Virus Win32.agent -LNK (Wm) - Page 2

  1. Mary
    Quelqu'un peut-il venir à mon secours? j'ai posté les rapports dans la page précédente, et comme je ne sais pas quoi supprimer, je demande...
    Merci à ceux qui veulent bien m'aider!
    Mary
    0
    1. jlpjlp Contributeur sécurité
      scan avec

      fx istbar

      https://www.broadcom.com/support/security-center

      _________________

      vire ces deux fichiers en allant dans poste de travail puis .... (si presents)

      C:\Documents and Settings\MAISON 2\Bureau\clé usb\boutvis\TuneUp_Utilities_2004_v4[2].1.2318_Multilanguage.zip

      F:\Pour Jouer\Majonguesetup\MyPlayCity_WhenUSave_Installer.exe

      _________________

      combofix (colle le rapport)
      http://download.bleepingcomputer.com/sUBs/ComboFix.exe

      _________________

      donne moi le nom exact du fichier trouvé comme infécté par avast
      0
      1. Mary
        Merci!

        Alors, voila, les deux fichiers sont supprimés, le nom exact du fichier infecté et signalé par avast est smtpdrv.sys, il est dans :
        C:\WINDOWS\system32\drivers.

        Le scan de symantec donne :

        Symantec Adware.Istbar / Trojan.ISTsvc Removal Tool 1.1.0

        registry: HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main: Search Bar (value deleted)
        registry: HKEY_USERS\S-1-5-21-1962516476-1565252573-596074764-1006\Software\Microsoft\Internet Explorer\Main: Search Bar (value deleted)
        registry: HKEY_USERS\S-1-5-21-1962516476-1565252573-596074764-1006\Software\Microsoft\Internet Explorer\Search: SearchAssistant (value deleted)

        C:\Documents and Settings\MAISON 2\Bureau\Utile\Clé usb\Nancy\Stage\Stage\Stage\Stage\Stage\Stage\Stage\Stage\Stage\Stage\Stage\Stage\Stage\Stage\Stage\Stage\Stage\Stage\Stage\Stage\Stage\Stage\Stage\Stage\Stage\Stage\Stage\Stage\Stage\Stage\Stage\Stage\Stage: (not scanned)
        C:\Documents and Settings\MAISON 2\Local Settings\Application Data\Microsoft\Messenger\marie_timac@hotmail.com\SharingMetadata\miss_lili_30@hotmail.com\DFSR\Staging\CS{BF53482E-7FAA-6668-DAC3-8F700681FB54}\01\127-{BF53482E-7FAA-6668-DAC3-8F700681FB54}-v1-{8E1DBB7F-8803-46E5-BE2F-FD394BF7A062}-v127-Downloaded.frx (WARNING: not scanned, path to long)
        C:\Documents and Settings\MAISON 2\Local Settings\Application Data\Microsoft\Messenger\marie_timac@hotmail.com\SharingMetadata\pierrickmartinez@hotmail.com\DFSR\Staging\CS{5E8AFFA7-3BDF-073A-4694-7CD42DFF03B0}\01\10-{5E8AFFA7-3BDF-073A-4694-7CD42DFF03B0}-v1-{8E1DBB7F-8803-46E5-BE2F-FD394BF7A062}-v10-Downloaded.frx (WARNING: not scanned, path to long)
        C:\Documents and Settings\MAISON 2\Local Settings\Application Data\Microsoft\Messenger\marie_timac@hotmail.com\SharingMetadata\pierrickmartinez@hotmail.com\DFSR\Staging\CS{5E8AFFA7-3BDF-073A-4694-7CD42DFF03B0}\11\11-{9BFAE866-4F2A-4083-B9DB-7CD5D5E465F8}-v11-{8E1DBB7F-8803-46E5-BE2F-FD394BF7A062}-v11-Downloaded.frx (WARNING: not scanned, path to long)
        C:\Documents and Settings\MAISON 2\Local Settings\Application Data\Microsoft\Messenger\marie_timac@hotmail.com\SharingMetadata\pierrickmartinez@hotmail.com\DFSR\Staging\CS{5E8AFFA7-3BDF-073A-4694-7CD42DFF03B0}\54\257-{2227D85F-2FEA-417D-9CED-BA115F66DE70}-v254-{2227D85F-2FEA-417D-9CED-BA115F66DE70}-v257-Downloaded.frx (WARNING: not scanned, path to long)
        C:\Documents and Settings\MAISON 2\Local Settings\Application Data\Microsoft\Messenger\marie_timac@hotmail.com\SharingMetadata\st_poncet@hotmail.com\DFSR\Staging\CS{A3407B29-5473-B8F1-0CAA-1383301D3323}\01\12-{A3407B29-5473-B8F1-0CAA-1383301D3323}-v1-{8E1DBB7F-8803-46E5-BE2F-FD394BF7A062}-v12-Downloaded.frx (WARNING: not scanned, path to long)
        C:\Documents and Settings\MAISON 2\Local Settings\Application Data\Microsoft\Messenger\marie_timac@hotmail.com\SharingMetadata\st_poncet@hotmail.com\DFSR\Staging\CS{A3407B29-5473-B8F1-0CAA-1383301D3323}\01\181-{8E1DBB7F-8803-46E5-BE2F-FD394BF7A062}-v101-{9BFAE866-4F2A-4083-B9DB-7CD5D5E465F8}-v181-Downloaded.frx (WARNING: not scanned, path to long)
        C:\Documents and Settings\MAISON 2\Local Settings\Application Data\Microsoft\Messenger\marie_timac@hotmail.com\SharingMetadata\st_poncet@hotmail.com\DFSR\Staging\CS{A3407B29-5473-B8F1-0CAA-1383301D3323}\11\40-{376C63C5-A299-423A-A7DC-C6C74C5F8FF4}-v11-{8E1DBB7F-8803-46E5-BE2F-FD394BF7A062}-v40-Downloaded.frx (WARNING: not scanned, path to long)
        C:\Documents and Settings\MAISON 2\Local Settings\Application Data\Microsoft\Messenger\marie_timac@hotmail.com\SharingMetadata\st_poncet@hotmail.com\DFSR\Staging\CS{A3407B29-5473-B8F1-0CAA-1383301D3323}\19\173-{9BFAE866-4F2A-4083-B9DB-7CD5D5E465F8}-v19-{9BFAE866-4F2A-4083-B9DB-7CD5D5E465F8}-v173-Downloaded.frx (WARNING: not scanned, path to long)
        C:\Documents and Settings\MAISON 2\Local Settings\Application Data\Microsoft\Messenger\marie_timac@hotmail.com\SharingMetadata\st_poncet@hotmail.com\DFSR\Staging\CS{A3407B29-5473-B8F1-0CAA-1383301D3323}\22\183-{376C63C5-A299-423A-A7DC-C6C74C5F8FF4}-v22-{9BFAE866-4F2A-4083-B9DB-7CD5D5E465F8}-v183-Downloaded.frx (WARNING: not scanned, path to long)
        C:\Documents and Settings\MAISON 2\Local Settings\Application Data\Microsoft\Messenger\marie_timac@hotmail.com\SharingMetadata\st_poncet@hotmail.com\DFSR\Staging\CS{A3407B29-5473-B8F1-0CAA-1383301D3323}\23\194-{376C63C5-A299-423A-A7DC-C6C74C5F8FF4}-v23-{9BFAE866-4F2A-4083-B9DB-7CD5D5E465F8}-v194-Downloaded.frx (WARNING: not scanned, path to long)
        C:\Documents and Settings\MAISON 2\Local Settings\Application Data\Microsoft\Messenger\marie_timac@hotmail.com\SharingMetadata\st_poncet@hotmail.com\DFSR\Staging\CS{A3407B29-5473-B8F1-0CAA-1383301D3323}\24\195-{376C63C5-A299-423A-A7DC-C6C74C5F8FF4}-v24-{9BFAE866-4F2A-4083-B9DB-7CD5D5E465F8}-v195-Downloaded.frx (WARNING: not scanned, path to long)
        C:\Documents and Settings\MAISON 2\Local Settings\Application Data\Microsoft\Messenger\marie_timac@hotmail.com\SharingMetadata\st_poncet@hotmail.com\DFSR\Staging\CS{A3407B29-5473-B8F1-0CAA-1383301D3323}\25\192-{376C63C5-A299-423A-A7DC-C6C74C5F8FF4}-v25-{9BFAE866-4F2A-4083-B9DB-7CD5D5E465F8}-v192-Downloaded.frx (WARNING: not scanned, path to long)
        C:\Documents and Settings\MAISON 2\Local Settings\Application Data\Microsoft\Messenger\marie_timac@hotmail.com\SharingMetadata\st_poncet@hotmail.com\DFSR\Staging\CS{A3407B29-5473-B8F1-0CAA-1383301D3323}\26\187-{376C63C5-A299-423A-A7DC-C6C74C5F8FF4}-v26-{9BFAE866-4F2A-4083-B9DB-7CD5D5E465F8}-v187-Downloaded.frx (WARNING: not scanned, path to long)
        C:\Documents and Settings\MAISON 2\Local Settings\Application Data\Microsoft\Messenger\marie_timac@hotmail.com\SharingMetadata\st_poncet@hotmail.com\DFSR\Staging\CS{A3407B29-5473-B8F1-0CAA-1383301D3323}\27\156-{9BFAE866-4F2A-4083-B9DB-7CD5D5E465F8}-v27-{9BFAE866-4F2A-4083-B9DB-7CD5D5E465F8}-v156-Downloaded.frx (WARNING: not scanned, path to long)
        C:\Documents and Settings\MAISON 2\Local Settings\Application Data\Microsoft\Messenger\marie_timac@hotmail.com\SharingMetadata\st_poncet@hotmail.com\DFSR\Staging\CS{A3407B29-5473-B8F1-0CAA-1383301D3323}\27\188-{376C63C5-A299-423A-A7DC-C6C74C5F8FF4}-v27-{9BFAE866-4F2A-4083-B9DB-7CD5D5E465F8}-v188-Downloaded.frx (WARNING: not scanned, path to long)
        C:\Documents and Settings\MAISON 2\Local Settings\Application Data\Microsoft\Messenger\marie_timac@hotmail.com\SharingMetadata\st_poncet@hotmail.com\DFSR\Staging\CS{A3407B29-5473-B8F1-0CAA-1383301D3323}\28\189-{376C63C5-A299-423A-A7DC-C6C74C5F8FF4}-v28-{9BFAE866-4F2A-4083-B9DB-7CD5D5E465F8}-v189-Downloaded.frx (WARNING: not scanned, path to long)
        C:\Documents and Settings\MAISON 2\Local Settings\Application Data\Microsoft\Messenger\marie_timac@hotmail.com\SharingMetadata\st_poncet@hotmail.com\DFSR\Staging\CS{A3407B29-5473-B8F1-0CAA-1383301D3323}\29\157-{9BFAE866-4F2A-4083-B9DB-7CD5D5E465F8}-v29-{9BFAE866-4F2A-4083-B9DB-7CD5D5E465F8}-v157-Downloaded.frx (WARNING: not scanned, path to long)
        C:\Documents and Settings\MAISON 2\Local Settings\Application Data\Microsoft\Messenger\marie_timac@hotmail.com\SharingMetadata\st_poncet@hotmail.com\DFSR\Staging\CS{A3407B29-5473-B8F1-0CAA-1383301D3323}\31\158-{9BFAE866-4F2A-4083-B9DB-7CD5D5E465F8}-v31-{9BFAE866-4F2A-4083-B9DB-7CD5D5E465F8}-v158-Downloaded.frx (WARNING: not scanned, path to long)
        C:\Documents and Settings\MAISON 2\Local Settings\Application Data\Microsoft\Messenger\marie_timac@hotmail.com\SharingMetadata\st_poncet@hotmail.com\DFSR\Staging\CS{A3407B29-5473-B8F1-0CAA-1383301D3323}\34\37-{8E1DBB7F-8803-46E5-BE2F-FD394BF7A062}-v34-{8E1DBB7F-8803-46E5-BE2F-FD394BF7A062}-v37-Downloaded.frx (WARNING: not scanned, path to long)
        C:\Documents and Settings\MAISON 2\Local Settings\Application Data\Microsoft\Messenger\marie_timac@hotmail.com\SharingMetadata\st_poncet@hotmail.com\DFSR\Staging\CS{A3407B29-5473-B8F1-0CAA-1383301D3323}\39\161-{9BFAE866-4F2A-4083-B9DB-7CD5D5E465F8}-v39-{9BFAE866-4F2A-4083-B9DB-7CD5D5E465F8}-v161-Downloaded.frx (WARNING: not scanned, path to long)
        C:\Documents and Settings\MAISON 2\Local Settings\Application Data\Microsoft\Messenger\marie_timac@hotmail.com\SharingMetadata\st_poncet@hotmail.com\DFSR\Staging\CS{A3407B29-5473-B8F1-0CAA-1383301D3323}\41\162-{9BFAE866-4F2A-4083-B9DB-7CD5D5E465F8}-v41-{9BFAE866-4F2A-4083-B9DB-7CD5D5E465F8}-v162-Downloaded.frx (WARNING: not scanned, path to long)
        C:\Documents and Settings\MAISON 2\Local Settings\Application Data\Microsoft\Messenger\marie_timac@hotmail.com\SharingMetadata\st_poncet@hotmail.com\DFSR\Staging\CS{A3407B29-5473-B8F1-0CAA-1383301D3323}\43\163-{9BFAE866-4F2A-4083-B9DB-7CD5D5E465F8}-v43-{9BFAE866-4F2A-4083-B9DB-7CD5D5E465F8}-v163-Downloaded.frx (WARNING: not scanned, path to long)
        C:\Documents and Settings\MAISON 2\Local Settings\Application Data\Microsoft\Messenger\marie_timac@hotmail.com\SharingMetadata\st_poncet@hotmail.com\DFSR\Staging\CS{A3407B29-5473-B8F1-0CAA-1383301D3323}\45\164-{9BFAE866-4F2A-4083-B9DB-7CD5D5E465F8}-v45-{9BFAE866-4F2A-4083-B9DB-7CD5D5E465F8}-v164-Downloaded.frx (WARNING: not scanned, path to long)
        C:\Documents and Settings\MAISON 2\Local Settings\Application Data\Microsoft\Messenger\marie_timac@hotmail.com\SharingMetadata\st_poncet@hotmail.com\DFSR\Staging\CS{A3407B29-5473-B8F1-0CAA-1383301D3323}\47\165-{9BFAE866-4F2A-4083-B9DB-7CD5D5E465F8}-v47-{9BFAE866-4F2A-4083-B9DB-7CD5D5E465F8}-v165-Downloaded.frx (WARNING: not scanned, path to long)
        C:\Documents and Settings\MAISON 2\Local Settings\Application Data\Microsoft\Messenger\marie_timac@hotmail.com\SharingMetadata\st_poncet@hotmail.com\DFSR\Staging\CS{A3407B29-5473-B8F1-0CAA-1383301D3323}\52\166-{9BFAE866-4F2A-4083-B9DB-7CD5D5E465F8}-v52-{9BFAE866-4F2A-4083-B9DB-7CD5D5E465F8}-v166-Downloaded.frx (WARNING: not scanned, path to long)
        C:\Documents and Settings\MAISON 2\Local Settings\Application Data\Microsoft\Messenger\marie_timac@hotmail.com\SharingMetadata\st_poncet@hotmail.com\DFSR\Staging\CS{A3407B29-5473-B8F1-0CAA-1383301D3323}\57\168-{9BFAE866-4F2A-4083-B9DB-7CD5D5E465F8}-v57-{9BFAE866-4F2A-4083-B9DB-7CD5D5E465F8}-v168-Downloaded.frx (WARNING: not scanned, path to long)
        C:\Documents and Settings\MAISON 2\Local Settings\Application Data\Microsoft\Messenger\marie_timac@hotmail.com\SharingMetadata\st_poncet@hotmail.com\DFSR\Staging\CS{A3407B29-5473-B8F1-0CAA-1383301D3323}\59\169-{9BFAE866-4F2A-4083-B9DB-7CD5D5E465F8}-v59-{9BFAE866-4F2A-4083-B9DB-7CD5D5E465F8}-v169-Downloaded.frx (WARNING: not scanned, path to long)
        C:\Documents and Settings\MAISON 2\Local Settings\Application Data\Microsoft\Messenger\marie_timac@hotmail.com\SharingMetadata\st_poncet@hotmail.com\DFSR\Staging\CS{A3407B29-5473-B8F1-0CAA-1383301D3323}\66\171-{9BFAE866-4F2A-4083-B9DB-7CD5D5E465F8}-v66-{9BFAE866-4F2A-4083-B9DB-7CD5D5E465F8}-v171-Downloaded.frx (WARNING: not scanned, path to long)
        C:\Documents and Settings\MAISON 2\Local Settings\Application Data\Microsoft\Messenger\marie_timac@hotmail.com\SharingMetadata\st_poncet@hotmail.com\DFSR\Staging\CS{A3407B29-5473-B8F1-0CAA-1383301D3323}\67\130-{8E1DBB7F-8803-46E5-BE2F-FD394BF7A062}-v67-{9BFAE866-4F2A-4083-B9DB-7CD5D5E465F8}-v130-Downloaded.frx (WARNING: not scanned, path to long)
        C:\Documents and Settings\MAISON 2\Local Settings\Application Data\Microsoft\Messenger\marie_timac@hotmail.com\SharingMetadata\st_poncet@hotmail.com\DFSR\Staging\CS{A3407B29-5473-B8F1-0CAA-1383301D3323}\68\148-{8E1DBB7F-8803-46E5-BE2F-FD394BF7A062}-v68-{9BFAE866-4F2A-4083-B9DB-7CD5D5E465F8}-v148-Downloaded.frx (WARNING: not scanned, path to long)
        C:\Documents and Settings\MAISON 2\Local Settings\Application Data\Microsoft\Messenger\marie_timac@hotmail.com\SharingMetadata\st_poncet@hotmail.com\DFSR\Staging\CS{A3407B29-5473-B8F1-0CAA-1383301D3323}\69\149-{8E1DBB7F-8803-46E5-BE2F-FD394BF7A062}-v69-{9BFAE866-4F2A-4083-B9DB-7CD5D5E465F8}-v149-Downloaded.frx (WARNING: not scanned, path to long)
        C:\Documents and Settings\MAISON 2\Local Settings\Application Data\Microsoft\Messenger\marie_timac@hotmail.com\SharingMetadata\st_poncet@hotmail.com\DFSR\Staging\CS{A3407B29-5473-B8F1-0CAA-1383301D3323}\70\151-{8E1DBB7F-8803-46E5-BE2F-FD394BF7A062}-v70-{9BFAE866-4F2A-4083-B9DB-7CD5D5E465F8}-v151-Downloaded.frx (WARNING: not scanned, path to long)
        C:\Documents and Settings\MAISON 2\Local Settings\Application Data\Microsoft\Messenger\marie_timac@hotmail.com\SharingMetadata\st_poncet@hotmail.com\DFSR\Staging\CS{A3407B29-5473-B8F1-0CAA-1383301D3323}\71\152-{8E1DBB7F-8803-46E5-BE2F-FD394BF7A062}-v71-{9BFAE866-4F2A-4083-B9DB-7CD5D5E465F8}-v152-Downloaded.frx (WARNING: not scanned, path to long)
        C:\Documents and Settings\MAISON 2\Local Settings\Application Data\Microsoft\Messenger\marie_timac@hotmail.com\SharingMetadata\st_poncet@hotmail.com\DFSR\Staging\CS{A3407B29-5473-B8F1-0CAA-1383301D3323}\72\153-{8E1DBB7F-8803-46E5-BE2F-FD394BF7A062}-v72-{9BFAE866-4F2A-4083-B9DB-7CD5D5E465F8}-v153-Downloaded.frx (WARNING: not scanned, path to long)
        C:\Documents and Settings\MAISON 2\Local Settings\Application Data\Microsoft\Messenger\marie_timac@hotmail.com\SharingMetadata\st_poncet@hotmail.com\DFSR\Staging\CS{A3407B29-5473-B8F1-0CAA-1383301D3323}\84\150-{8E1DBB7F-8803-46E5-BE2F-FD394BF7A062}-v84-{9BFAE866-4F2A-4083-B9DB-7CD5D5E465F8}-v150-Downloaded.frx (WARNING: not scanned, path to long)
        C:\Documents and Settings\MAISON 2\Local Settings\Application Data\Microsoft\Messenger\marie_timac@hotmail.com\SharingMetadata\st_poncet@hotmail.com\DFSR\Staging\CS{A3407B29-5473-B8F1-0CAA-1383301D3323}\92\176-{8E1DBB7F-8803-46E5-BE2F-FD394BF7A062}-v92-{9BFAE866-4F2A-4083-B9DB-7CD5D5E465F8}-v176-Downloaded.frx (WARNING: not scanned, path to long)
        C:\Documents and Settings\MAISON 2\Local Settings\Application Data\Microsoft\Messenger\marie_timac@hotmail.com\SharingMetadata\st_poncet@hotmail.com\DFSR\Staging\CS{A3407B29-5473-B8F1-0CAA-1383301D3323}\93\174-{8E1DBB7F-8803-46E5-BE2F-FD394BF7A062}-v93-{9BFAE866-4F2A-4083-B9DB-7CD5D5E465F8}-v174-Downloaded.frx (WARNING: not scanned, path to long)
        C:\Documents and Settings\MAISON 2\Local Settings\Application Data\Microsoft\Messenger\marie_timac@hotmail.com\SharingMetadata\st_poncet@hotmail.com\DFSR\Staging\CS{A3407B29-5473-B8F1-0CAA-1383301D3323}\94\175-{8E1DBB7F-8803-46E5-BE2F-FD394BF7A062}-v94-{9BFAE866-4F2A-4083-B9DB-7CD5D5E465F8}-v175-Downloaded.frx (WARNING: not scanned, path to long)
        C:\Documents and Settings\MAISON 2\Local Settings\Application Data\Microsoft\Messenger\marie_timac@hotmail.com\SharingMetadata\st_poncet@hotmail.com\DFSR\Staging\CS{A3407B29-5473-B8F1-0CAA-1383301D3323}\99\180-{8E1DBB7F-8803-46E5-BE2F-FD394BF7A062}-v99-{9BFAE866-4F2A-4083-B9DB-7CD5D5E465F8}-v180-Downloaded.frx (WARNING: not scanned, path to long)
        C:\System Volume Information: (not scanned)
        Adware.Istbar has not been found on your computer.

        Le scan de combofix donne :

        ComboFix 08-01-23.1C - MAISON 2 2008-01-25 14:10:11.1 - NTFSx86
        Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.298 [GMT 1:00]
        Endroit: C:\Documents and Settings\MAISON 2\Bureau\ComboFix.exe
        * Création d'un nouveau point de restauration

        [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!/b/color
        .
        /wow section - STAGE 1

        (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
        .

        C:\Program Files\Helper
        C:\Program Files\Helper\superfindout.dll
        C:\WINDOWS\system32\6_exception.nls
        C:\WINDOWS\system32\lt.res
        C:\WINDOWS\system32\sft.res

        .
        ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

        .
        -------\LEGACY_SMTPDRV
        -------\runtime
        -------\smtpdrv

        ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-12-25 to 2008-01-25 ))))))))))))))))))))))))))))))))))))
        .

        2008-01-25 14:07 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\Nircmd.exe
        2008-01-23 15:52 . 2008-01-24 21:54 <REP> d-------- C:\Program Files\Navilog1
        2008-01-23 00:01 . 2008-01-23 21:41 <REP> d-------- C:\WINDOWS\BDOSCAN8
        2008-01-21 23:56 . 2008-01-22 23:42 <REP> d-------- C:\Program Files\Panda Security
        2008-01-21 22:51 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
        2008-01-21 12:59 . 2008-01-21 12:59 <REP> d-------- C:\Program Files\Trend Micro
        2008-01-20 23:37 . 2008-01-25 14:14 25,984 --a------ C:\WINDOWS\system32\drivers\Hpa58.sys
        2008-01-20 23:37 . 2008-01-20 23:37 2 --a--c--- C:\-1872345472
        2008-01-20 23:36 . 2008-01-20 23:36 54,764 --a------ C:\WINDOWS\system32\drivers\drtya
        2008-01-18 20:04 . 2005-10-15 12:32 196,608 --a------ C:\WINDOWS\system32\pdfcmnnt.dll
        2008-01-18 20:04 . 1998-06-24 00:00 137,000 --a------ C:\WINDOWS\system32\MSMAPI32.OCX
        2008-01-18 20:04 . 1998-07-06 00:00 23,552 --a------ C:\WINDOWS\system32\MSMPIDE.DLL
        2008-01-18 20:02 . 2008-01-18 20:04 <REP> d-------- C:\Program Files\PDF creator
        2008-01-18 18:37 . 2008-01-24 19:45 54,156 --ah----- C:\WINDOWS\QTFont.qfn
        2008-01-18 18:37 . 2008-01-18 18:37 1,409 --a------ C:\WINDOWS\QTFont.for
        2008-01-18 18:36 . 2008-01-18 18:36 <REP> d-------- C:\Program Files\iTunes
        2008-01-18 18:36 . 2008-01-18 18:36 <REP> d-------- C:\Program Files\iPod
        2008-01-18 18:34 . 2008-01-18 18:35 <REP> d-------- C:\Program Files\QuickTime
        2008-01-12 14:56 . 2008-01-12 16:33 <REP> d-------- C:\WINDOWS\system32\Carte du monde Voyages SNCF dir
        2008-01-12 14:52 . 2008-01-12 16:33 <REP> d-------- C:\WINDOWS\system32\Images du monde Voyages SNCF dir
        2008-01-10 15:27 . 2008-01-10 15:27 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
        2008-01-10 15:27 . 2008-01-10 15:27 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts
        2008-01-08 16:52 . 2008-01-08 16:52 <REP> d-------- C:\Program Files\Apple Software Update
        2008-01-08 16:51 . 2008-01-08 16:51 <REP> d-------- C:\Program Files\Fichiers communs\Apple
        2007-12-27 23:28 . 2003-06-12 23:25 7,062 --a------ C:\WINDOWS\system32\audiopid.vxd
        2007-12-27 23:19 . 2007-12-27 23:26 <REP> d-------- C:\Program Files\SightSpeed

        .
        (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
        .
        2008-01-23 15:36 --------- d-----w C:\Program Files\Windows Media Connect 2
        2008-01-23 15:36 --------- d-----w C:\Program Files\Plasma Pong
        2008-01-23 15:36 --------- d-----w C:\Program Files\Dictionnairecantonnais
        2008-01-21 22:46 --------- d-----w C:\Program Files\wanadoo_toolbar
        2008-01-08 18:23 --------- d-----w C:\Program Files\EA GAMES
        2007-12-27 22:33 --------- d-----w C:\Program Files\Creative
        2007-12-27 22:28 --------- d--h--w C:\Program Files\InstallShield Installation Information
        2007-12-06 22:43 --------- d-----w C:\Program Files\Logitech
        2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys
        2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
        2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
        2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
        2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
        2007-11-26 11:42 --------- d-----w C:\Program Files\DAEMON Tools
        .

        ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
        .
        .
        REGEDIT4
        *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

        [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 13:00 15360]
        "Creative Detector"="C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 18:23 102400]
        "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-11 19:11 68856]
        "msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 11:55 5674352]
        "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-09-18 15:16 171464]
        "Creative Live! Cam Manager"="C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe" [2006-05-31 16:00 143360]
        "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-09-24 13:11 22880040]

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "avast!"="F:\POURAN~2\avaste\ashDisp.exe" [2007-12-04 14:00 79224]
        "LVCOMS"="C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE" [2002-12-10 17:54 127022]
        "TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2007-09-14 16:33 185632]
        "AVFX Engine"="C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe" [2006-06-09 01:11 24576]
        "V0220Mon.exe"="C:\WINDOWS\V0220Mon.exe" [2006-06-28 18:01 32768]
        "CreativeTaskScheduler"="C:\Program Files\Creative\Shared Files\CTSched.exe" [2006-01-09 03:43 53340]
        "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312]

        [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
        "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 13:00 15360]
        "DWQueuedReporting"="C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [2005-04-25 12:45 36040]
        "Picasa Media Detector"="F:\Pour Voir\Pikasa\Picasa2\PicasaMediaDetector.exe" [2007-09-28 02:17 443968]

        C:\Documents and Settings\MAISON 2\Menu D‚marrer\Programmes\D‚marrage\
        Adobe Gamma.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2005-08-23 17:27:58 110592]
        RocketDock.lnk - C:\Program Files\interface vista\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-03-18 23:05:02 630784]

        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
        "DisableRegistryTools"= 0 (0x0)

        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Hpa58.sys]
        @="Driver"

        [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Adobe Gamma Loader.lnk]
        path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Adobe Gamma Loader.lnk
        backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

        [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Reader.lnk]
        path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Lancement rapide d'Adobe Reader.lnk
        backup=C:\WINDOWS\pss\Lancement rapide d'Adobe Reader.lnkCommon Startup

        [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk]
        path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk
        backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
        --a------ 2004-07-20 09:22 57344 C:\WINDOWS\ALCMTR.EXE

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcWzrd]
        --a------ 2004-09-15 10:20 2557952 C:\WINDOWS\ALCWZRD.EXE

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
        --a------ 2004-08-12 20:10 339968 C:\ATI Technologies\ATI Control Panel\atiptaxx.exe

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]
        --a------ 2004-08-05 13:00 110592 C:\WINDOWS\system32\bthprops.cpl

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DXM6Patch_981116]
        --a------ 1998-11-30 18:04 497376 C:\WINDOWS\p_981116.exe

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
        --a------ 2004-08-05 13:00 208952 C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
        --a------ 2001-09-04 22:30 28738 C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
        --a------ 2001-07-09 09:50 155648 C:\WINDOWS\system32\NeroCheck.exe

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService]
        --a------ 2004-10-08 02:14 81920 c:\Apps\Powercinema\PCMService.exe

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
        --a------ 2004-08-05 13:00 455168 C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
        --a------ 2004-08-05 13:00 455168 C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Raccourci vers la page des propriétés de High Definition Audio]
        --a------ 2004-03-17 14:10 61952 C:\WINDOWS\system32\Hdaudpropshortcut.exe

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
        --a------ 2004-09-10 17:29 77824 C:\WINDOWS\SoundMan.exe

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec NetDriver Monitor]
        C:\PROGRA~1\SYMNET~1\SNDMon.exe

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
        --a------ 2007-09-14 16:33 185632 C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe

        R0 Hpa58;Hpa58;C:\WINDOWS\system32\Drivers\Hpa58.sys [2008-01-25 14:14]
        R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 22:08]
        R3 V0220Dev;Live! Cam Video IM;C:\WINDOWS\system32\DRIVERS\V0220Dev.sys [2006-06-29 06:58]
        R3 V0220Vfx;V0220VFX;C:\WINDOWS\system32\DRIVERS\V0220Vfx.sys [2006-06-08 09:00]
        S3 BTNetFilter;Bluetooth Network Filter;C:\WINDOWS\system32\drivers\BTNetFilter.sys [2004-12-16 16:32]
        S3 C-Dilla;C-Dilla;C:\WINDOWS\system32\drivers\CDANT.SYS [2001-04-06 22:24]
        S3 EPPSCSIx;Agfa EPPSCSI Driver;C:\WINDOWS\system32\DRIVERS\EPPSCAN.sys []
        S3 PortlUSB;PortlUSB;C:\WINDOWS\system32\DRIVERS\YH-925.sys [2004-06-24 12:52]
        S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 21:58]

        .
        Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
        "2008-01-18 17:28:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
        - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
        "2005-08-24 21:38:59 C:\WINDOWS\Tasks\HDReg.job"
        - c:\Apps\HDReg\HDRegRem.exe
        "2008-01-18 16:16:29 C:\WINDOWS\Tasks\Maintenance en 1 clic.job"
        - C:\Program Files\TuneUp Utilities 2006\SystemOptimizer.exe
        "2008-01-25 13:18:07 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
        - C:\Program Files\Windows Defender\MpCmdRun.exe
        "2008-01-24 14:00:00 C:\WINDOWS\Tasks\vider le dossier prefetch automatiquement.job"
        - C:\WINDOWS\prefetchnet.net
        .
        **************************************************************************

        catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
        Rootkit scan 2008-01-25 14:16:10
        Windows 5.1.2600 Service Pack 2 NTFS

        Balayage processus cach‚s ...

        Balayage cach‚ autostart entries ...

        Balayage des fichiers cach‚s ...

        Scan termin‚ avec succŠs
        Les fichiers cach‚s: 0

        **************************************************************************
        .
        --------------------- DLLs a charg‚ sous des processus courants ---------------------

        PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2900.3156]
        -> C:\Program Files\interface vista\Vista Inspirat 2\RocketDock\RocketDock.dll
        .
        Temps d'accomplissement: 2008-01-25 14:18:43 - machine was rebooted
        ComboFix-quarantined-files.txt 2008-01-25 13:18:40
        .
        2008-01-24 23:34:19 --- E O F ---

        Voivi un exemple d'un avertissement avast

        Message suspect :
        Il y a trop de mails identiques envoyés dans un faible intervalle de temps

        Expéditeur : "Heidi Mcneal" <vkpuusnn@bonesframedpictures.com>
        Destinataire : <resume@aonix.com>
        Sujet : Lean and mean is in!

        Et un autre... (pour le plaisir)

        Message suspect :
        Il y a trop de mails identiques envoyés dans un faible intervalle de temps

        Expéditeur : "Elsie Eastman" <teijidovazquez@yahoo.es>
        Destinataire : <dcmoore@wellington.com>
        Sujet : Tired of being overweight? We can help!
        0
        1. jlpjlp Contributeur sécurité
          Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau.
          http://downloads.andymanchesta.com/RemovalTools/SDFix.exe
          Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici :
          • Redémarre ton ordinateur
          • Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (une pression par seconde).
          • A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.
          • Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".
          • Choisis ton compte.
          Déroule la liste des instructions ci-dessous :
          • Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script.
          • Appuie sur Y pour commencer le processus de nettoyage.
          • Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
          • Appuie sur une touche pour redémarrer le PC.
          • Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
          • Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
          • Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
          • Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
          • Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum

          ______________________

          c'est ca le fichiers exact???

          C:\WINDOWS\system32\drivers\smtpdrv.sys

          _________________

          analyse ces fichiers sur virus total et colle moi les rapports: https://www.virustotal.com/gui/

          C:\WINDOWS\system32\drivers\drtya
          C:\WINDOWS\system32\Drivers\Hpa58.sys
          0
          2. Mary
            Merci de ton aide, mais je ne vais pas avoir accès à mon ordi jusqu'à vendredi. je ferais ça et je reposte dans la journée du vendredi.
            Encore merci et à la semaine prochaine !
            bonne nuit, mary
            0
            2. Mary
              Alors me revoilà!
              J'ai bien téléchargé SDfix, mais il ne connaît pas la touche Y, il y a A, B, C, D, 1, 2, 3, et E pour exit.
              Qu'est-ce qui cloche avec mon fichier infecté??? lol.
              Et virustotal me dit ca quand je veux lancer l'analyse : "0 bytes size received / Se ha recibido un archivo vacio"

              Voila, j'espère que tu vas pouvoir m'aider!
              a plus tard, Mary
              0
              1. Mary
                En fait, c'est carrément le mode sans échec que je peux pas mettre en route! quand je fais f8, j'ai un menu qui apparait 'boot menu' ou il me propose disquette, disque dur, cd rom, et realtek boot agent... surement pour redémarrer windows. Mais pas de mode sans échec... coment je peux y accéder?
                0
                1. jlpjlp Contributeur sécurité
                  Ferme tout tes navigateurs (donc copie ou imprime les instructions avant)

                  Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :

                  Driver ::
                  Hpa58

                  File::
                  C:\WINDOWS\system32\Drivers\Hpa58.sys
                  C:\WINDOWS\system32\drivers\smtpdrv.sys

                  Registry::
                  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Hpa58.sys]

                  Enregistre ce fichier sous le nom CFscript

                  Fait un glisser/déposer de ce fichier CFscrïpt sur le fichier ComboFix.exe

                  Clique sur le fichier CFScript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFScript vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.

                  Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

                  Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

                  Ne touche à rien tant que le scan n'est pas terminé.

                  Une fois le scan achevé, un rapport va s'afficher: poste son contenu.

                  Remets aussi un rapport Hijackthis

                  Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt
                  0
                  1. Mary
                    Hello, voici le rapport ComboFix :

                    ComboFix 08-01-23.1C - MAISON 2 2008-01-31 22:58:40.2 - NTFSx86
                    Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.472 [GMT 1:00]
                    Endroit: C:\Documents and Settings\MAISON 2\Bureau\ComboFix.exe
                    Command switches used :: C:\Documents and Settings\MAISON 2\Bureau\CFScript.txt
                    * Création d'un nouveau point de restauration

                    [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]

                    FILE
                    C:\WINDOWS\system32\Drivers\Hpa58.sys
                    C:\WINDOWS\system32\drivers\smtpdrv.sys
                    .
                    /wow section - STAGE 1

                    (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
                    .

                    C:\WINDOWS\system32\Drivers\Hpa58.sys . . . . Echec de suppression
                    .
                    ---- Previous Run -------
                    .
                    C:\Program Files\Helper
                    C:\Program Files\Helper\superfindout.dll
                    C:\WINDOWS\system32\6_exception.nls
                    C:\WINDOWS\system32\lt.res
                    C:\WINDOWS\system32\sft.res

                    .
                    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

                    .
                    -------\LEGACY_SMTPDRV
                    -------\runtime
                    -------\smtpdrv

                    -------\smtpdrv

                    ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-12-28 to 2008-01-31 ))))))))))))))))))))))))))))))))))))
                    .

                    2008-01-25 14:07 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\Nircmd.exe
                    2008-01-23 15:52 . 2008-01-24 21:54 <REP> d-------- C:\Program Files\Navilog1
                    2008-01-23 00:01 . 2008-01-23 21:41 <REP> d-------- C:\WINDOWS\BDOSCAN8
                    2008-01-21 23:56 . 2008-01-22 23:42 <REP> d-------- C:\Program Files\Panda Security
                    2008-01-21 22:51 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
                    2008-01-21 12:59 . 2008-01-21 12:59 <REP> d-------- C:\Program Files\Trend Micro
                    2008-01-20 23:37 . 2008-01-31 23:02 25,984 --a------ C:\WINDOWS\system32\drivers\Hpa58.sys
                    2008-01-20 23:37 . 2008-01-20 23:37 2 --a--c--- C:\-1872345472
                    2008-01-20 23:36 . 2008-01-20 23:36 54,764 --a------ C:\WINDOWS\system32\drivers\drtya
                    2008-01-18 20:04 . 2005-10-15 12:32 196,608 --a------ C:\WINDOWS\system32\pdfcmnnt.dll
                    2008-01-18 20:04 . 1998-06-24 00:00 137,000 --a------ C:\WINDOWS\system32\MSMAPI32.OCX
                    2008-01-18 20:04 . 1998-07-06 00:00 23,552 --a------ C:\WINDOWS\system32\MSMPIDE.DLL
                    2008-01-18 20:02 . 2008-01-18 20:04 <REP> d-------- C:\Program Files\PDF creator
                    2008-01-18 18:37 . 2008-01-24 19:45 54,156 --ah----- C:\WINDOWS\QTFont.qfn
                    2008-01-18 18:37 . 2008-01-18 18:37 1,409 --a------ C:\WINDOWS\QTFont.for
                    2008-01-18 18:36 . 2008-01-18 18:36 <REP> d-------- C:\Program Files\iTunes
                    2008-01-18 18:36 . 2008-01-18 18:36 <REP> d-------- C:\Program Files\iPod
                    2008-01-18 18:34 . 2008-01-18 18:35 <REP> d-------- C:\Program Files\QuickTime
                    2008-01-12 14:56 . 2008-01-12 16:33 <REP> d-------- C:\WINDOWS\system32\Carte du monde Voyages SNCF dir
                    2008-01-12 14:52 . 2008-01-12 16:33 <REP> d-------- C:\WINDOWS\system32\Images du monde Voyages SNCF dir
                    2008-01-10 15:27 . 2008-01-10 15:27 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
                    2008-01-10 15:27 . 2008-01-10 15:27 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts
                    2008-01-08 16:52 . 2008-01-08 16:52 <REP> d-------- C:\Program Files\Apple Software Update
                    2008-01-08 16:51 . 2008-01-08 16:51 <REP> d-------- C:\Program Files\Fichiers communs\Apple
                    2007-12-27 23:28 . 2003-06-12 23:25 7,062 --a------ C:\WINDOWS\system32\audiopid.vxd
                    2007-12-27 23:19 . 2007-12-27 23:26 <REP> d-------- C:\Program Files\SightSpeed
                    2007-12-09 17:10 . 2007-12-09 17:10 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll

                    .
                    (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                    .
                    2008-01-23 15:36 --------- d-----w C:\Program Files\Windows Media Connect 2
                    2008-01-23 15:36 --------- d-----w C:\Program Files\Plasma Pong
                    2008-01-23 15:36 --------- d-----w C:\Program Files\Dictionnairecantonnais
                    2008-01-21 22:46 --------- d-----w C:\Program Files\wanadoo_toolbar
                    2008-01-08 18:23 --------- d-----w C:\Program Files\EA GAMES
                    2007-12-27 22:33 --------- d-----w C:\Program Files\Creative
                    2007-12-27 22:28 --------- d--h--w C:\Program Files\InstallShield Installation Information
                    2007-12-06 22:43 --------- d-----w C:\Program Files\Logitech
                    2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys
                    2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
                    2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
                    2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
                    2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
                    .

                    ((((((((((((((((((((((((((((( snapshot@2008-01-25_14.18.17.40 )))))))))))))))))))))))))))))))))))))))))
                    .
                    - 2008-01-25 13:09:52 237,568 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT
                    + 2008-01-31 21:58:04 237,568 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT
                    - 2008-01-25 13:09:52 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
                    + 2008-01-31 21:58:04 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
                    - 2008-01-25 13:09:52 233,472 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\NTUSER.DAT
                    + 2008-01-31 21:58:04 233,472 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\NTUSER.DAT
                    - 2008-01-25 13:09:53 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
                    + 2008-01-31 21:58:04 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
                    - 2008-01-25 13:09:53 7,307,264 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\ntuser.dat
                    + 2008-01-31 21:58:04 7,307,264 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\ntuser.dat
                    - 2008-01-25 13:09:53 221,184 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
                    + 2008-01-31 21:58:04 221,184 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
                    + 2008-01-31 22:03:53 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_2f4.dat
                    - 2008-01-25 13:15:14 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_4cc.dat
                    + 2008-01-31 22:03:30 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_4cc.dat
                    .
                    ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
                    .
                    .
                    REGEDIT4
                    *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

                    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 13:00 15360]
                    "Creative Detector"="C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 18:23 102400]
                    "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-11 19:11 68856]
                    "msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 11:55 5674352]
                    "Creative Live! Cam Manager"="C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe" [2006-05-31 16:00 143360]
                    "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-09-24 13:11 22880040]

                    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                    "avast!"="F:\POURAN~2\avaste\ashDisp.exe" [2007-12-04 14:00 79224]
                    "LVCOMS"="C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE" [2002-12-10 17:54 127022]
                    "TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2007-09-14 16:33 185632]
                    "AVFX Engine"="C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe" [2006-06-09 01:11 24576]
                    "V0220Mon.exe"="C:\WINDOWS\V0220Mon.exe" [2006-06-28 18:01 32768]
                    "CreativeTaskScheduler"="C:\Program Files\Creative\Shared Files\CTSched.exe" [2006-01-09 03:43 53340]
                    "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312]

                    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 13:00 15360]
                    "DWQueuedReporting"="C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [2005-04-25 12:45 36040]
                    "Picasa Media Detector"="F:\Pour Voir\Pikasa\Picasa2\PicasaMediaDetector.exe" [2007-09-28 02:17 443968]

                    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
                    "DisableRegistryTools"= 0 (0x0)

                    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Hpa58.sys]
                    @="Driver"

                    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Adobe Gamma Loader.lnk]
                    path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Adobe Gamma Loader.lnk
                    backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

                    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Reader.lnk]
                    path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Lancement rapide d'Adobe Reader.lnk
                    backup=C:\WINDOWS\pss\Lancement rapide d'Adobe Reader.lnkCommon Startup

                    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk]
                    path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk
                    backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

                    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
                    --a------ 2004-07-20 09:22 57344 C:\WINDOWS\ALCMTR.EXE

                    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcWzrd]
                    --a------ 2004-09-15 10:20 2557952 C:\WINDOWS\ALCWZRD.EXE

                    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
                    --a------ 2004-08-12 20:10 339968 C:\ATI Technologies\ATI Control Panel\atiptaxx.exe

                    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]
                    --a------ 2004-08-05 13:00 110592 C:\WINDOWS\system32\bthprops.cpl

                    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DXM6Patch_981116]
                    --a------ 1998-11-30 18:04 497376 C:\WINDOWS\p_981116.exe

                    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
                    --a------ 2004-08-05 13:00 208952 C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe

                    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
                    --a------ 2001-09-04 22:30 28738 C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe

                    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
                    --a------ 2001-07-09 09:50 155648 C:\WINDOWS\system32\NeroCheck.exe

                    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService]
                    --a------ 2004-10-08 02:14 81920 c:\Apps\Powercinema\PCMService.exe

                    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
                    --a------ 2004-08-05 13:00 455168 C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe

                    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
                    --a------ 2004-08-05 13:00 455168 C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe

                    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Raccourci vers la page des propriétés de High Definition Audio]
                    --a------ 2004-03-17 14:10 61952 C:\WINDOWS\system32\Hdaudpropshortcut.exe

                    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
                    --a------ 2004-09-10 17:29 77824 C:\WINDOWS\SoundMan.exe

                    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec NetDriver Monitor]
                    C:\PROGRA~1\SYMNET~1\SNDMon.exe

                    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
                    --a------ 2007-09-14 16:33 185632 C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe

                    R0 Hpa58;Hpa58;C:\WINDOWS\system32\Drivers\Hpa58.sys [2008-01-31 23:02]
                    R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 22:08]
                    R3 V0220Dev;Live! Cam Video IM;C:\WINDOWS\system32\DRIVERS\V0220Dev.sys [2006-06-29 06:58]
                    R3 V0220Vfx;V0220VFX;C:\WINDOWS\system32\DRIVERS\V0220Vfx.sys [2006-06-08 09:00]
                    S3 BTNetFilter;Bluetooth Network Filter;C:\WINDOWS\system32\drivers\BTNetFilter.sys [2004-12-16 16:32]
                    S3 C-Dilla;C-Dilla;C:\WINDOWS\system32\drivers\CDANT.SYS [2001-04-06 22:24]
                    S3 EPPSCSIx;Agfa EPPSCSI Driver;C:\WINDOWS\system32\DRIVERS\EPPSCAN.sys []
                    S3 PortlUSB;PortlUSB;C:\WINDOWS\system32\DRIVERS\YH-925.sys [2004-06-24 12:52]
                    S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 21:58]

                    .
                    Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
                    "2008-01-25 17:28:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
                    - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
                    "2005-08-24 21:38:59 C:\WINDOWS\Tasks\HDReg.job"
                    - c:\Apps\HDReg\HDRegRem.exe
                    "2008-01-28 16:15:00 C:\WINDOWS\Tasks\Maintenance en 1 clic.job"
                    - C:\Program Files\TuneUp Utilities 2006\SystemOptimizer.exe
                    "2008-01-31 22:06:25 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
                    - C:\Program Files\Windows Defender\MpCmdRun.exe
                    "2008-01-31 14:00:00 C:\WINDOWS\Tasks\vider le dossier prefetch automatiquement.job"
                    - C:\WINDOWS\prefetchnet.net
                    .
                    **************************************************************************

                    catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                    Rootkit scan 2008-01-31 23:04:19
                    Windows 5.1.2600 Service Pack 2 NTFS

                    Balayage processus cach‚s ...

                    Balayage cach‚ autostart entries ...

                    Balayage des fichiers cach‚s ...

                    Scan termin‚ avec succŠs
                    Les fichiers cach‚s: 0

                    **************************************************************************
                    .
                    --------------------- DLLs a charg‚ sous des processus courants ---------------------

                    PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2900.3156]
                    -> C:\Program Files\interface vista\Vista Inspirat 2\RocketDock\RocketDock.dll
                    .
                    Temps d'accomplissement: 2008-01-31 23:06:57 - machine was rebooted [MAISON 2]
                    ComboFix-quarantined-files.txt 2008-01-31 22:06:54
                    .
                    2008-01-29 20:00:38 --- E O F ---

                    Et voici le Hijackthis

                    Logfile of Trend Micro HijackThis v2.0.2
                    Scan saved at 23:09, on 2008-01-31
                    Platform: Windows XP SP2 (WinNT 5.01.2600)
                    MSIE: Internet Explorer v7.00 (7.00.6000.16574)
                    Boot mode: Normal

                    Running processes:
                    C:\WINDOWS\System32\smss.exe
                    C:\WINDOWS\system32\winlogon.exe
                    C:\WINDOWS\system32\services.exe
                    C:\WINDOWS\system32\lsass.exe
                    C:\WINDOWS\system32\Ati2evxx.exe
                    C:\WINDOWS\system32\svchost.exe
                    C:\Program Files\Windows Defender\MsMpEng.exe
                    C:\WINDOWS\System32\svchost.exe
                    C:\WINDOWS\system32\svchost.exe
                    F:\Pour antivirus\avaste\aswUpdSv.exe
                    F:\Pour antivirus\avaste\ashServ.exe
                    C:\WINDOWS\system32\Ati2evxx.exe
                    C:\WINDOWS\Explorer.EXE
                    C:\WINDOWS\system32\LEXBCES.EXE
                    C:\WINDOWS\system32\spoolsv.exe
                    C:\WINDOWS\system32\LEXPPS.EXE
                    C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                    C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
                    C:\WINDOWS\system32\CTsvcCDA.EXE
                    C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                    C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
                    C:\WINDOWS\System32\snmp.exe
                    C:\WINDOWS\system32\svchost.exe
                    F:\Pour antivirus\avaste\ashMaiSv.exe
                    F:\Pour antivirus\avaste\ashWebSv.exe
                    F:\POURAN~2\avaste\ashDisp.exe
                    C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
                    C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
                    C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe
                    C:\WINDOWS\V0220Mon.exe
                    C:\Program Files\Creative\Shared Files\CTSched.exe
                    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
                    C:\WINDOWS\system32\ctfmon.exe
                    C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
                    C:\WINDOWS\system32\wuauclt.exe
                    C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe
                    C:\Program Files\Skype\Phone\Skype.exe
                    C:\Program Files\Google\Google Updater\GoogleUpdater.exe
                    C:\Program Files\interface vista\Vista Inspirat 2\RocketDock\RocketDock.exe
                    C:\WINDOWS\System32\svchost.exe
                    C:\WINDOWS\System32\svchost.exe
                    C:\Program Files\Skype\Plugin Manager\SkypePM.exe
                    C:\Program Files\MSN Messenger\usnsvc.exe
                    C:\WINDOWS\system32\NOTEPAD.EXE
                    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

                    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.neuf.fr/
                    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://actus.sfr.fr
                    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
                    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
                    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                    R3 - URLSearchHook: (no name) - {BE89472C-B803-4D1D-9A9A-0A63660E0FE3} - C:\PROGRA~1\COPERN~1\COPERN~1.DLL
                    O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
                    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
                    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
                    O3 - Toolbar: Copernic Agent - {F2E259E8-0FC8-438C-A6E0-342DD80FA53E} - C:\Program Files\Copernic Agent\CopernicAgentExt.dll
                    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
                    O4 - HKLM\..\Run: [avast!] F:\POURAN~2\avaste\ashDisp.exe
                    O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
                    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                    O4 - HKLM\..\Run: [AVFX Engine] C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe
                    O4 - HKLM\..\Run: [V0220Mon.exe] C:\WINDOWS\V0220Mon.exe
                    O4 - HKLM\..\Run: [CreativeTaskScheduler] "C:\Program Files\Creative\Shared Files\CTSched.exe" /logon
                    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
                    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                    O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
                    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
                    O4 - HKCU\..\Run: [Creative Live! Cam Manager] "C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe"
                    O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
                    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                    O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
                    O4 - Startup: RocketDock.lnk = C:\Program Files\interface vista\Vista Inspirat 2\RocketDock\RocketDock.exe
                    O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
                    O8 - Extra context menu item: &Clean Traces - F:\Pour Telecharger\DAP\Privacy Package\dapcleanerie.htm
                    O8 - Extra context menu item: &Download with &DAP - F:\Pour Telecharger\DAP\dapextie.htm
                    O8 - Extra context menu item: Chercher avec Copernic Agent - res://C:\Program Files\Copernic Agent\CopernicAgentExt.rdl/INTEGRATION_MENU_SEARCHEXT
                    O8 - Extra context menu item: Download &all with DAP - F:\Pour Telecharger\DAP\dapextie2.htm
                    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
                    O8 - Extra context menu item: Ouvrir le cadre dans une nouvelle fenêtre - C:\WINDOWS\web\OpenFrame.htm
                    O8 - Extra context menu item: Rechercher avec Voila - file://C:\Program Files\WANADOO_TOOLBAR\Cache\SelectedContextSearch.htm
                    O8 - Extra context menu item: Surligner en Jaune - C:\WINDOWS\web\MarqueurFluoYellow.htm
                    O8 - Extra context menu item: Surligner en Rose - C:\WINDOWS\web\MarqueurFluoPink.htm
                    O8 - Extra context menu item: Surligner en Vert - C:\WINDOWS\web\MarqueurFluoGreen.htm
                    O8 - Extra context menu item: Télécharger avec Star Downloader - F:\Pour Telecharger\Star doneloder\Star Downloader\sdie.htm
                    O8 - Extra context menu item: Voir les cookies - C:\WINDOWS\web\showcookies.htm
                    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                    O9 - Extra button: (no name) - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
                    O9 - Extra 'Tools' menuitem: Démarrer Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
                    O9 - Extra button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
                    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
                    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
                    O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\WINDOWS\system32\shdocvw.dll
                    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
                    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                    O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
                    O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} - https://support.norton.com/sp/en/us/home/current/info
                    O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
                    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
                    O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://drivers1.free.fr/telecharger.php?id=2&version=
                    O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://support.norton.com/sp/en/us/home/current/info
                    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
                    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
                    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - F:\Pour antivirus\avaste\aswUpdSv.exe
                    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
                    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
                    O23 - Service: avast! Antivirus - ALWIL Software - F:\Pour antivirus\avaste\ashServ.exe
                    O23 - Service: avast! Mail Scanner - ALWIL Software - F:\Pour antivirus\avaste\ashMaiSv.exe
                    O23 - Service: avast! Web Scanner - ALWIL Software - F:\Pour antivirus\avaste\ashWebSv.exe
                    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                    O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
                    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
                    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
                    O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
                    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
                    O23 - Service: MysqlInventime - Unknown owner - c:\mysql\bin\mysqld-nt.exe (file missing)
                    O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
                    O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe
                    0
                    1. jlpjlp Contributeur sécurité
                      REFAIS ceci:

                      Ferme tout tes navigateurs (donc copie ou imprime les instructions avant)

                      Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :

                      Driver ::
                      Hpa58

                      File::
                      C:\WINDOWS\system32\Drivers\Hpa58.sys
                      C:\WINDOWS\system32\drivers\smtpdrv.sys

                      Registry::
                      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Hpa58.sys]

                      Enregistre ce fichier sous le nom CFscript

                      Fait un glisser/déposer de ce fichier CFscrïpt sur le fichier ComboFix.exe

                      Clique sur le fichier CFScript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFScript vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.

                      Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

                      Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

                      Ne touche à rien tant que le scan n'est pas terminé.

                      Une fois le scan achevé, un rapport va s'afficher: poste son contenu.

                      Remets aussi un rapport Hijackthis

                      Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

                      ______________________

                      scan ton ordi avec spybot et vire ce qui est trouvé

                      https://www.01net.com/telecharger/windows/Securite/anti-spyware/fiches/26157.html

                      ________________________

                      remplace avast par antivir et colle le rapport:

                      https://www.malekal.com/avira-free-security-antivirus-gratuit/ (merci Malekal)

                      ________________________
                      encore des problemes? lesquels????
                      0
                      1. Mary
                        Voila, bcp de choses à lire en perspective... :-)

                        ComboFix

                        ComboFix 08-01-23.1C - MAISON 2 2008-02-01 13:06:59.3 - NTFSx86
                        Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.536 [GMT 1:00]
                        Endroit: C:\Documents and Settings\MAISON 2\Bureau\ComboFix.exe
                        Command switches used :: C:\Documents and Settings\MAISON 2\Bureau\CFscript.txt
                        * Création d'un nouveau point de restauration

                        [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]

                        FILE
                        C:\WINDOWS\system32\Drivers\Hpa58.sys
                        C:\WINDOWS\system32\drivers\smtpdrv.sys
                        .
                        /wow section - STAGE 1

                        (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
                        .

                        C:\WINDOWS\system32\Drivers\Hpa58.sys . . . . Echec de suppression
                        .
                        ---- Previous Run -------
                        .
                        C:\Program Files\Helper
                        C:\Program Files\Helper\superfindout.dll
                        C:\WINDOWS\system32\6_exception.nls
                        C:\WINDOWS\system32\lt.res
                        C:\WINDOWS\system32\sft.res
                        C:\WINDOWS\system32\Drivers\Hpa58.sys . . . . Echec de suppression

                        .
                        ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

                        .
                        -------\LEGACY_SMTPDRV
                        -------\runtime
                        -------\smtpdrv

                        -------\smtpdrv

                        ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-01-01 to 2008-02-01 ))))))))))))))))))))))))))))))))))))
                        .

                        2008-01-25 14:07 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\Nircmd.exe
                        2008-01-23 15:52 . 2008-01-24 21:54 <REP> d-------- C:\Program Files\Navilog1
                        2008-01-23 00:01 . 2008-01-23 21:41 <REP> d-------- C:\WINDOWS\BDOSCAN8
                        2008-01-21 23:56 . 2008-01-22 23:42 <REP> d-------- C:\Program Files\Panda Security
                        2008-01-21 22:51 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
                        2008-01-21 12:59 . 2008-01-21 12:59 <REP> d-------- C:\Program Files\Trend Micro
                        2008-01-20 23:37 . 2008-02-01 13:10 25,984 --a------ C:\WINDOWS\system32\drivers\Hpa58.sys
                        2008-01-20 23:37 . 2008-01-20 23:37 2 --a--c--- C:\-1872345472
                        2008-01-20 23:36 . 2008-01-20 23:36 54,764 --a------ C:\WINDOWS\system32\drivers\drtya
                        2008-01-18 20:04 . 2005-10-15 12:32 196,608 --a------ C:\WINDOWS\system32\pdfcmnnt.dll
                        2008-01-18 20:04 . 1998-06-24 00:00 137,000 --a------ C:\WINDOWS\system32\MSMAPI32.OCX
                        2008-01-18 20:04 . 1998-07-06 00:00 23,552 --a------ C:\WINDOWS\system32\MSMPIDE.DLL
                        2008-01-18 20:02 . 2008-01-18 20:04 <REP> d-------- C:\Program Files\PDF creator
                        2008-01-18 18:37 . 2008-01-24 19:45 54,156 --ah----- C:\WINDOWS\QTFont.qfn
                        2008-01-18 18:37 . 2008-01-18 18:37 1,409 --a------ C:\WINDOWS\QTFont.for
                        2008-01-18 18:36 . 2008-01-18 18:36 <REP> d-------- C:\Program Files\iTunes
                        2008-01-18 18:36 . 2008-01-18 18:36 <REP> d-------- C:\Program Files\iPod
                        2008-01-18 18:34 . 2008-01-18 18:35 <REP> d-------- C:\Program Files\QuickTime
                        2008-01-12 14:56 . 2008-01-12 16:33 <REP> d-------- C:\WINDOWS\system32\Carte du monde Voyages SNCF dir
                        2008-01-12 14:52 . 2008-01-12 16:33 <REP> d-------- C:\WINDOWS\system32\Images du monde Voyages SNCF dir
                        2008-01-10 15:27 . 2008-01-10 15:27 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
                        2008-01-10 15:27 . 2008-01-10 15:27 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts
                        2008-01-08 16:52 . 2008-01-08 16:52 <REP> d-------- C:\Program Files\Apple Software Update
                        2008-01-08 16:51 . 2008-01-08 16:51 <REP> d-------- C:\Program Files\Fichiers communs\Apple

                        .
                        (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                        .
                        2008-01-23 15:36 --------- d-----w C:\Program Files\Windows Media Connect 2
                        2008-01-23 15:36 --------- d-----w C:\Program Files\Plasma Pong
                        2008-01-23 15:36 --------- d-----w C:\Program Files\Dictionnairecantonnais
                        2008-01-21 22:46 --------- d-----w C:\Program Files\wanadoo_toolbar
                        2008-01-08 18:23 --------- d-----w C:\Program Files\EA GAMES
                        2007-12-27 22:33 --------- d-----w C:\Program Files\Creative
                        2007-12-27 22:28 --------- d--h--w C:\Program Files\InstallShield Installation Information
                        2007-12-27 22:26 --------- d-----w C:\Program Files\SightSpeed
                        2007-12-06 22:43 --------- d-----w C:\Program Files\Logitech
                        2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys
                        2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
                        2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
                        2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
                        2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
                        .

                        ((((((((((((((((((((((((((((( snapshot@2008-01-25_14.18.17.40 )))))))))))))))))))))))))))))))))))))))))
                        .
                        - 2008-01-25 13:09:52 237,568 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT
                        + 2008-02-01 12:06:26 237,568 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT
                        - 2008-01-25 13:09:52 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
                        + 2008-02-01 12:06:27 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
                        - 2008-01-25 13:09:52 233,472 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\NTUSER.DAT
                        + 2008-02-01 12:06:27 233,472 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\NTUSER.DAT
                        - 2008-01-25 13:09:53 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
                        + 2008-02-01 12:06:27 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
                        - 2008-01-25 13:09:53 7,307,264 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\ntuser.dat
                        + 2008-02-01 12:06:27 7,307,264 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\ntuser.dat
                        - 2008-01-25 13:09:53 221,184 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
                        + 2008-02-01 12:06:27 221,184 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
                        + 2008-02-01 12:12:39 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_10c.dat
                        + 2008-02-01 12:12:02 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_4d4.dat
                        .
                        ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
                        .
                        .
                        REGEDIT4
                        *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

                        [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                        "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 13:00 15360]
                        "Creative Detector"="C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 18:23 102400]
                        "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-11 19:11 68856]
                        "Creative Live! Cam Manager"="C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe" [2006-05-31 16:00 143360]

                        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                        "avast!"="F:\POURAN~2\avaste\ashDisp.exe" [2007-12-04 14:00 79224]
                        "LVCOMS"="C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE" [2002-12-10 17:54 127022]
                        "TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2007-09-14 16:33 185632]
                        "AVFX Engine"="C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe" [2006-06-09 01:11 24576]
                        "V0220Mon.exe"="C:\WINDOWS\V0220Mon.exe" [2006-06-28 18:01 32768]
                        "CreativeTaskScheduler"="C:\Program Files\Creative\Shared Files\CTSched.exe" [2006-01-09 03:43 53340]
                        "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312]

                        [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                        "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 13:00 15360]
                        "DWQueuedReporting"="C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [2005-04-25 12:45 36040]
                        "Picasa Media Detector"="F:\Pour Voir\Pikasa\Picasa2\PicasaMediaDetector.exe" [2007-09-28 02:17 443968]

                        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
                        "DisableRegistryTools"= 0 (0x0)

                        [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Hpa58.sys]
                        @="Driver"

                        [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Adobe Gamma Loader.lnk]
                        path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Adobe Gamma Loader.lnk
                        backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

                        [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Reader.lnk]
                        path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Lancement rapide d'Adobe Reader.lnk
                        backup=C:\WINDOWS\pss\Lancement rapide d'Adobe Reader.lnkCommon Startup

                        [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk]
                        path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk
                        backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

                        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
                        --a------ 2004-07-20 09:22 57344 C:\WINDOWS\ALCMTR.EXE

                        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcWzrd]
                        --a------ 2004-09-15 10:20 2557952 C:\WINDOWS\ALCWZRD.EXE

                        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
                        --a------ 2004-08-12 20:10 339968 C:\ATI Technologies\ATI Control Panel\atiptaxx.exe

                        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]
                        --a------ 2004-08-05 13:00 110592 C:\WINDOWS\system32\bthprops.cpl

                        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DXM6Patch_981116]
                        --a------ 1998-11-30 18:04 497376 C:\WINDOWS\p_981116.exe

                        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
                        --a------ 2004-08-05 13:00 208952 C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe

                        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
                        --a------ 2001-09-04 22:30 28738 C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe

                        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
                        --a------ 2001-07-09 09:50 155648 C:\WINDOWS\system32\NeroCheck.exe

                        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService]
                        --a------ 2004-10-08 02:14 81920 c:\Apps\Powercinema\PCMService.exe

                        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
                        --a------ 2004-08-05 13:00 455168 C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe

                        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
                        --a------ 2004-08-05 13:00 455168 C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe

                        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Raccourci vers la page des propriétés de High Definition Audio]
                        --a------ 2004-03-17 14:10 61952 C:\WINDOWS\system32\Hdaudpropshortcut.exe

                        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
                        --a------ 2004-09-10 17:29 77824 C:\WINDOWS\SoundMan.exe

                        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec NetDriver Monitor]
                        C:\PROGRA~1\SYMNET~1\SNDMon.exe

                        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
                        --a------ 2007-09-14 16:33 185632 C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe

                        R0 Hpa58;Hpa58;C:\WINDOWS\system32\Drivers\Hpa58.sys [2008-02-01 13:10]
                        R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 22:08]
                        R3 V0220Dev;Live! Cam Video IM;C:\WINDOWS\system32\DRIVERS\V0220Dev.sys [2006-06-29 06:58]
                        R3 V0220Vfx;V0220VFX;C:\WINDOWS\system32\DRIVERS\V0220Vfx.sys [2006-06-08 09:00]
                        S3 BTNetFilter;Bluetooth Network Filter;C:\WINDOWS\system32\drivers\BTNetFilter.sys [2004-12-16 16:32]
                        S3 C-Dilla;C-Dilla;C:\WINDOWS\system32\drivers\CDANT.SYS [2001-04-06 22:24]
                        S3 EPPSCSIx;Agfa EPPSCSI Driver;C:\WINDOWS\system32\DRIVERS\EPPSCAN.sys []
                        S3 PortlUSB;PortlUSB;C:\WINDOWS\system32\DRIVERS\YH-925.sys [2004-06-24 12:52]
                        S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 21:58]

                        .
                        Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
                        "2008-01-25 17:28:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
                        - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
                        "2005-08-24 21:38:59 C:\WINDOWS\Tasks\HDReg.job"
                        - c:\Apps\HDReg\HDRegRem.exe
                        "2008-01-28 16:15:00 C:\WINDOWS\Tasks\Maintenance en 1 clic.job"
                        - C:\Program Files\TuneUp Utilities 2006\SystemOptimizer.exe
                        "2008-01-31 22:06:25 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
                        - C:\Program Files\Windows Defender\MpCmdRun.exe
                        "2008-01-31 14:00:00 C:\WINDOWS\Tasks\vider le dossier prefetch automatiquement.job"
                        - C:\WINDOWS\prefetchnet.net
                        .
                        **************************************************************************

                        catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                        Rootkit scan 2008-02-01 13:12:52
                        Windows 5.1.2600 Service Pack 2 NTFS

                        Balayage processus cach‚s ...

                        Balayage cach‚ autostart entries ...

                        Balayage des fichiers cach‚s ...

                        Scan termin‚ avec succŠs
                        Les fichiers cach‚s: 0

                        **************************************************************************
                        .
                        --------------------- DLLs a charg‚ sous des processus courants ---------------------

                        PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2900.3156]
                        -> C:\Program Files\interface vista\Vista Inspirat 2\RocketDock\RocketDock.dll
                        .
                        Temps d'accomplissement: 2008-02-01 13:15:05 - machine was rebooted [MAISON 2]
                        ComboFix-quarantined-files.txt 2008-02-01 12:15:02
                        .
                        2008-01-29 20:00:38 --- E O F ---

                        Hijackthis

                        Logfile of Trend Micro HijackThis v2.0.2
                        Scan saved at 14:00, on 2008-02-01
                        Platform: Windows XP SP2 (WinNT 5.01.2600)
                        MSIE: Internet Explorer v7.00 (7.00.6000.16574)
                        Boot mode: Normal

                        Running processes:
                        C:\WINDOWS\System32\smss.exe
                        C:\WINDOWS\system32\winlogon.exe
                        C:\WINDOWS\system32\services.exe
                        C:\WINDOWS\system32\lsass.exe
                        C:\WINDOWS\system32\Ati2evxx.exe
                        C:\WINDOWS\system32\svchost.exe
                        C:\Program Files\Windows Defender\MsMpEng.exe
                        C:\WINDOWS\System32\svchost.exe
                        C:\WINDOWS\system32\svchost.exe
                        F:\Pour antivirus\avaste\aswUpdSv.exe
                        F:\Pour antivirus\avaste\ashServ.exe
                        C:\WINDOWS\system32\Ati2evxx.exe
                        C:\WINDOWS\Explorer.EXE
                        C:\WINDOWS\system32\LEXBCES.EXE
                        C:\WINDOWS\system32\spoolsv.exe
                        C:\WINDOWS\system32\LEXPPS.EXE
                        C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                        C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                        C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
                        C:\WINDOWS\system32\CTsvcCDA.EXE
                        C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                        C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
                        C:\WINDOWS\System32\snmp.exe
                        C:\WINDOWS\system32\svchost.exe
                        F:\Pour antivirus\avaste\ashMaiSv.exe
                        F:\Pour antivirus\avaste\ashWebSv.exe
                        F:\POURAN~2\avaste\ashDisp.exe
                        C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
                        C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
                        C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe
                        C:\WINDOWS\V0220Mon.exe
                        C:\Program Files\Creative\Shared Files\CTSched.exe
                        C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
                        C:\WINDOWS\system32\ctfmon.exe
                        C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
                        C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe
                        C:\Program Files\Google\Google Updater\GoogleUpdater.exe
                        C:\Program Files\interface vista\Vista Inspirat 2\RocketDock\RocketDock.exe
                        C:\WINDOWS\System32\svchost.exe
                        C:\WINDOWS\System32\svchost.exe
                        C:\WINDOWS\system32\NOTEPAD.EXE
                        C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                        C:\Program Files\Skype\Phone\Skype.exe
                        C:\Program Files\Skype\Plugin Manager\SkypePM.exe
                        C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

                        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.neuf.fr/
                        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://actus.sfr.fr
                        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                        R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
                        R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
                        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                        R3 - URLSearchHook: (no name) - {BE89472C-B803-4D1D-9A9A-0A63660E0FE3} - C:\PROGRA~1\COPERN~1\COPERN~1.DLL
                        O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
                        O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                        O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                        O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                        O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
                        O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
                        O3 - Toolbar: Copernic Agent - {F2E259E8-0FC8-438C-A6E0-342DD80FA53E} - C:\Program Files\Copernic Agent\CopernicAgentExt.dll
                        O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
                        O4 - HKLM\..\Run: [avast!] F:\POURAN~2\avaste\ashDisp.exe
                        O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
                        O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                        O4 - HKLM\..\Run: [AVFX Engine] C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe
                        O4 - HKLM\..\Run: [V0220Mon.exe] C:\WINDOWS\V0220Mon.exe
                        O4 - HKLM\..\Run: [CreativeTaskScheduler] "C:\Program Files\Creative\Shared Files\CTSched.exe" /logon
                        O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
                        O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                        O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
                        O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                        O4 - HKCU\..\Run: [Creative Live! Cam Manager] "C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe"
                        O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                        O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                        O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                        O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                        O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                        O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
                        O4 - Startup: RocketDock.lnk = C:\Program Files\interface vista\Vista Inspirat 2\RocketDock\RocketDock.exe
                        O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
                        O8 - Extra context menu item: &Clean Traces - F:\Pour Telecharger\DAP\Privacy Package\dapcleanerie.htm
                        O8 - Extra context menu item: &Download with &DAP - F:\Pour Telecharger\DAP\dapextie.htm
                        O8 - Extra context menu item: Chercher avec Copernic Agent - res://C:\Program Files\Copernic Agent\CopernicAgentExt.rdl/INTEGRATION_MENU_SEARCHEXT
                        O8 - Extra context menu item: Download &all with DAP - F:\Pour Telecharger\DAP\dapextie2.htm
                        O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
                        O8 - Extra context menu item: Ouvrir le cadre dans une nouvelle fenêtre - C:\WINDOWS\web\OpenFrame.htm
                        O8 - Extra context menu item: Rechercher avec Voila - file://C:\Program Files\WANADOO_TOOLBAR\Cache\SelectedContextSearch.htm
                        O8 - Extra context menu item: Surligner en Jaune - C:\WINDOWS\web\MarqueurFluoYellow.htm
                        O8 - Extra context menu item: Surligner en Rose - C:\WINDOWS\web\MarqueurFluoPink.htm
                        O8 - Extra context menu item: Surligner en Vert - C:\WINDOWS\web\MarqueurFluoGreen.htm
                        O8 - Extra context menu item: Télécharger avec Star Downloader - F:\Pour Telecharger\Star doneloder\Star Downloader\sdie.htm
                        O8 - Extra context menu item: Voir les cookies - C:\WINDOWS\web\showcookies.htm
                        O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                        O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                        O9 - Extra button: (no name) - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
                        O9 - Extra 'Tools' menuitem: Démarrer Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
                        O9 - Extra button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
                        O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
                        O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
                        O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\WINDOWS\system32\shdocvw.dll
                        O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
                        O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                        O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                        O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                        O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                        O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                        O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
                        O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} - https://support.norton.com/sp/en/us/home/current/info
                        O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
                        O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
                        O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://drivers1.free.fr/telecharger.php?id=2&version=
                        O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://support.norton.com/sp/en/us/home/current/info
                        O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
                        O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
                        O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                        O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - F:\Pour antivirus\avaste\aswUpdSv.exe
                        O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
                        O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
                        O23 - Service: avast! Antivirus - ALWIL Software - F:\Pour antivirus\avaste\ashServ.exe
                        O23 - Service: avast! Mail Scanner - ALWIL Software - F:\Pour antivirus\avaste\ashMaiSv.exe
                        O23 - Service: avast! Web Scanner - ALWIL Software - F:\Pour antivirus\avaste\ashWebSv.exe
                        O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                        O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
                        O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
                        O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                        O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
                        O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
                        O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
                        O23 - Service: MysqlInventime - Unknown owner - c:\mysql\bin\mysqld-nt.exe (file missing)
                        O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
                        O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe
                        0
                        1. jlpjlp Contributeur sécurité
                          slt,

                          rq:
                          pour aller en mode sans echec essaye de demarrer en appuyant sur F5 ou ESC ou suppr à la place de F8

                          DESACTIVE LE TEA TIMER DE SPYBOT PENDANT TOUTE LA PROCEDURE!!!

                          _____________

                          vire ce qui est dnas le dossier quarantine en allant danC puis :

                          C:\Documents and Settings\MAISON 2\.housecall6.6\Quarantine

                          ________________

                          vire ce qui est en quarantaine dans AVG ANTISPYWARE:

                          C:\Documents and Settings\MAISON 2\Application Data\Grisoft\AVG Antispyware 7.5\quarantine\filE10330D9.dat

                          ___________________

                          vire ce qui est dnas le dossier quarantine en allant danC puis :

                          C:\QooBox\Quarantine\

                          ____________

                          vire ce qui est dans le dossier MovedFiles en allant danC puis :

                          C:\_OTMoveIt\MovedFiles

                          _____________

                          REFAIS ceci:

                          Ferme tout tes navigateurs (donc copie ou imprime les instructions avant)

                          Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :

                          Driver ::
                          Hpa58

                          File::
                          C:\WINDOWS\system32\Drivers\Hpa58.sys
                          C:\WINDOWS\system32\drivers\smtpdrv.sys

                          Registry::
                          [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Hpa58.sys]

                          Enregistre ce fichier sous le nom CFscript

                          Fait un glisser/déposer de ce fichier CFscrïpt sur le fichier ComboFix.exe

                          Clique sur le fichier CFScript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFScript vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.

                          Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

                          Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

                          Ne touche à rien tant que le scan n'est pas terminé.

                          Une fois le scan achevé, un rapport va s'afficher: poste son contenu.

                          Remets aussi un rapport Hijackthis

                          Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

                          _________________

                          désactive la restauration système pour purger les virus qui seraient dedans
                          puis redemarre ton ordi
                          puis réactive là
                          (dans DEMARRER puis TOUS LES PROGRAMMES puis ACCESSOIRE puis OUTILS SYSTEME puis RESTAURATION SYSTEME puis paramètre)

                          ____________________

                          recolle un rapport antivir
                          0
                          1. Mary
                            moi qui croyait que c'était fini...lol

                            Alors:
                            ComboFix

                            ComboFix 08-01-23.1C - MAISON 2 2008-02-01 22:15:10.4 - NTFSx86
                            Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.474 [GMT 1:00]
                            Endroit: C:\Documents and Settings\MAISON 2\Bureau\ComboFix.exe
                            Command switches used :: C:\Documents and Settings\MAISON 2\Bureau\CFscript.txt
                            * Création d'un nouveau point de restauration

                            [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]

                            FILE
                            C:\WINDOWS\system32\Drivers\Hpa58.sys
                            C:\WINDOWS\system32\drivers\smtpdrv.sys
                            .

                            (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
                            .

                            C:\WINDOWS\system32\Drivers\Hpa58.sys
                            .
                            ---- Previous Run -------
                            .
                            C:\Program Files\Helper
                            C:\Program Files\Helper\superfindout.dll
                            C:\WINDOWS\system32\6_exception.nls
                            C:\WINDOWS\system32\lt.res
                            C:\WINDOWS\system32\sft.res
                            C:\WINDOWS\system32\Drivers\Hpa58.sys . . . . Echec de suppression

                            .
                            ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

                            .
                            -------\LEGACY_SMTPDRV
                            -------\runtime
                            -------\smtpdrv

                            -------\smtpdrv

                            ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-01-01 to 2008-02-01 ))))))))))))))))))))))))))))))))))))
                            .

                            2008-02-01 14:27 . 2008-02-01 14:27 <REP> d-------- C:\Program Files\Avira
                            2008-02-01 14:06 . 2008-02-01 21:53 <REP> d----c--- C:\TEMP
                            2008-01-25 14:07 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\Nircmd.exe
                            2008-01-23 15:52 . 2008-01-24 21:54 <REP> d-------- C:\Program Files\Navilog1
                            2008-01-23 00:01 . 2008-01-23 21:41 <REP> d-------- C:\WINDOWS\BDOSCAN8
                            2008-01-21 23:56 . 2008-01-22 23:42 <REP> d-------- C:\Program Files\Panda Security
                            2008-01-21 22:51 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
                            2008-01-21 12:59 . 2008-01-21 12:59 <REP> d-------- C:\Program Files\Trend Micro
                            2008-01-20 23:37 . 2008-01-20 23:37 2 --a--c--- C:\-1872345472
                            2008-01-20 23:36 . 2008-01-20 23:36 54,764 --a------ C:\WINDOWS\system32\drivers\drtya
                            2008-01-18 20:04 . 2005-10-15 12:32 196,608 --a------ C:\WINDOWS\system32\pdfcmnnt.dll
                            2008-01-18 20:04 . 1998-06-24 00:00 137,000 --a------ C:\WINDOWS\system32\MSMAPI32.OCX
                            2008-01-18 20:04 . 1998-07-06 00:00 23,552 --a------ C:\WINDOWS\system32\MSMPIDE.DLL
                            2008-01-18 20:02 . 2008-01-18 20:04 <REP> d-------- C:\Program Files\PDF creator
                            2008-01-18 18:36 . 2008-01-18 18:36 <REP> d-------- C:\Program Files\iTunes
                            2008-01-18 18:36 . 2008-01-18 18:36 <REP> d-------- C:\Program Files\iPod
                            2008-01-18 18:34 . 2008-01-18 18:35 <REP> d-------- C:\Program Files\QuickTime
                            2008-01-12 14:56 . 2008-01-12 16:33 <REP> d-------- C:\WINDOWS\system32\Carte du monde Voyages SNCF dir
                            2008-01-12 14:52 . 2008-01-12 16:33 <REP> d-------- C:\WINDOWS\system32\Images du monde Voyages SNCF dir
                            2008-01-10 15:27 . 2008-01-10 15:27 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
                            2008-01-10 15:27 . 2008-01-10 15:27 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts
                            2008-01-08 16:52 . 2008-01-08 16:52 <REP> d-------- C:\Program Files\Apple Software Update
                            2008-01-08 16:51 . 2008-01-08 16:51 <REP> d-------- C:\Program Files\Fichiers communs\Apple

                            .
                            (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                            .
                            2008-01-23 15:36 --------- d-----w C:\Program Files\Windows Media Connect 2
                            2008-01-23 15:36 --------- d-----w C:\Program Files\Plasma Pong
                            2008-01-23 15:36 --------- d-----w C:\Program Files\Dictionnairecantonnais
                            2008-01-21 22:46 --------- d-----w C:\Program Files\wanadoo_toolbar
                            2008-01-08 18:23 --------- d-----w C:\Program Files\EA GAMES
                            2007-12-27 22:33 --------- d-----w C:\Program Files\Creative
                            2007-12-27 22:28 --------- d--h--w C:\Program Files\InstallShield Installation Information
                            2007-12-27 22:26 --------- d-----w C:\Program Files\SightSpeed
                            2007-12-06 22:43 --------- d-----w C:\Program Files\Logitech
                            2001-03-28 10:02 122,880 ----a-w C:\WINDOWS\inf\AGFA\message.exe
                            .

                            ((((((((((((((((((((((((((((( snapshot@2008-01-25_14.18.17.40 )))))))))))))))))))))))))))))))))))))))))
                            .
                            - 2008-01-25 13:09:52 237,568 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000001\NTUSER.DAT
                            + 2008-02-01 21:14:53 1,437,696 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000001\NTUSER.DAT
                            - 2008-01-25 13:09:52 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000002\UsrClass.dat
                            + 2008-02-01 21:14:53 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000002\UsrClass.dat
                            - 2008-01-25 13:09:52 233,472 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000003\NTUSER.DAT
                            + 2008-02-01 21:14:53 1,433,600 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000003\NTUSER.DAT
                            - 2008-01-25 13:09:53 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000004\UsrClass.dat
                            + 2008-02-01 21:14:53 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000004\UsrClass.dat
                            - 2008-01-25 13:09:53 7,307,264 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000005\ntuser.dat
                            + 2008-02-01 21:14:53 7,708,672 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000005\ntuser.dat
                            - 2008-01-25 13:09:53 221,184 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000006\UsrClass.dat
                            + 2008-02-01 21:14:53 221,184 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000006\UsrClass.dat
                            + 2007-08-09 12:04:11 40,768 ----a-w C:\WINDOWS\system32\drivers\avgntdd.sys
                            + 2007-07-18 13:22:19 21,312 ----a-w C:\WINDOWS\system32\drivers\avgntmgr.sys
                            + 2008-02-01 13:42:12 61,632 ----a-w C:\WINDOWS\system32\drivers\avipbb.sys
                            + 2007-03-01 09:34:36 28,352 ----a-w C:\WINDOWS\system32\drivers\ssmdrv.sys
                            + 2008-02-01 21:20:53 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_20c.dat
                            .
                            ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
                            .
                            .
                            REGEDIT4
                            *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

                            [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                            "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 13:00 15360]
                            "Creative Detector"="C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 18:23 102400]
                            "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-11 19:11 68856]
                            "Creative Live! Cam Manager"="C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe" [2006-05-31 16:00 143360]

                            [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                            "LVCOMS"="C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE" [2002-12-10 17:54 127022]
                            "TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2007-09-14 16:33 185632]
                            "AVFX Engine"="C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe" [2006-06-09 01:11 24576]
                            "V0220Mon.exe"="C:\WINDOWS\V0220Mon.exe" [2006-06-28 18:01 32768]
                            "CreativeTaskScheduler"="C:\Program Files\Creative\Shared Files\CTSched.exe" [2006-01-09 03:43 53340]
                            "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312]
                            "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-01 14:42 249896]

                            [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                            "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 13:00 15360]
                            "DWQueuedReporting"="C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [2005-04-25 12:45 36040]
                            "Picasa Media Detector"="F:\Pour Voir\Pikasa\Picasa2\PicasaMediaDetector.exe" [2007-09-28 02:17 443968]

                            [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
                            "DisableRegistryTools"= 0 (0x0)

                            [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Hpa58.sys]
                            @="Driver"

                            [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Adobe Gamma Loader.lnk]
                            path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Adobe Gamma Loader.lnk
                            backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

                            [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Reader.lnk]
                            path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Lancement rapide d'Adobe Reader.lnk
                            backup=C:\WINDOWS\pss\Lancement rapide d'Adobe Reader.lnkCommon Startup

                            [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk]
                            path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk
                            backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

                            [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
                            --a------ 2004-07-20 09:22 57344 C:\WINDOWS\ALCMTR.EXE

                            [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcWzrd]
                            --a------ 2004-09-15 10:20 2557952 C:\WINDOWS\ALCWZRD.EXE

                            [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
                            --a------ 2004-08-12 20:10 339968 C:\ATI Technologies\ATI Control Panel\atiptaxx.exe

                            [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]
                            --a------ 2004-08-05 13:00 110592 C:\WINDOWS\system32\bthprops.cpl

                            [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DXM6Patch_981116]
                            --a------ 1998-11-30 18:04 497376 C:\WINDOWS\p_981116.exe

                            [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
                            --a------ 2004-08-05 13:00 208952 C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe

                            [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
                            --a------ 2001-09-04 22:30 28738 C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe

                            [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
                            --a------ 2001-07-09 09:50 155648 C:\WINDOWS\system32\NeroCheck.exe

                            [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService]
                            --a------ 2004-10-08 02:14 81920 c:\Apps\Powercinema\PCMService.exe

                            [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
                            --a------ 2004-08-05 13:00 455168 C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe

                            [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
                            --a------ 2004-08-05 13:00 455168 C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe

                            [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Raccourci vers la page des propriétés de High Definition Audio]
                            --a------ 2004-03-17 14:10 61952 C:\WINDOWS\system32\Hdaudpropshortcut.exe

                            [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
                            --a------ 2004-09-10 17:29 77824 C:\WINDOWS\SoundMan.exe

                            [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec NetDriver Monitor]
                            C:\PROGRA~1\SYMNET~1\SNDMon.exe

                            [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
                            --a------ 2007-09-14 16:33 185632 C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe

                            R0 Hpa58;Hpa58;C:\WINDOWS\system32\Drivers\Hpa58.sys []
                            R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 22:08]
                            R3 V0220Dev;Live! Cam Video IM;C:\WINDOWS\system32\DRIVERS\V0220Dev.sys [2006-06-29 06:58]
                            R3 V0220Vfx;V0220VFX;C:\WINDOWS\system32\DRIVERS\V0220Vfx.sys [2006-06-08 09:00]
                            S3 BTNetFilter;Bluetooth Network Filter;C:\WINDOWS\system32\drivers\BTNetFilter.sys [2004-12-16 16:32]
                            S3 C-Dilla;C-Dilla;C:\WINDOWS\system32\drivers\CDANT.SYS [2001-04-06 22:24]
                            S3 EPPSCSIx;Agfa EPPSCSI Driver;C:\WINDOWS\system32\DRIVERS\EPPSCAN.sys []
                            S3 PortlUSB;PortlUSB;C:\WINDOWS\system32\DRIVERS\YH-925.sys [2004-06-24 12:52]
                            S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 21:58]

                            .
                            Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
                            "2008-02-01 17:28:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
                            - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
                            "2005-08-24 21:38:59 C:\WINDOWS\Tasks\HDReg.job"
                            - c:\Apps\HDReg\HDRegRem.exe
                            "2008-02-01 16:16:44 C:\WINDOWS\Tasks\Maintenance en 1 clic.job"
                            - C:\Program Files\TuneUp Utilities 2006\SystemOptimizer.exe
                            "2008-02-01 16:32:08 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
                            - C:\Program Files\Windows Defender\MpCmdRun.exe
                            "2008-02-01 14:00:00 C:\WINDOWS\Tasks\vider le dossier prefetch automatiquement.job"
                            - C:\WINDOWS\prefetchnet.net
                            .
                            **************************************************************************

                            catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                            Rootkit scan 2008-02-01 22:21:26
                            Windows 5.1.2600 Service Pack 2 NTFS

                            Balayage processus cach‚s ...

                            Balayage cach‚ autostart entries ...

                            Balayage des fichiers cach‚s ...

                            Scan termin‚ avec succŠs
                            Les fichiers cach‚s: 0

                            **************************************************************************
                            .
                            Temps d'accomplissement: 2008-02-01 22:23:34 - machine was rebooted [MAISON 2]
                            ComboFix-quarantined-files.txt 2008-02-01 21:23:31
                            .
                            2008-02-01 13:58:05 --- E O F ---

                            Hijackthis :

                            Logfile of Trend Micro HijackThis v2.0.2
                            Scan saved at 22:24:03, on 01/02/2008
                            Platform: Windows XP SP2 (WinNT 5.01.2600)
                            MSIE: Internet Explorer v7.00 (7.00.6000.16574)
                            Boot mode: Normal

                            Running processes:
                            C:\WINDOWS\System32\smss.exe
                            C:\WINDOWS\system32\winlogon.exe
                            C:\WINDOWS\system32\services.exe
                            C:\WINDOWS\system32\lsass.exe
                            C:\WINDOWS\system32\Ati2evxx.exe
                            C:\WINDOWS\system32\svchost.exe
                            C:\Program Files\Windows Defender\MsMpEng.exe
                            C:\WINDOWS\System32\svchost.exe
                            C:\WINDOWS\system32\svchost.exe
                            C:\WINDOWS\system32\LEXBCES.EXE
                            C:\WINDOWS\system32\spoolsv.exe
                            C:\WINDOWS\system32\LEXPPS.EXE
                            C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
                            C:\WINDOWS\system32\Ati2evxx.exe
                            C:\WINDOWS\Explorer.EXE
                            C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
                            C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                            C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                            C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
                            C:\WINDOWS\system32\CTsvcCDA.EXE
                            C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                            C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
                            C:\WINDOWS\System32\snmp.exe
                            C:\WINDOWS\system32\svchost.exe
                            C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
                            C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
                            C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe
                            C:\WINDOWS\V0220Mon.exe
                            C:\Program Files\Creative\Shared Files\CTSched.exe
                            C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
                            C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
                            C:\WINDOWS\system32\ctfmon.exe
                            C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
                            C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe
                            C:\Program Files\Google\Google Updater\GoogleUpdater.exe
                            C:\Program Files\interface vista\Vista Inspirat 2\RocketDock\RocketDock.exe
                            C:\WINDOWS\system32\wuauclt.exe
                            C:\WINDOWS\system32\notepad.exe
                            C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

                            R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.neuf.fr/
                            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://actus.sfr.fr
                            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                            R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
                            R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
                            R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                            R3 - URLSearchHook: (no name) - {BE89472C-B803-4D1D-9A9A-0A63660E0FE3} - C:\PROGRA~1\COPERN~1\COPERN~1.DLL
                            O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
                            O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                            O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                            O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                            O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
                            O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
                            O3 - Toolbar: Copernic Agent - {F2E259E8-0FC8-438C-A6E0-342DD80FA53E} - C:\Program Files\Copernic Agent\CopernicAgentExt.dll
                            O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
                            O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
                            O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                            O4 - HKLM\..\Run: [AVFX Engine] C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe
                            O4 - HKLM\..\Run: [V0220Mon.exe] C:\WINDOWS\V0220Mon.exe
                            O4 - HKLM\..\Run: [CreativeTaskScheduler] "C:\Program Files\Creative\Shared Files\CTSched.exe" /logon
                            O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
                            O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
                            O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                            O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
                            O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                            O4 - HKCU\..\Run: [Creative Live! Cam Manager] "C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe"
                            O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                            O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                            O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                            O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                            O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
                            O4 - Startup: RocketDock.lnk = C:\Program Files\interface vista\Vista Inspirat 2\RocketDock\RocketDock.exe
                            O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
                            O8 - Extra context menu item: &Clean Traces - F:\Pour Telecharger\DAP\Privacy Package\dapcleanerie.htm
                            O8 - Extra context menu item: &Download with &DAP - F:\Pour Telecharger\DAP\dapextie.htm
                            O8 - Extra context menu item: Chercher avec Copernic Agent - res://C:\Program Files\Copernic Agent\CopernicAgentExt.rdl/INTEGRATION_MENU_SEARCHEXT
                            O8 - Extra context menu item: Download &all with DAP - F:\Pour Telecharger\DAP\dapextie2.htm
                            O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
                            O8 - Extra context menu item: Ouvrir le cadre dans une nouvelle fenêtre - C:\WINDOWS\web\OpenFrame.htm
                            O8 - Extra context menu item: Rechercher avec Voila - file://C:\Program Files\WANADOO_TOOLBAR\Cache\SelectedContextSearch.htm
                            O8 - Extra context menu item: Surligner en Jaune - C:\WINDOWS\web\MarqueurFluoYellow.htm
                            O8 - Extra context menu item: Surligner en Rose - C:\WINDOWS\web\MarqueurFluoPink.htm
                            O8 - Extra context menu item: Surligner en Vert - C:\WINDOWS\web\MarqueurFluoGreen.htm
                            O8 - Extra context menu item: Télécharger avec Star Downloader - F:\Pour Telecharger\Star doneloder\Star Downloader\sdie.htm
                            O8 - Extra context menu item: Voir les cookies - C:\WINDOWS\web\showcookies.htm
                            O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                            O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                            O9 - Extra button: (no name) - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
                            O9 - Extra 'Tools' menuitem: Démarrer Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
                            O9 - Extra button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
                            O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
                            O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
                            O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\WINDOWS\system32\shdocvw.dll
                            O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
                            O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                            O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                            O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                            O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                            O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                            O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                            O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
                            O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} - https://support.norton.com/sp/en/us/home/current/info
                            O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
                            O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
                            O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://drivers1.free.fr/telecharger.php?id=2&version=
                            O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://support.norton.com/sp/en/us/home/current/info
                            O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
                            O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
                            O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
                            O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
                            O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                            O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
                            O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
                            O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                            O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
                            O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
                            O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                            O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
                            O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
                            O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
                            O23 - Service: MysqlInventime - Unknown owner - c:\mysql\bin\mysqld-nt.exe (file missing)
                            O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
                            O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe
                            0
                            1. jlpjlp Contributeur sécurité
                              ok
                              recolle un rapport antivir et dis tes soucis
                              0
                              1. Mary
                                Alors voilà le rapport antivir.
                                Je n'ai plus de souci avec msn, je l'ai réouvert cet aprem pour la première fois depuis le virus et pas de virus propagé chez mes contacts...ça fait plaisir! Plus non plus d'apparition de messages suspects d'avast (normal il est plus la) concernant des mails qui passeraient par mon ordi, et ça c'est vmt chouette parce que ça me pourrissait mon écran! A part ça, j'ai un fichier qu'antivir met en quarantaine qd j'allume mon ordi mais qui réapparait au démarrage suivant : C:\WINDOWS\Temp\BN1.tmp (Is the Trojan horse TR/Agent.EJX).
                                Et pour le moment, c'est tout...mais promis, je te fais signe si ça recommence! lol.
                                Merci beaucoup, vraiment, pour tout ce que tu as fait!!! jamais j'aurais réussi à nettoyer mon ordi sans toi...
                                Au fait, qu'est-ce que je fais de tous ces logiciels sur mon ordi ???

                                Mary

                                AntiVir PersonalEdition Classic
                                Report file date: vendredi 1 février 2008 22:33

                                Scanning for 1087915 virus strains and unwanted programs.

                                Licensed to: Avira AntiVir PersonalEdition Classic
                                Serial number: 0000149996-ADJIE-0001
                                Platform: Windows XP
                                Windows version: (Service Pack 2) [5.1.2600]
                                Username: SYSTEM
                                Computer name: SN100285100300

                                Version information:
                                BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00
                                AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 13:16:29
                                AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 12:23:51
                                LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 15:32:47
                                LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 12:35:20
                                ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 14:27:15
                                ANTIVIR1.VDF : 7.0.1.95 3367424 Bytes 14/12/2007 13:42:11
                                ANTIVIR2.VDF : 7.0.2.49 1339904 Bytes 25/01/2008 13:42:11
                                ANTIVIR3.VDF : 7.0.2.80 239104 Bytes 01/02/2008 13:42:11
                                AVEWIN32.DLL : 7.6.0.61 3240448 Bytes 01/02/2008 13:42:12
                                AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 10:36:26
                                AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 07:39:17
                                AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:16:24
                                AVPACK32.DLL : 7.6.0.3 360488 Bytes 01/02/2008 13:42:12
                                AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 07:17:06
                                AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 12:26:33
                                AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 07:10:18
                                NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 11:09:42
                                RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07/08/2007 12:38:13
                                RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 12:50:37
                                SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 09:37:21

                                Configuration settings for the scan:
                                Jobname..........................: Complete system scan
                                Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
                                Logging..........................: low
                                Primary action...................: interactive
                                Secondary action.................: ignore
                                Scan master boot sector..........: off
                                Scan boot sector.................: on
                                Boot sectors.....................: F:,
                                Scan memory......................: on
                                Process scan.....................: on
                                Scan registry....................: on
                                Search for rootkits..............: on
                                Scan all files...................: Intelligent file selection
                                Scan archives....................: on
                                Recursion depth..................: 20
                                Smart extensions.................: on
                                Macro heuristic..................: on
                                File heuristic...................: medium

                                Start of the scan: vendredi 1 février 2008 22:33

                                Starting search for hidden objects.
                                HKEY_LOCAL_MACHINE\System\ControlSet001\Services\drtya\type
                                [NOTE] The registry entry is invisible.
                                HKEY_LOCAL_MACHINE\System\ControlSet001\Services\drtya\start
                                [NOTE] The registry entry is invisible.
                                HKEY_LOCAL_MACHINE\System\ControlSet001\Services\drtya\errorcontrol
                                [NOTE] The registry entry is invisible.
                                HKEY_LOCAL_MACHINE\System\ControlSet001\Services\drtya\imagepath
                                [NOTE] The registry entry is invisible.
                                HKEY_LOCAL_MACHINE\System\ControlSet001\Services\drtya\extparamd
                                [NOTE] The registry entry is invisible.
                                HKEY_LOCAL_MACHINE\System\ControlSet001\Services\drtya\Security\security
                                [NOTE] The registry entry is invisible.
                                HKEY_LOCAL_MACHINE\System\ControlSet001\Services\drtya\type
                                [NOTE] The registry entry is invisible.
                                HKEY_LOCAL_MACHINE\System\ControlSet001\Services\drtya\start
                                [NOTE] The registry entry is invisible.
                                HKEY_LOCAL_MACHINE\System\ControlSet001\Services\drtya\errorcontrol
                                [NOTE] The registry entry is invisible.
                                HKEY_LOCAL_MACHINE\System\ControlSet001\Services\drtya\imagepath
                                [NOTE] The registry entry is invisible.
                                HKEY_LOCAL_MACHINE\System\ControlSet001\Services\drtya\extparamd
                                [NOTE] The registry entry is invisible.
                                HKEY_LOCAL_MACHINE\System\ControlSet001\Services\drtya\Security\security
                                [NOTE] The registry entry is invisible.
                                '52904' objects were checked, '12' hidden objects were found.

                                The scan of running processes will be started
                                Scan process 'avscan.exe' - '1' Module(s) have been scanned
                                Scan process 'avcenter.exe' - '1' Module(s) have been scanned
                                Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
                                Scan process 'wmiprvse.exe' - '1' Module(s) have been scanned
                                Scan process 'RocketDock.exe' - '1' Module(s) have been scanned
                                Scan process 'alg.exe' - '1' Module(s) have been scanned
                                Scan process 'GoogleUpdater.exe' - '1' Module(s) have been scanned
                                Scan process 'CTLCMgr.exe' - '1' Module(s) have been scanned
                                Scan process 'CTDetect.exe' - '1' Module(s) have been scanned
                                Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
                                Scan process 'avgnt.exe' - '1' Module(s) have been scanned
                                Scan process 'avgas.exe' - '1' Module(s) have been scanned
                                Scan process 'CTSched.exe' - '1' Module(s) have been scanned
                                Scan process 'V0220Mon.exe' - '1' Module(s) have been scanned
                                Scan process 'StartFX.exe' - '1' Module(s) have been scanned
                                Scan process 'realsched.exe' - '1' Module(s) have been scanned
                                Scan process 'svchost.exe' - '1' Module(s) have been scanned
                                Scan process 'LVComS.exe' - '1' Module(s) have been scanned
                                Scan process 'snmp.exe' - '1' Module(s) have been scanned
                                Scan process 'slserv.exe' - '1' Module(s) have been scanned
                                Scan process 'mdm.exe' - '1' Module(s) have been scanned
                                Scan process 'GoogleUpdaterService.exe' - '1' Module(s) have been scanned
                                Scan process 'CTSVCCDA.EXE' - '1' Module(s) have been scanned
                                Scan process 'CDANTSRV.EXE' - '1' Module(s) have been scanned
                                Scan process 'svchost.exe' - '1' Module(s) have been scanned
                                Scan process 'guard.exe' - '0' Module(s) have been scanned
                                Scan process 'AppleMobileDeviceService.exe' - '1' Module(s) have been scanned
                                Scan process 'sched.exe' - '1' Module(s) have been scanned
                                Scan process 'explorer.exe' - '1' Module(s) have been scanned
                                Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
                                Scan process 'avguard.exe' - '1' Module(s) have been scanned
                                Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
                                Scan process 'LEXPPS.EXE' - '1' Module(s) have been scanned
                                Scan process 'LEXBCES.EXE' - '1' Module(s) have been scanned
                                Scan process 'svchost.exe' - '1' Module(s) have been scanned
                                Scan process 'svchost.exe' - '1' Module(s) have been scanned
                                Scan process 'svchost.exe' - '1' Module(s) have been scanned
                                Scan process 'svchost.exe' - '1' Module(s) have been scanned
                                Scan process 'MsMpEng.exe' - '1' Module(s) have been scanned
                                Scan process 'svchost.exe' - '1' Module(s) have been scanned
                                Scan process 'svchost.exe' - '1' Module(s) have been scanned
                                Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
                                Scan process 'lsass.exe' - '1' Module(s) have been scanned
                                Scan process 'services.exe' - '1' Module(s) have been scanned
                                Scan process 'winlogon.exe' - '1' Module(s) have been scanned
                                Scan process 'csrss.exe' - '1' Module(s) have been scanned
                                Scan process 'smss.exe' - '1' Module(s) have been scanned
                                46 processes with 46 modules were scanned

                                Start scanning boot sectors:
                                Boot sector 'C:\'
                                [NOTE] No virus was found!
                                Boot sector 'F:\'
                                [NOTE] No virus was found!

                                Starting to scan the registry.
                                The registry was scanned ( '26' files ).

                                Starting the file scan:

                                Begin scan in 'C:\' <HDD1>
                                C:\pagefile.sys
                                [WARNING] The file could not be opened!
                                C:\QooBox\Quarantine\catchme2008-02-01_222106.46.zip
                                [0] Archive type: ZIP
                                --> Hpa58.sys
                                [DETECTION] Contains detection pattern of the worm WORM/Ntech.Z.4
                                [INFO] The file was moved to '4817973a.qua'!
                                C:\WINDOWS\system32\drivers\sptd.sys
                                [WARNING] The file could not be opened!
                                Begin scan in 'F:\' <Données>

                                End of the scan: samedi 2 février 2008 00:05
                                Used time: 1:32:04 min

                                The scan has been done completely.

                                9344 Scanning directories
                                636864 Files were scanned
                                1 viruses and/or unwanted programs were found
                                0 Files were classified as suspicious:
                                0 files were deleted
                                0 files were repaired
                                1 files were moved to quarantine
                                0 files were renamed
                                2 Files cannot be scanned
                                636863 Files not concerned
                                9019 Archives were scanned
                                2 Warnings
                                35 Notes
                                52904 Objects were scanned with rootkit scan
                                12 Hidden objects were found
                                0
                                1. jlpjlp Contributeur sécurité
                                  vire ce qui est dans le dossier quarantine en allant dans poste de travail puis C puis QooBox\Quarantine

                                  ________________

                                  REFAIS ceci:

                                  Ferme tout tes navigateurs (donc copie ou imprime les instructions avant)

                                  Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :

                                  Driver ::
                                  Hpa58

                                  File::

                                  C:\WINDOWS\system32\drivers\sptd.sys
                                  C:\WINDOWS\system32\Drivers\Hpa58.sys
                                  C:\WINDOWS\system32\drivers\smtpdrv.sys

                                  Registry::
                                  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Hpa58.sys]

                                  Enregistre ce fichier sous le nom CFscript

                                  Fait un glisser/déposer de ce fichier CFscrïpt sur le fichier ComboFix.exe

                                  Clique sur le fichier CFScript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFScript vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.

                                  Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

                                  Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

                                  Ne touche à rien tant que le scan n'est pas terminé.

                                  Une fois le scan achevé, un rapport va s'afficher: poste son contenu.

                                  Remets aussi un rapport Hijackthis

                                  Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

                                  ___________________

                                  encore des problemes????
                                  0
                                  1. Mary
                                    Voici les deux rapports :

                                    Combofix

                                    ComboFix 08-01-23.1C - MAISON 2 2008-02-03 17:44:05.5 - NTFSx86
                                    Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.433 [GMT 1:00]
                                    Endroit: C:\Documents and Settings\MAISON 2\Bureau\ComboFix.exe
                                    Command switches used :: C:\Documents and Settings\MAISON 2\Bureau\CFscript.txt
                                    * Création d'un nouveau point de restauration

                                    [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]

                                    FILE
                                    C:\WINDOWS\system32\Drivers\Hpa58.sys
                                    C:\WINDOWS\system32\drivers\smtpdrv.sys
                                    C:\WINDOWS\system32\drivers\sptd.sys
                                    .

                                    (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
                                    .

                                    C:\WINDOWS\system32\drivers\sptd.sys

                                    .
                                    ((((((((((((((((((((((((((((( Fichiers créés 2008-01-03 to 2008-02-03 ))))))))))))))))))))))))))))))))))))
                                    .

                                    2008-02-01 22:23 . 2008-02-03 17:44 <REP> d----c--- C:\temp
                                    2008-02-01 14:27 . 2008-02-01 14:27 <REP> d-------- C:\Program Files\Avira
                                    2008-01-25 14:07 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\Nircmd.exe
                                    2008-01-23 15:52 . 2008-01-24 21:54 <REP> d-------- C:\Program Files\Navilog1
                                    2008-01-23 00:01 . 2008-01-23 21:41 <REP> d-------- C:\WINDOWS\BDOSCAN8
                                    2008-01-21 23:56 . 2008-01-22 23:42 <REP> d-------- C:\Program Files\Panda Security
                                    2008-01-21 22:51 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
                                    2008-01-21 12:59 . 2008-01-21 12:59 <REP> d-------- C:\Program Files\Trend Micro
                                    2008-01-20 23:37 . 2008-01-20 23:37 2 --a--c--- C:\-1872345472
                                    2008-01-20 23:36 . 2008-01-20 23:36 54,764 --a------ C:\WINDOWS\system32\drivers\drtya
                                    2008-01-18 20:04 . 2005-10-15 12:32 196,608 --a------ C:\WINDOWS\system32\pdfcmnnt.dll
                                    2008-01-18 20:04 . 1998-06-24 00:00 137,000 --a------ C:\WINDOWS\system32\MSMAPI32.OCX
                                    2008-01-18 20:04 . 1998-07-06 00:00 23,552 --a------ C:\WINDOWS\system32\MSMPIDE.DLL
                                    2008-01-18 20:02 . 2008-01-18 20:04 <REP> d-------- C:\Program Files\PDF creator
                                    2008-01-18 18:36 . 2008-01-18 18:36 <REP> d-------- C:\Program Files\iTunes
                                    2008-01-18 18:36 . 2008-01-18 18:36 <REP> d-------- C:\Program Files\iPod
                                    2008-01-18 18:34 . 2008-01-18 18:35 <REP> d-------- C:\Program Files\QuickTime
                                    2008-01-12 14:56 . 2008-01-12 16:33 <REP> d-------- C:\WINDOWS\system32\Carte du monde Voyages SNCF dir
                                    2008-01-12 14:52 . 2008-01-12 16:33 <REP> d-------- C:\WINDOWS\system32\Images du monde Voyages SNCF dir
                                    2008-01-10 15:27 . 2008-01-10 15:27 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
                                    2008-01-10 15:27 . 2008-01-10 15:27 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts
                                    2008-01-08 16:52 . 2008-01-08 16:52 <REP> d-------- C:\Program Files\Apple Software Update
                                    2008-01-08 16:51 . 2008-01-08 16:51 <REP> d-------- C:\Program Files\Fichiers communs\Apple

                                    .
                                    (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                                    .
                                    2008-01-23 15:36 --------- d-----w C:\Program Files\Windows Media Connect 2
                                    2008-01-23 15:36 --------- d-----w C:\Program Files\Plasma Pong
                                    2008-01-23 15:36 --------- d-----w C:\Program Files\Dictionnairecantonnais
                                    2008-01-21 22:46 --------- d-----w C:\Program Files\wanadoo_toolbar
                                    2008-01-08 18:23 --------- d-----w C:\Program Files\EA GAMES
                                    2007-12-27 22:33 --------- d-----w C:\Program Files\Creative
                                    2007-12-27 22:28 --------- d--h--w C:\Program Files\InstallShield Installation Information
                                    2007-12-27 22:26 --------- d-----w C:\Program Files\SightSpeed
                                    2007-12-09 16:10 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
                                    2007-12-06 22:43 --------- d-----w C:\Program Files\Logitech
                                    2007-11-07 09:28 728,576 ----a-w C:\WINDOWS\system32\lsasrv.dll
                                    2007-11-07 09:28 728,576 ------w C:\WINDOWS\system32\dllcache\lsasrv.dll
                                    2001-03-28 10:02 122,880 ----a-w C:\WINDOWS\inf\AGFA\message.exe
                                    .

                                    ((((((((((((((((((((((((((((( snapshot@2008-01-25_14.18.17.40 )))))))))))))))))))))))))))))))))))))))))
                                    .
                                    - 2008-01-25 13:09:52 237,568 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000001\NTUSER.DAT
                                    + 2008-02-03 16:43:41 1,437,696 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000001\NTUSER.DAT
                                    - 2008-01-25 13:09:52 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000002\UsrClass.dat
                                    + 2008-02-03 16:43:41 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000002\UsrClass.dat
                                    - 2008-01-25 13:09:52 233,472 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000003\NTUSER.DAT
                                    + 2008-02-03 16:43:41 1,433,600 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000003\NTUSER.DAT
                                    - 2008-01-25 13:09:53 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000004\UsrClass.dat
                                    + 2008-02-03 16:43:41 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000004\UsrClass.dat
                                    - 2008-01-25 13:09:53 7,307,264 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000005\ntuser.dat
                                    + 2008-02-03 16:43:41 7,708,672 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000005\ntuser.dat
                                    - 2008-01-25 13:09:53 221,184 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000006\UsrClass.dat
                                    + 2008-02-03 16:43:41 221,184 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000006\UsrClass.dat
                                    + 2007-08-09 12:04:11 40,768 ----a-w C:\WINDOWS\system32\drivers\avgntdd.sys
                                    + 2007-07-18 13:22:19 21,312 ----a-w C:\WINDOWS\system32\drivers\avgntmgr.sys
                                    + 2008-02-01 13:42:12 61,632 ----a-w C:\WINDOWS\system32\drivers\avipbb.sys
                                    + 2007-03-01 09:34:36 28,352 ----a-w C:\WINDOWS\system32\drivers\ssmdrv.sys
                                    + 2008-02-01 21:32:31 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_168.dat
                                    .
                                    ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
                                    .
                                    .
                                    REGEDIT4
                                    *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

                                    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                                    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 13:00 15360]
                                    "Creative Detector"="C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 18:23 102400]
                                    "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-11 19:11 68856]
                                    "Creative Live! Cam Manager"="C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe" [2006-05-31 16:00 143360]

                                    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                                    "LVCOMS"="C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE" [2002-12-10 17:54 127022]
                                    "TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2007-09-14 16:33 185632]
                                    "AVFX Engine"="C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe" [2006-06-09 01:11 24576]
                                    "V0220Mon.exe"="C:\WINDOWS\V0220Mon.exe" [2006-06-28 18:01 32768]
                                    "CreativeTaskScheduler"="C:\Program Files\Creative\Shared Files\CTSched.exe" [2006-01-09 03:43 53340]
                                    "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312]
                                    "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-01 14:42 249896]

                                    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                                    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 13:00 15360]
                                    "DWQueuedReporting"="C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [2005-04-25 12:45 36040]
                                    "Picasa Media Detector"="F:\Pour Voir\Pikasa\Picasa2\PicasaMediaDetector.exe" [2007-09-28 02:17 443968]

                                    C:\Documents and Settings\MAISON 2\Menu D‚marrer\Programmes\D‚marrage\
                                    Adobe Gamma.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2005-08-23 17:27:58 110592]
                                    RocketDock.lnk - C:\Program Files\interface vista\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-03-18 23:05:02 630784]

                                    C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
                                    Outil de mise … jour Google.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2007-09-14 15:30:46 126136]

                                    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Hpa58.sys]
                                    @="Driver"

                                    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Adobe Gamma Loader.lnk]
                                    path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Adobe Gamma Loader.lnk
                                    backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

                                    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Reader.lnk]
                                    path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Lancement rapide d'Adobe Reader.lnk
                                    backup=C:\WINDOWS\pss\Lancement rapide d'Adobe Reader.lnkCommon Startup

                                    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk]
                                    path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk
                                    backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

                                    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
                                    --a------ 2004-07-20 09:22 57344 C:\WINDOWS\ALCMTR.EXE

                                    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcWzrd]
                                    --a------ 2004-09-15 10:20 2557952 C:\WINDOWS\ALCWZRD.EXE

                                    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
                                    --a------ 2004-08-12 20:10 339968 C:\ATI Technologies\ATI Control Panel\atiptaxx.exe

                                    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]
                                    --a------ 2004-08-05 13:00 110592 C:\WINDOWS\system32\bthprops.cpl

                                    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DXM6Patch_981116]
                                    --a------ 1998-11-30 18:04 497376 C:\WINDOWS\p_981116.exe

                                    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
                                    --a------ 2004-08-05 13:00 208952 C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe

                                    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
                                    --a------ 2001-09-04 22:30 28738 C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe

                                    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
                                    --a------ 2001-07-09 09:50 155648 C:\WINDOWS\system32\NeroCheck.exe

                                    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService]
                                    --a------ 2004-10-08 02:14 81920 c:\Apps\Powercinema\PCMService.exe

                                    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
                                    --a------ 2004-08-05 13:00 455168 C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe

                                    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
                                    --a------ 2004-08-05 13:00 455168 C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe

                                    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Raccourci vers la page des propriétés de High Definition Audio]
                                    --a------ 2004-03-17 14:10 61952 C:\WINDOWS\system32\Hdaudpropshortcut.exe

                                    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
                                    --a------ 2004-09-10 17:29 77824 C:\WINDOWS\SoundMan.exe

                                    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec NetDriver Monitor]
                                    C:\PROGRA~1\SYMNET~1\SNDMon.exe

                                    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
                                    --a------ 2007-09-14 16:33 185632 C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe

                                    R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 22:08]
                                    R3 V0220Dev;Live! Cam Video IM;C:\WINDOWS\system32\DRIVERS\V0220Dev.sys [2006-06-29 06:58]
                                    R3 V0220Vfx;V0220VFX;C:\WINDOWS\system32\DRIVERS\V0220Vfx.sys [2006-06-08 09:00]
                                    S0 Hpa58;Hpa58;C:\WINDOWS\system32\Drivers\Hpa58.sys []
                                    S3 BTNetFilter;Bluetooth Network Filter;C:\WINDOWS\system32\drivers\BTNetFilter.sys [2004-12-16 16:32]
                                    S3 C-Dilla;C-Dilla;C:\WINDOWS\system32\drivers\CDANT.SYS [2001-04-06 22:24]
                                    S3 EPPSCSIx;Agfa EPPSCSI Driver;C:\WINDOWS\system32\DRIVERS\EPPSCAN.sys []
                                    S3 PortlUSB;PortlUSB;C:\WINDOWS\system32\DRIVERS\YH-925.sys [2004-06-24 12:52]
                                    S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 21:58]

                                    *Newly Created Service* - SYSMONLOG
                                    .
                                    Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
                                    "2008-02-01 17:28:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
                                    - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
                                    "2005-08-24 21:38:59 C:\WINDOWS\Tasks\HDReg.job"
                                    - c:\Apps\HDReg\HDRegRem.exe
                                    "2008-02-01 16:16:44 C:\WINDOWS\Tasks\Maintenance en 1 clic.job"
                                    - C:\Program Files\TuneUp Utilities 2006\SystemOptimizer.exe
                                    "2008-02-02 11:00:51 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
                                    - C:\Program Files\Windows Defender\MpCmdRun.exe
                                    "2008-02-03 14:00:00 C:\WINDOWS\Tasks\vider le dossier prefetch automatiquement.job"
                                    - C:\WINDOWS\prefetchnet.net
                                    .
                                    **************************************************************************

                                    catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                                    Rootkit scan 2008-02-03 17:46:25
                                    Windows 5.1.2600 Service Pack 2 NTFS

                                    Balayage processus cachés ...

                                    Balayage caché autostart entries ...

                                    Balayage des fichiers cachés ...

                                    Scan terminé avec succès
                                    Les fichiers cachés: 0

                                    **************************************************************************
                                    .
                                    Temps d'accomplissement: 2008-02-03 17:47:07
                                    ComboFix-quarantined-files.txt 2008-02-03 16:47:04
                                    ComboFix2.txt 2008-02-01 21:23:34
                                    .
                                    2008-02-01 13:58:05 --- E O F ---

                                    Et Hijackthis :

                                    Logfile of Trend Micro HijackThis v2.0.2
                                    Scan saved at 17:51:41, on 03/02/2008
                                    Platform: Windows XP SP2 (WinNT 5.01.2600)
                                    MSIE: Internet Explorer v7.00 (7.00.6000.16574)
                                    Boot mode: Normal

                                    Running processes:
                                    C:\WINDOWS\System32\smss.exe
                                    C:\WINDOWS\system32\winlogon.exe
                                    C:\WINDOWS\system32\services.exe
                                    C:\WINDOWS\system32\lsass.exe
                                    C:\WINDOWS\system32\Ati2evxx.exe
                                    C:\WINDOWS\system32\svchost.exe
                                    C:\Program Files\Windows Defender\MsMpEng.exe
                                    C:\WINDOWS\System32\svchost.exe
                                    C:\WINDOWS\system32\svchost.exe
                                    C:\WINDOWS\system32\LEXBCES.EXE
                                    C:\WINDOWS\system32\LEXPPS.EXE
                                    C:\WINDOWS\system32\spoolsv.exe
                                    C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
                                    C:\WINDOWS\system32\Ati2evxx.exe
                                    C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
                                    C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                                    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                                    C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
                                    C:\WINDOWS\system32\CTsvcCDA.EXE
                                    C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                                    C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
                                    C:\WINDOWS\System32\snmp.exe
                                    C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
                                    C:\WINDOWS\system32\svchost.exe
                                    C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe
                                    C:\WINDOWS\V0220Mon.exe
                                    C:\Program Files\Creative\Shared Files\CTSched.exe
                                    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
                                    C:\WINDOWS\system32\ctfmon.exe
                                    C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
                                    C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe
                                    C:\Program Files\Google\Google Updater\GoogleUpdater.exe
                                    C:\Program Files\interface vista\Vista Inspirat 2\RocketDock\RocketDock.exe
                                    C:\Program Files\MSN Messenger\usnsvc.exe
                                    C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
                                    C:\Program Files\Internet Explorer\IEXPLORE.EXE
                                    C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
                                    C:\Program Files\iPod\bin\iPodService.exe
                                    C:\WINDOWS\explorer.exe
                                    C:\Program Files\Mozilla Firefox\firefox.exe
                                    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

                                    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.neuf.fr/
                                    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                                    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://actus.sfr.fr
                                    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                                    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
                                    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
                                    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                                    R3 - URLSearchHook: (no name) - {BE89472C-B803-4D1D-9A9A-0A63660E0FE3} - C:\PROGRA~1\COPERN~1\COPERN~1.DLL
                                    O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
                                    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                                    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                                    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                                    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
                                    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
                                    O3 - Toolbar: Copernic Agent - {F2E259E8-0FC8-438C-A6E0-342DD80FA53E} - C:\Program Files\Copernic Agent\CopernicAgentExt.dll
                                    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
                                    O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
                                    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                                    O4 - HKLM\..\Run: [AVFX Engine] C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe
                                    O4 - HKLM\..\Run: [V0220Mon.exe] C:\WINDOWS\V0220Mon.exe
                                    O4 - HKLM\..\Run: [CreativeTaskScheduler] "C:\Program Files\Creative\Shared Files\CTSched.exe" /logon
                                    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
                                    O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
                                    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                                    O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
                                    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                                    O4 - HKCU\..\Run: [Creative Live! Cam Manager] "C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe"
                                    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                                    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                                    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                                    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                                    O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
                                    O4 - Startup: RocketDock.lnk = C:\Program Files\interface vista\Vista Inspirat 2\RocketDock\RocketDock.exe
                                    O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
                                    O8 - Extra context menu item: &Clean Traces - F:\Pour Telecharger\DAP\Privacy Package\dapcleanerie.htm
                                    O8 - Extra context menu item: &Download with &DAP - F:\Pour Telecharger\DAP\dapextie.htm
                                    O8 - Extra context menu item: Chercher avec Copernic Agent - res://C:\Program Files\Copernic Agent\CopernicAgentExt.rdl/INTEGRATION_MENU_SEARCHEXT
                                    O8 - Extra context menu item: Download &all with DAP - F:\Pour Telecharger\DAP\dapextie2.htm
                                    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
                                    O8 - Extra context menu item: Ouvrir le cadre dans une nouvelle fenêtre - C:\WINDOWS\web\OpenFrame.htm
                                    O8 - Extra context menu item: Rechercher avec Voila - file://C:\Program Files\WANADOO_TOOLBAR\Cache\SelectedContextSearch.htm
                                    O8 - Extra context menu item: Surligner en Jaune - C:\WINDOWS\web\MarqueurFluoYellow.htm
                                    O8 - Extra context menu item: Surligner en Rose - C:\WINDOWS\web\MarqueurFluoPink.htm
                                    O8 - Extra context menu item: Surligner en Vert - C:\WINDOWS\web\MarqueurFluoGreen.htm
                                    O8 - Extra context menu item: Télécharger avec Star Downloader - F:\Pour Telecharger\Star doneloder\Star Downloader\sdie.htm
                                    O8 - Extra context menu item: Voir les cookies - C:\WINDOWS\web\showcookies.htm
                                    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                                    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                                    O9 - Extra button: (no name) - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
                                    O9 - Extra 'Tools' menuitem: Démarrer Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
                                    O9 - Extra button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
                                    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
                                    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
                                    O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\WINDOWS\system32\shdocvw.dll
                                    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
                                    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                                    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                                    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                                    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                                    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                                    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                                    O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
                                    O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} - https://support.norton.com/sp/en/us/home/current/info
                                    O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
                                    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
                                    O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://drivers1.free.fr/telecharger.php?id=2&version=
                                    O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://support.norton.com/sp/en/us/home/current/info
                                    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
                                    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
                                    O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
                                    O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
                                    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                                    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
                                    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
                                    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                                    O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
                                    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
                                    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                                    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
                                    O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
                                    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
                                    O23 - Service: MysqlInventime - Unknown owner - c:\mysql\bin\mysqld-nt.exe (file missing)
                                    O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
                                    O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe
                                    0
                                    2. Mary
                                      Yahouuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuu!!!!

                                      Merci bcp, de ma part mais surtout de la part de mon ordi!!!
                                      0
                                      Précédent
                                      • 1
                                      • 2

                                      Discussions similaires

                                      Problème avec "PUADIManager:Win32/OfferCore
                                      Knaki

                                      3 réponses
                                      Supprimer $McRebootA5E6DEAA56$.lnk , virus ?
                                      Amelie30530

                                      19 réponses
                                      Comment ouvrir fichier avec extension .lnk
                                      Cyberdarlac

                                      4 réponses
                                      ouvrir les fichiers lnk
                                      Elinux

                                      18 réponses
                                      Softonic,est-ce un virus ?
                                      techmel1

                                      6 réponses