchApp"="Alaunch"
"SoundMan"="SOUNDMAN.EXE"
"AGRSMMSG"="AGRSMMSG.exe"
"LtMoh"="C:\\Program Files\\ltmoh\\Ltmoh.exe"
"SynTPLpr"="C:\\Program Files\\Synaptics\\SynTP\\SynTPLpr.exe"
"SynTPEnh"="C:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe"
"RemoteControl"="\"C:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe\""
"IMJPMIG8.1"="\"C:\\WINDOWS\\IME\\imjp8_1\\IMJPMIG.EXE\" /Spoil /RemAdvDef /Migration32"
"MSPY2002"="C:\\WINDOWS\\system32\\IME\\PINTLGNT\\ImScInst.exe /SYNC"
"PHIME2002ASync"="C:\\WINDOWS\\system32\\IME\\TINTLGNT\\TINTSETP.EXE /SYNC"
"PHIME2002A"="C:\\WINDOWS\\system32\\IME\\TINTLGNT\\TINTSETP.EXE /IMEName"
"EPM-DM"="c:\\acer\\epm\\epm-dm.exe"
"ePowerManagement"="C:\\Acer\\ePM\\ePM.exe boot"
"LManager"="C:\\PROGRA~1\\LAUNCH~1\\LManager.EXE"
"Ulead Video@Home Scheduling Wizard"="C:\\Program Files\\Ulead Systems\\Ulead Video@Home 2.0\\monitor.exe"
"BO1HelperStartUp"="C:\\PROGRA~1\\BUTTER~1\\BO1HEL~1.EXE /partner BO1"
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"avast!"="C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe"
"Easy-PrintToolBox"="C:\\Program Files\\Canon\\Easy-PrintToolBox\\BJPSMAIN.EXE /logon"
"WOOWATCH"="C:\\PROGRA~1\\WANADOO\\Watch.exe"
"WOOTASKBARICON"="C:\\PROGRA~1\\WANADOO\\GestMaj.exe TaskBarIcon.exe"
"KernelFaultCheck"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,\
65,6d,33,32,5c,64,75,6d,70,72,65,70,20,30,20,2d,6b,00
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.6.0_02\\bin\\jusched.exe\""
"!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\ctfmon.exe"
"Skype"="\"C:\\Program Files\\Skype\\Phone\\Skype.exe\" /nosplash /minimized"
"Configuration de la neuf Box"="C:\\Program Files\\neuf telecom\\neuf Box\\Wizard\\QuickAccess.exe"
"eMuleAutoStart"="C:\\Program Files\\eMule\\emule.exe -AutoStart"
....
Hosts file was reset, If you use a custom hosts file please replace it...
~~~~~ End report ~~~~~

et le rapport hijackthis :

Logfile of HijackThis v1.99.1
Scan saved at 09:50:59, on 16/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\PROGRA~1\LAUNCH~1\LManager.EXE
C:\Program Files\Ulead Systems\Ulead Video@Home 2.0\monitor.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\WANADOO\TaskBarIcon.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://home.neuf.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\WANADOO\SEARCH~1.DLL
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.EXE
O4 - HKLM\..\Run: [Ulead Video@Home Scheduling Wizard] C:\Program Files\Ulead Systems\Ulead Video@Home 2.0\monitor.exe
O4 - HKLM\..\Run: [BO1HelperStartUp] C:\PROGRA~1\BUTTER~1\BO1HEL~1.EXE /partner BO1
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\WANADOO\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\WANADOO\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Configuration de la neuf Box] C:\Program Files\neuf telecom\neuf Box\Wizard\QuickAccess.exe
O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697516} (NsvPlayX Control) - http://www.nullsoft.com/nsv/embed/nsvplayx_vp6_mp3.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0ADFB544-E512-449A-8814-D82C82F4E75D}: NameServer = 208.254.4.3
O17 - HKLM\System\CCS\Services\Tcpip\..\{53FE03FF-8418-4350-AF58-38F3E97626DA}: NameServer = 208.254.4.3
O17 - HKLM\System\CCS\Services\Tcpip\..\{57B75F4D-3445-49A7-AB18-EC8C51CE6C1D}: NameServer = 208.254.4.3
O17 - HKLM\System\CCS\Services\Tcpip\..\{98064786-F020-4B58-8674-EA4FF46D6517}: NameServer = 208.254.4.3
O17 - HKLM\System\CCS\Services\Tcpip\..\{AA63B722-7AF4-4E30-B0AC-EB660492C41F}: NameServer = 208.254.4.3
O17 - HKLM\System\CS1\Services\Tcpip\..\{0ADFB544-E512-449A-8814-D82C82F4E75D}: NameServer = 208.254.4.3
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Notebook Manager Service (anbmService) - Unknown owner - C:\Acer\eManager\anbmServ.exe (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

Re,

Relance smitfraudfix puis choisis l'option 5.

Poste le rapport généré avec un nouveau rapport Hijackthis.
Dis-moi si la connexion a été rétablie.

FillPCA

Ya tjrs pas le net etvoici les rapports

SMITFRAUDIX:

SmitFraudFix v2.224

Rapport fait à 10:17:37,84, 16/09/2007
Executé à partir de C:\Documents and Settings\a\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est FAT32
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» DNS Avant Fix

HKLM\SYSTEM\CCS\Services\Tcpip\..\{0ADFB544-E512-449A-8814-D82C82F4E75D}: NameServer=208.254.4.3
HKLM\SYSTEM\CCS\Services\Tcpip\..\{53FE03FF-8418-4350-AF58-38F3E97626DA}: NameServer=208.254.4.3
HKLM\SYSTEM\CCS\Services\Tcpip\..\{57B75F4D-3445-49A7-AB18-EC8C51CE6C1D}: NameServer=208.254.4.3
HKLM\SYSTEM\CCS\Services\Tcpip\..\{92A85EDE-5E85-45C6-8B48-2A70F5B88A2E}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{98064786-F020-4B58-8674-EA4FF46D6517}: NameServer=208.254.4.3
HKLM\SYSTEM\CCS\Services\Tcpip\..\{AA63B722-7AF4-4E30-B0AC-EB660492C41F}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{AA63B722-7AF4-4E30-B0AC-EB660492C41F}: NameServer=208.254.4.3
HKLM\SYSTEM\CS1\Services\Tcpip\..\{0ADFB544-E512-449A-8814-D82C82F4E75D}: NameServer=208.254.4.3
HKLM\SYSTEM\CS1\Services\Tcpip\..\{53FE03FF-8418-4350-AF58-38F3E97626DA}: NameServer=208.254.4.3
HKLM\SYSTEM\CS1\Services\Tcpip\..\{57B75F4D-3445-49A7-AB18-EC8C51CE6C1D}: NameServer=208.254.4.3
HKLM\SYSTEM\CS1\Services\Tcpip\..\{92A85EDE-5E85-45C6-8B48-2A70F5B88A2E}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{98064786-F020-4B58-8674-EA4FF46D6517}: NameServer=208.254.4.3
HKLM\SYSTEM\CS1\Services\Tcpip\..\{AA63B722-7AF4-4E30-B0AC-EB660492C41F}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{AA63B722-7AF4-4E30-B0AC-EB660492C41F}: NameServer=208.254.4.3
HKLM\SYSTEM\CS3\Services\Tcpip\..\{0ADFB544-E512-449A-8814-D82C82F4E75D}: NameServer=208.254.4.3
HKLM\SYSTEM\CS3\Services\Tcpip\..\{53FE03FF-8418-4350-AF58-38F3E97626DA}: NameServer=208.254.4.3
HKLM\SYSTEM\CS3\Services\Tcpip\..\{57B75F4D-3445-49A7-AB18-EC8C51CE6C1D}: NameServer=208.254.4.3
HKLM\SYSTEM\CS3\Services\Tcpip\..\{92A85EDE-5E85-45C6-8B48-2A70F5B88A2E}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{98064786-F020-4B58-8674-EA4FF46D6517}: NameServer=208.254.4.3
HKLM\SYSTEM\CS3\Services\Tcpip\..\{AA63B722-7AF4-4E30-B0AC-EB660492C41F}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{AA63B722-7AF4-4E30-B0AC-EB660492C41F}: NameServer=208.254.4.3
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1

»»»»»»»»»»»»»»»»»»»»»»»» DNS Après Fix

HKLM\SYSTEM\CCS\Services\Tcpip\..\{0ADFB544-E512-449A-8814-D82C82F4E75D}: NameServer=208.254.4.3
HKLM\SYSTEM\CCS\Services\Tcpip\..\{53FE03FF-8418-4350-AF58-38F3E97626DA}: NameServer=208.254.4.3
HKLM\SYSTEM\CCS\Services\Tcpip\..\{57B75F4D-3445-49A7-AB18-EC8C51CE6C1D}: NameServer=208.254.4.3
HKLM\SYSTEM\CCS\Services\Tcpip\..\{92A85EDE-5E85-45C6-8B48-2A70F5B88A2E}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{98064786-F020-4B58-8674-EA4FF46D6517}: NameServer=208.254.4.3
HKLM\SYSTEM\CCS\Services\Tcpip\..\{AA63B722-7AF4-4E30-B0AC-EB660492C41F}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{AA63B722-7AF4-4E30-B0AC-EB660492C41F}: NameServer=208.254.4.3
HKLM\SYSTEM\CS1\Services\Tcpip\..\{0ADFB544-E512-449A-8814-D82C82F4E75D}: NameServer=208.254.4.3
HKLM\SYSTEM\CS1\Services\Tcpip\..\{53FE03FF-8418-4350-AF58-38F3E97626DA}: NameServer=208.254.4.3
HKLM\SYSTEM\CS1\Services\Tcpip\..\{57B75F4D-3445-49A7-AB18-EC8C51CE6C1D}: NameServer=208.254.4.3
HKLM\SYSTEM\CS1\Services\Tcpip\..\{92A85EDE-5E85-45C6-8B48-2A70F5B88A2E}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{98064786-F020-4B58-8674-EA4FF46D6517}: NameServer=208.254.4.3
HKLM\SYSTEM\CS1\Services\Tcpip\..\{AA63B722-7AF4-4E30-B0AC-EB660492C41F}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{AA63B722-7AF4-4E30-B0AC-EB660492C41F}: NameServer=208.254.4.3
HKLM\SYSTEM\CS3\Services\Tcpip\..\{0ADFB544-E512-449A-8814-D82C82F4E75D}: NameServer=208.254.4.3
HKLM\SYSTEM\CS3\Services\Tcpip\..\{53FE03FF-8418-4350-AF58-38F3E97626DA}: NameServer=208.254.4.3
HKLM\SYSTEM\CS3\Services\Tcpip\..\{57B75F4D-3445-49A7-AB18-EC8C51CE6C1D}: NameServer=208.254.4.3
HKLM\SYSTEM\CS3\Services\Tcpip\..\{92A85EDE-5E85-45C6-8B48-2A70F5B88A2E}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{98064786-F020-4B58-8674-EA4FF46D6517}: NameServer=208.254.4.3
HKLM\SYSTEM\CS3\Services\Tcpip\..\{AA63B722-7AF4-4E30-B0AC-EB660492C41F}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{AA63B722-7AF4-4E30-B0AC-EB660492C41F}: NameServer=208.254.4.3
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1

et celui de hijackthis :

Logfile of HijackThis v1.99.1
Scan saved at 10:20:11, on 16/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\PROGRA~1\LAUNCH~1\LManager.EXE
C:\Program Files\Ulead Systems\Ulead Video@Home 2.0\monitor.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\WANADOO\TaskBarIcon.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://home.neuf.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\WANADOO\SEARCH~1.DLL
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.EXE
O4 - HKLM\..\Run: [Ulead Video@Home Scheduling Wizard] C:\Program Files\Ulead Systems\Ulead Video@Home 2.0\monitor.exe
O4 - HKLM\..\Run: [BO1HelperStartUp] C:\PROGRA~1\BUTTER~1\BO1HEL~1.EXE /partner BO1
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\WANADOO\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\WANADOO\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Configuration de la neuf Box] C:\Program Files\neuf telecom\neuf Box\Wizard\QuickAccess.exe
O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697516} (NsvPlayX Control) - http://www.nullsoft.com/nsv/embed/nsvplayx_vp6_mp3.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0ADFB544-E512-449A-8814-D82C82F4E75D}: NameServer = 208.254.4.3
O17 - HKLM\System\CCS\Services\Tcpip\..\{53FE03FF-8418-4350-AF58-38F3E97626DA}: NameServer = 208.254.4.3
O17 - HKLM\System\CCS\Services\Tcpip\..\{57B75F4D-3445-49A7-AB18-EC8C51CE6C1D}: NameServer = 208.254.4.3
O17 - HKLM\System\CCS\Services\Tcpip\..\{98064786-F020-4B58-8674-EA4FF46D6517}: NameServer = 208.254.4.3
O17 - HKLM\System\CCS\Services\Tcpip\..\{AA63B722-7AF4-4E30-B0AC-EB660492C41F}: NameServer = 208.254.4.3
O17 - HKLM\System\CS1\Services\Tcpip\..\{0ADFB544-E512-449A-8814-D82C82F4E75D}: NameServer = 208.254.4.3
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Notebook Manager Service (anbmService) - Unknown owner - C:\Acer\eManager\anbmServ.exe (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe