Redirection non désirée

Question

Bonjour,

J'ai quelques petits soucis avec mon PC lorsque je me connecte à certains sites, une autre page apparaît à la place de celle demandée ! 
De plus il me semble aussi rencontrer certaines difficultés à télécharger des fichiers (ça bloque au milieu du téléchargement). 

Je vous colle déjà un petit hijackthis pour la route:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:33:16, on 01.03.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\CTHELPER.EXE
C:\WINDOWS\system32\CTXFIHLP.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE
C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe
C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Canon\MultiPASS4\monitr32.exe
C:\Program Files\Canon\MultiPASS4\MPTBox.exe
C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Fichiers communs\Teleca Shared\CapabilityManager.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Windows Live\Contrôle parental\fssui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\winlogon.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.video2000.ch/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: IE7Pro - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files\IEPro\iepro.dll
O2 - BHO: Windows Live OneCare Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Contrôle parental\fssbho.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: TV5 - Dictionnaires - {CEDDA62D-5FBE-4AB2-AE2E-5E069F444444} - C:\Program Files\Dico TV5\MDTV5TB.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [CTDVDDET] "C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE"
O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" /r
O4 - HKLM\..\Run: [AudioDrvEmulator] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll"
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\ISUSPM.exe" -startup
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe 
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [monitr32] C:\Program Files\Canon\MultiPASS4\monitr32.exe
O4 - HKLM\..\Run: [MPTBox] C:\Program Files\Canon\MultiPASS4\MPTBox.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [AdobeVersionCue] C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [fssui] "C:\Program Files\Windows Live\Contrôle parental\fssui.exe" -autorun
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-21-3113122520-2486959141-1304036979-1006\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Bouchra')
O4 - HKUS\S-1-5-21-3113122520-2486959141-1304036979-1006\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" (User 'Bouchra')
O4 - HKUS\S-1-5-21-3113122520-2486959141-1304036979-1006\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime (User 'Bouchra')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Assistant d'Acrobat.lnk = C:\Program Files\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://s.tf1.fr/mmdia/static/rawflow/clients/5.3.1.0/Rawflow.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://62.202.10.41/activex/AxisCamControl.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {DFB5BCF1-06AE-4ABB-BFA8-1E228F41C50A} - https://www.bobtv.fr/download/cfweb_www.bobtv.fr-download_instmodule.exe
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AdobeVersionCue - Adobe Sytems - C:\Program Files\Adobe\Adobe Version Cue\service\VersionCue.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Intel® Quick Resume Technology Drivers (ELService) - Intel Corporation - C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology\ELService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MpService - Canon Inc - C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

green day · Answer

Salut

# Télécharge ceci: (merci a S!RI pour ce petit programme). 

http://siri.urz.free.fr/Fix/SmitfraudFix.zip 

Exécute le, Double click sur Smitfraudfix.cmd choisit l’option 1, 
voila a quoi cela ressemble : http://siri.urz.free.fr/Fix/SmitfraudFix.php 
il va générer un rapport : copie/colle le sur le poste stp. 


++

DllD · Answer

Bonsoir,
>Ouvre ce lien (merci a S!RI pour ce fix) http://siri.urz.free.fr/Fix/SmitfraudFix.php et télécharge SmitfraudFix.exe.
- Regarde le tuto
- Exécute le programme et choisi l’option 1
Le programme va générer un rapport, copie/colle le sur le forum stp. 

A+

:)

codu · Answer

j'ai dézippé le fichier et j'ai plein d'exe mais pas celui mentionné dans le tutorial, je clique sur lequel?

booddha · Answer

C'est une cocotte minute ce PC

green day · Answer

voir le tuto ici : http://siri.urz.free.fr/Fix/SmitfraudFix.php

++

codu · Answer

voili, voilà

SmitFraudFix v2.299

Rapport fait à 22:46:20.88, 01.03.2008
Executé à partir de C:\Documents and Settings\Christophe\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\CTHELPER.EXE
C:\WINDOWS\system32\CTXFIHLP.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE
C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe
C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Canon\MultiPASS4\monitr32.exe
C:\Program Files\Canon\MultiPASS4\MPTBox.exe
C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Fichiers communs\Teleca Shared\CapabilityManager.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Windows Live\Contrôle parental\fssui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\winlogon.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Christophe


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Christophe\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\CHRIST~1\Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files 


»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
 
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"
 

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Rustock



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Intel(R) PRO/1000 PL Network Connection - Miniport d'ordonnancement de paquets
DNS Server Search Order: 80.83.47.198
DNS Server Search Order: 80.83.47.11
DNS Server Search Order: 80.83.47.157
DNS Server Search Order: 80.83.47.10

HKLM\SYSTEM\CCS\Services\Tcpip\..\{83E6215F-3F9B-40C9-8DA7-F3CE456985C1}: DhcpNameServer=80.83.47.198 80.83.47.11 80.83.47.157 80.83.47.10
HKLM\SYSTEM\CS1\Services\Tcpip\..\{83E6215F-3F9B-40C9-8DA7-F3CE456985C1}: DhcpNameServer=80.83.47.198 80.83.47.11 80.83.47.157 80.83.47.10
HKLM\SYSTEM\CS3\Services\Tcpip\..\{83E6215F-3F9B-40C9-8DA7-F3CE456985C1}: DhcpNameServer=80.83.47.198 80.83.47.11 80.83.47.157 80.83.47.10
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=80.83.47.198 80.83.47.11 80.83.47.157 80.83.47.10
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=80.83.47.198 80.83.47.11 80.83.47.157 80.83.47.10
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=80.83.47.198 80.83.47.11 80.83.47.157 80.83.47.10


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

DllD · Answer

Green day,
tout compte fait je te laisse la place...

A+

:)))

green day · Answer

Tsssss ! j'avions posté 4 minutes avant toi ! :p

Codu :

Télécharger ComboFix (par sUBs) sur le Bureau : http://download.bleepingcomputer.com/sUBs/ComboFix.exe 

* Démarrer en mode sans echec 
* Double cliquer combofix.exe. 
* Appuyer sur la touche Y (Yes) pour démarrer le scan 
* Le rapport sera crée dans: C:\Combofix.txt, poste le stp 

++

codu · Answer

et voilà le travail ! (je suis revenu en mode normal)

ComboFix 08-03-01.3 - Christophe 2008-03-01 23:04:36.1 - NTFSx86 MINIMAL
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1731 [GMT 1:00]
Endroit: C:\Documents and Settings\Christophe\Bureau\ComboFix.exe

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.

((((((((((((((((((((((((((((( Fichiers créés 2008-02-01 to 2008-03-01 ))))))))))))))))))))))))))))))))))))
.

2008-02-27 19:40 . 2007-10-17 13:53 43,816 --a------ C:\WINDOWS\system32\drivers\fssfltr.sys
2008-02-27 19:39 . 2006-11-29 13:06 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll
2008-02-27 19:38 . 2008-02-27 19:38 <REP> d-------- C:\Program Files\Microsoft SQL Server Compact Edition
2008-02-27 19:37 . 2008-02-27 19:37 <REP> d-------- C:\Program Files\Windows Live Toolbar
2008-02-27 19:37 . 2008-02-27 19:37 <REP> d-------- C:\Program Files\Windows Live Favorites
2008-02-27 19:28 . 2008-02-27 19:31 <REP> d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller
2008-02-27 19:24 . 2008-02-27 19:28 <REP> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-02-24 22:22 . 2006-03-11 16:12 3,956,547 --------- C:\WINDOWS\YMP.CAB
2008-02-24 22:22 . 2008-02-24 22:22 74,752 --a------ C:\WINDOWS\ST6UNST.EXE
2008-02-23 01:14 . 2008-02-23 01:14 0 --a------ C:\WINDOWS\nsreg.dat
2008-02-20 22:02 . 2008-02-20 22:02 <REP> d-------- C:\Program Files\ooVoo
2008-02-20 22:02 . 2008-02-20 22:15 <REP> d-------- C:\Documents and Settings\Christophe\Application Data\ooVoo Details
2008-02-20 17:48 . 2008-02-20 17:48 <REP> d-------- C:\Documents and Settings\Orane\Application Data\IEPro
2008-02-20 17:47 . 2008-02-20 17:47 <REP> d-------- C:\Documents and Settings\Orane\Application Data\Grisoft
2008-02-16 18:20 . 2008-02-16 18:20 1,409 --a------ C:\WINDOWS\system32\tmp8DE63.FOT
2008-02-12 23:37 . 2008-02-12 23:38 1,374 --a------ C:\WINDOWS\imsins.BAK
2008-02-10 18:45 . 2008-02-10 18:45 <REP> d-------- C:\Documents and Settings\Bouchra\Application Data\Grisoft
2008-02-08 21:07 . 2008-02-08 21:07 <REP> d-------- C:\Documents and Settings\Yanis\Application Data\Grisoft
2008-02-05 21:20 . 2008-02-05 21:23 <REP> d-------- C:\Program Files\Lopxp
2008-02-05 21:00 . 2008-02-05 21:01 <REP> d-------- C:\Program Files\CleanUp!
2008-02-05 19:57 . 2008-02-05 19:57 <REP> d-------- C:\WINDOWS\ERUNT
2008-02-05 07:02 . 2008-02-05 07:02 <REP> d-------- C:\Program Files\Trend Micro
2008-02-05 00:16 . 2008-02-05 06:56 <REP> d-------- C:\WINDOWS\BDOSCAN8
2008-02-04 22:46 . 2008-02-04 22:46 <REP> d-------- C:\Documents and Settings\Christophe\Application Data\Grisoft
2008-02-04 22:45 . 2008-02-04 22:45 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-02-04 22:45 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-02-04 22:34 . 2008-02-04 22:34 <REP> d-------- C:\Program Files\CCleaner
2008-02-04 00:27 . 2008-02-04 00:27 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
2008-02-04 00:27 . 2008-02-04 20:47 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-01 20:10 . 2008-02-01 20:10 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-02-01 20:10 . 2008-02-01 20:10 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-02-01 11:17 . 2008-02-01 11:17 587,264 --a------ C:\WINDOWS\WLXPGSS.SCR

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-01 21:46 6,172 ----a-w C:\WINDOWS\system32\tmp.reg
2008-02-29 22:48 82,432 ----a-w C:\WINDOWS\system32\IEDFix.exe
2008-02-29 15:16 355,988 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-02-29 15:16 30,107,680 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-02-28 10:37 86,016 ----a-w C:\WINDOWS\system32\VACFix.exe
2008-02-28 00:03 --------- d-----w C:\Program Files\Windows Live
2008-02-27 18:33 --------- d-----w C:\Program Files\MSN Messenger
2008-02-24 21:22 --------- d-----w C:\Program Files\Yahoo!
2008-02-24 20:24 --------- d-----w C:\Documents and Settings\Christophe\Application Data\Skype
2008-02-20 21:01 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-13 21:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-02-05 22:51 --------- d-----w C:\Documents and Settings\All Users\Application Data\ZoomBrowser
2008-02-05 20:12 --------- d-----w C:\Program Files\FreeAngel
2008-02-05 18:29 --------- d-----w C:\Program Files\Navilog1
2008-02-01 21:58 --------- d-----w C:\Documents and Settings\Christophe\Application Data\SecondLife
2008-02-01 19:10 --------- d-----w C:\Program Files\Lavasoft
2008-01-15 22:21 --------- d-----w C:\Documents and Settings\Christophe\Application Data\Panasonic
2008-01-15 22:16 --------- d-----w C:\Program Files\Panasonic
2008-01-15 22:16 --------- d-----w C:\Documents and Settings\Christophe\Application Data\InstallShield
2008-01-11 16:09 --------- d-----w C:\Documents and Settings\Bouchra\Application Data\ZoomBrowser EX
2008-01-11 05:36 44,544 ----a-w C:\WINDOWS\system32\dllcache\pngfilt.dll
2008-01-10 17:53 --------- d-----w C:\Documents and Settings\Bouchra\Application Data\IEPro
2008-01-09 14:01 53,248 ----a-w C:\WINDOWS\bdoscandel.exe
2008-01-08 17:17 --------- d-----w C:\Documents and Settings\Christophe\Application Data\ZoomBrowser EX
2008-01-06 08:52 --------- d-----w C:\Documents and Settings\Yanis\Application Data\IEPro
2008-01-05 21:09 --------- d-----w C:\Documents and Settings\Christophe\Application Data\MiniDm
2008-01-04 10:37 --------- d-----w C:\Documents and Settings\Christophe\Application Data\IEPro
2008-01-04 10:36 --------- d-----w C:\Program Files\IEPro
2008-01-04 10:36 --------- d-----w C:\Program Files\IE7Pro
2008-01-04 10:36 --------- d-----w C:\Documents and Settings\Christophe\Application Data\IE7Pro
2008-01-01 18:34 75,932 ----a-w C:\WINDOWS\system32\drivers\klick.dat
2008-01-01 18:34 74,396 ----a-w C:\WINDOWS\system32\drivers\klin.dat
2008-01-01 18:34 --------- d-----w C:\Documents and Settings\All Users\Application Data\MailFrontier
2008-01-01 18:33 --------- d-----w C:\Program Files\Zone Labs
2007-12-19 22:53 347,136 ----a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll
2007-12-18 09:51 179,584 ------w C:\WINDOWS\system32\dllcache\mrxdav.sys
2007-12-14 10:32 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe
2007-12-08 05:08 3,592,192 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2007-12-06 11:03 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe
2007-12-06 11:02 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2007-12-06 11:00 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
2007-12-06 04:59 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll
2007-12-04 18:41 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
2007-12-04 18:41 550,912 ------w C:\WINDOWS\system32\dllcache\oleaut32.dll
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr
2007-08-03 16:29 560 ----a-w C:\Documents and Settings\Bouchra\Application Data\ViewerApp.dat
2006-11-03 22:18 284 ----a-w C:\Documents and Settings\Christophe\Application Data\ViewerApp.dat
2006-03-27 20:57 104 --sh--r C:\WINDOWS\system32\D814B28974.sys
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4f3ed5cd-0726-42a9-87f5-d13f3d2976ac}]
2007-12-17 11:12 56360 --a------ C:\Program Files\Windows Live\Contrôle parental\fssbho.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{47833539-D0C5-4125-9FA8-0819E2EAAC93}
{CEDDA62D-5FBE-4AB2-AE2E-5E069F444444}
{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}

[HKEY_CLASSES_ROOT\clsid\{cedda62d-5fbe-4ab2-ae2e-5e069f444444}]
[HKEY_CLASSES_ROOT\MDTV5Tb.IEToolBar.1]
[HKEY_CLASSES_ROOT\TypeLib\{43C9998B-DB65-4F03-8C57-BBF146CCCCCC}]
[HKEY_CLASSES_ROOT\MDTV5Tb.IEToolBar]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 13:00 15360]
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2007-02-27 20:37 67128]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24 1694208]
"LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [2004-10-08 11:06 196608]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 19:04 139264]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-12-17 17:13 3810544]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-09-29 15:01 67584]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-07-08 17:57 7110656]
"CTHelper"="CTHELPER.EXE" [2005-11-08 13:30 16384 C:\WINDOWS\CTHELPER.EXE]
"CTxfiHlp"="CTXFIHLP.EXE" [2006-03-02 05:00 18944 C:\WINDOWS\system32\CTXFIHLP.EXE]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11 132496]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2005-06-17 08:56 139264]
"DMXLauncher"="C:\Program Files\Dell\Media Experience\DMXLauncher.exe" [2005-10-05 04:12 94208]
"CTDVDDET"="C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE" [2003-06-18 02:00 45056]
"VolPanel"="C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" [2005-10-14 12:01 122880]
"AudioDrvEmulator"="C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" [2005-11-04 19:07 49152]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 02:00 90112]
"ISUSPM Startup"="C:\Program Files\Fichiers communs\InstallShield\UpdateService\ISUSPM.exe" [2005-06-10 11:44 249856]
"DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-09-08 06:20 122940]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2004-10-08 11:52 221184]
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2004-10-08 11:31 458752]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2004-10-08 11:24 217088]
"monitr32"="C:\Program Files\Canon\MultiPASS4\monitr32.exe" [2002-10-29 10:35 315392]
"MPTBox"="C:\Program Files\Canon\MultiPASS4\MPTBox.exe" [2001-12-12 10:56 151552]
"MSKDetectorExe"="C:\Program Files\McAfee\SpamKiller\MSKDetct.exe" [2005-08-12 15:16 1121792]
"AdobeVersionCue"="C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe" [2003-10-22 15:33 1732608]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 15:17 159744]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2006-08-01 09:36 180269]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
"NeroFilterCheck"="C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2006-01-12 15:40 155648]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 10:54 282624]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-03-02 15:24 257088]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-05-14 23:22 35328]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2006-10-23 01:48 40048]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 18:20 866584]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-06-21 21:54 919016]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312]
"fssui"="C:\Program Files\Windows Live\Contrôle parental\fssui.exe" [2007-12-17 11:12 243240]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-10 13:00 15360]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Adobe Gamma Loader.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2006-03-28 17:33:51 110592]
Adobe Reader Synchronizer.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2007-05-10 23:29:22 738968]
Assistant d'Acrobat.lnk - C:\Program Files\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe [2003-10-24 05:37:56 217194]
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-02-27 20:37:21 67128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\NetMeeting\\conf.exe"=
"C:\\Program Files\\SecondLife\\SecondLife.exe"=
"C:\\Program Files\\BitTorrent\\bittorrent.exe"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Zattoo\\zattood.exe"=
"C:\\Program Files\\Zattoo\\Zattoo1.exe"=
"C:\\Program Files\\Internet Explorer\\iexplore.exe"=
"C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"C:\\Program Files\\SecondLife\\SLVoice.exe"=
"C:\\WINDOWS\\system32\\ZoneLabs\\avsys\\ScanningProcess.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"443:TCP"= 443:TCP:*:Disabled:TCP port 443 ooVoo
"443:UDP"= 443:UDP:*:Disabled:UDP port 443 ooVoo
"37674:TCP"= 37674:TCP:*:Disabled:TCP port 37674 ooVoo
"37674:UDP"= 37674:UDP:*:Disabled:UDP port 37674 ooVoo
"37675:UDP"= 37675:UDP:*:Disabled:UDP port 37675 ooVoo

R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 00:08]
S2 cis1284;cis1284;C:\WINDOWS\system32\drivers\cis1284.sys [2001-09-03 10:02]
S2 fssfltr;FssFltr;C:\WINDOWS\system32\DRIVERS\fssfltr.sys [2007-10-17 13:53]
S2 fsssvc;Windows Live OneCare Contrôle parental;"C:\Program Files\Windows Live\Contrôle parental\fsssvc.exe" [2007-12-17 11:13]
S3 ha20x2k;Creative 20X HAL Driver;C:\WINDOWS\system32\drivers\ha20x2k.sys [2006-02-15 07:40]
S3 sonypvs1;Sony Digital Imaging Video2;C:\WINDOWS\system32\DRIVERS\sonypvs1.sys [2002-10-15 22:41]
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 21:58]

.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2007-03-14 05:31:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-03-01 22:05:10 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
"2008-03-01 21:36:06 C:\WINDOWS\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-01 23:07:21
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
CTHelper = CTHELPER.EXE?
CTxfiHlp = CTXFIHLP.EXE?

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-03-01 23:08:27
.
2008-02-29 14:18:26 --- E O F ---

codu · Answer

déjà au dodo?

codu · Answer

quelqu'un pour reprendre mon problème?

green day · Answer

Salut

on tarde à répondre, mais on n'abandonne pas nos postes !

Crée un nouveau document texte et nomme le CFScript.txt ( attention très important ! ) : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes en gras : 

File:: 

C:\WINDOWS\system32\drivers\klick.dat
C:\WINDOWS\system32\drivers\klin.dat
C:\WINDOWS\system32\VACFix.exe 
C:\WINDOWS\imsins.BAK 
C:\WINDOWS\YMP.CAB 
C:\WINDOWS
sreg.dat 

ensuite fais glisser le fichier texte sur combo.exe comme sur l'animation : 
http://img.bleepingcomputer.com/combofix/usage/rc.gif

Dans la fenêtre qui suit, choisie l'option 1 puis valide 
Patiente un peu, si le bureau disparait parfois durant le scan : c'est normal ! 
A la fin du scan, un rapport va s'afficher : poste le stp ( sinon il se situe dans ici : C:\ComboFix.txt ) 

++

codu · Answer

J'ai suivi les instructions, mais j'ai le message suivant qui vient juste après le démarrage de combofix:

Etiez-vous en train ex,cuter CFScript?
Le nom CFScript semble ^tre incorrectement ,crit
(sic)

Merci de me dire ce que je dois faire?

green day · Answer

ça signifie que tu as du mal nommé le fichier !

 est-ce que tu as bien enregistré le script sous le nom de : CFScript.txt  ??

++

codu · Answer

Voilà:

ComboFix 08-03-01.3 - Christophe 2008-03-02 14:16:44.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.41.1036.18.1319 [GMT 1:00]
Endroit: C:\Documents and Settings\Christophe\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\Christophe\Bureau\CFScript.txt
* Création d'un nouveau point de restauration

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.

((((((((((((((((((((((((((((( Fichiers créés 2008-02-02 to 2008-03-02 ))))))))))))))))))))))))))))))))))))
.

2008-02-27 19:40 . 2007-10-17 13:53 43,816 --a------ C:\WINDOWS\system32\drivers\fssfltr.sys
2008-02-27 19:39 . 2006-11-29 13:06 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll
2008-02-27 19:38 . 2008-02-27 19:38 <REP> d-------- C:\Program Files\Microsoft SQL Server Compact Edition
2008-02-27 19:37 . 2008-02-27 19:37 <REP> d-------- C:\Program Files\Windows Live Toolbar
2008-02-27 19:37 . 2008-02-27 19:37 <REP> d-------- C:\Program Files\Windows Live Favorites
2008-02-27 19:28 . 2008-02-27 19:31 <REP> d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller
2008-02-27 19:24 . 2008-02-27 19:28 <REP> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-02-24 22:22 . 2006-03-11 16:12 3,956,547 --------- C:\WINDOWS\YMP.CAB
2008-02-24 22:22 . 2008-02-24 22:22 74,752 --a------ C:\WINDOWS\ST6UNST.EXE
2008-02-23 01:14 . 2008-02-23 01:14 0 --a------ C:\WINDOWS\nsreg.dat
2008-02-20 22:02 . 2008-02-20 22:02 <REP> d-------- C:\Program Files\ooVoo
2008-02-20 22:02 . 2008-02-20 22:15 <REP> d-------- C:\Documents and Settings\Christophe\Application Data\ooVoo Details
2008-02-20 17:48 . 2008-02-20 17:48 <REP> d-------- C:\Documents and Settings\Orane\Application Data\IEPro
2008-02-20 17:47 . 2008-02-20 17:47 <REP> d-------- C:\Documents and Settings\Orane\Application Data\Grisoft
2008-02-16 18:20 . 2008-02-16 18:20 1,409 --a------ C:\WINDOWS\system32\tmp8DE63.FOT
2008-02-12 23:37 . 2008-02-12 23:38 1,374 --a------ C:\WINDOWS\imsins.BAK
2008-02-10 18:45 . 2008-02-10 18:45 <REP> d-------- C:\Documents and Settings\Bouchra\Application Data\Grisoft
2008-02-08 21:07 . 2008-02-08 21:07 <REP> d-------- C:\Documents and Settings\Yanis\Application Data\Grisoft
2008-02-05 21:20 . 2008-02-05 21:23 <REP> d-------- C:\Program Files\Lopxp
2008-02-05 21:00 . 2008-02-05 21:01 <REP> d-------- C:\Program Files\CleanUp!
2008-02-05 19:57 . 2008-02-05 19:57 <REP> d-------- C:\WINDOWS\ERUNT
2008-02-05 07:02 . 2008-02-05 07:02 <REP> d-------- C:\Program Files\Trend Micro
2008-02-05 00:16 . 2008-02-05 06:56 <REP> d-------- C:\WINDOWS\BDOSCAN8
2008-02-04 22:46 . 2008-02-04 22:46 <REP> d-------- C:\Documents and Settings\Christophe\Application Data\Grisoft
2008-02-04 22:45 . 2008-02-04 22:45 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-02-04 22:45 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-02-04 22:34 . 2008-02-04 22:34 <REP> d-------- C:\Program Files\CCleaner
2008-02-04 00:27 . 2008-02-04 00:27 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
2008-02-04 00:27 . 2008-02-04 20:47 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-02 13:11 --------- d-----w C:\Documents and Settings\Christophe\Application Data\Skype
2008-03-01 21:46 6,172 ----a-w C:\WINDOWS\system32\tmp.reg
2008-02-29 22:48 82,432 ----a-w C:\WINDOWS\system32\IEDFix.exe
2008-02-29 15:16 355,988 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-02-29 15:16 30,107,680 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-02-28 10:37 86,016 ----a-w C:\WINDOWS\system32\VACFix.exe
2008-02-28 00:03 --------- d-----w C:\Program Files\Windows Live
2008-02-27 18:33 --------- d-----w C:\Program Files\MSN Messenger
2008-02-24 21:22 --------- d-----w C:\Program Files\Yahoo!
2008-02-20 21:01 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-13 21:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-02-05 22:51 --------- d-----w C:\Documents and Settings\All Users\Application Data\ZoomBrowser
2008-02-05 20:12 --------- d-----w C:\Program Files\FreeAngel
2008-02-05 18:29 --------- d-----w C:\Program Files\Navilog1
2008-02-01 21:58 --------- d-----w C:\Documents and Settings\Christophe\Application Data\SecondLife
2008-02-01 19:10 --------- d-----w C:\Program Files\Lavasoft
2008-02-01 19:10 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-02-01 19:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-02-01 10:17 587,264 ----a-w C:\WINDOWS\WLXPGSS.SCR
2008-01-15 22:21 --------- d-----w C:\Documents and Settings\Christophe\Application Data\Panasonic
2008-01-15 22:16 --------- d-----w C:\Program Files\Panasonic
2008-01-15 22:16 --------- d-----w C:\Documents and Settings\Christophe\Application Data\InstallShield
2008-01-11 16:09 --------- d-----w C:\Documents and Settings\Bouchra\Application Data\ZoomBrowser EX
2008-01-11 05:36 44,544 ----a-w C:\WINDOWS\system32\dllcache\pngfilt.dll
2008-01-10 17:53 --------- d-----w C:\Documents and Settings\Bouchra\Application Data\IEPro
2008-01-09 14:01 53,248 ----a-w C:\WINDOWS\bdoscandel.exe
2008-01-08 17:17 --------- d-----w C:\Documents and Settings\Christophe\Application Data\ZoomBrowser EX
2008-01-06 08:52 --------- d-----w C:\Documents and Settings\Yanis\Application Data\IEPro
2008-01-05 21:09 --------- d-----w C:\Documents and Settings\Christophe\Application Data\MiniDm
2008-01-04 10:37 --------- d-----w C:\Documents and Settings\Christophe\Application Data\IEPro
2008-01-04 10:36 --------- d-----w C:\Program Files\IEPro
2008-01-04 10:36 --------- d-----w C:\Program Files\IE7Pro
2008-01-04 10:36 --------- d-----w C:\Documents and Settings\Christophe\Application Data\IE7Pro
2007-12-19 22:53 347,136 ----a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll
2007-12-18 09:51 179,584 ------w C:\WINDOWS\system32\dllcache\mrxdav.sys
2007-12-14 10:32 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe
2007-12-08 05:08 3,592,192 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2007-12-06 11:03 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe
2007-12-06 11:02 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2007-12-06 11:00 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
2007-12-06 04:59 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll
2007-12-04 18:41 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
2007-12-04 18:41 550,912 ------w C:\WINDOWS\system32\dllcache\oleaut32.dll
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr
2007-08-03 16:29 560 ----a-w C:\Documents and Settings\Bouchra\Application Data\ViewerApp.dat
2006-11-03 22:18 284 ----a-w C:\Documents and Settings\Christophe\Application Data\ViewerApp.dat
2006-03-27 20:57 104 --sh--r C:\WINDOWS\system32\D814B28974.sys
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4f3ed5cd-0726-42a9-87f5-d13f3d2976ac}]
2007-12-17 11:12 56360 --a------ C:\Program Files\Windows Live\Contrôle parental\fssbho.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{47833539-D0C5-4125-9FA8-0819E2EAAC93}
{CEDDA62D-5FBE-4AB2-AE2E-5E069F444444}
{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}

[HKEY_CLASSES_ROOT\clsid\{cedda62d-5fbe-4ab2-ae2e-5e069f444444}]
[HKEY_CLASSES_ROOT\MDTV5Tb.IEToolBar.1]
[HKEY_CLASSES_ROOT\TypeLib\{43C9998B-DB65-4F03-8C57-BBF146CCCCCC}]
[HKEY_CLASSES_ROOT\MDTV5Tb.IEToolBar]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 13:00 15360]
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2007-02-27 20:37 67128]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24 1694208]
"LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [2004-10-08 11:06 196608]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 19:04 139264]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-12-17 17:13 3810544]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-09-29 15:01 67584]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-07-08 17:57 7110656]
"CTHelper"="CTHELPER.EXE" [2005-11-08 13:30 16384 C:\WINDOWS\CTHELPER.EXE]
"CTxfiHlp"="CTXFIHLP.EXE" [2006-03-02 05:00 18944 C:\WINDOWS\system32\CTXFIHLP.EXE]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11 132496]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2005-06-17 08:56 139264]
"DMXLauncher"="C:\Program Files\Dell\Media Experience\DMXLauncher.exe" [2005-10-05 04:12 94208]
"CTDVDDET"="C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE" [2003-06-18 02:00 45056]
"VolPanel"="C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" [2005-10-14 12:01 122880]
"AudioDrvEmulator"="C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" [2005-11-04 19:07 49152]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 02:00 90112]
"ISUSPM Startup"="C:\Program Files\Fichiers communs\InstallShield\UpdateService\ISUSPM.exe" [2005-06-10 11:44 249856]
"DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-09-08 06:20 122940]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2004-10-08 11:52 221184]
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2004-10-08 11:31 458752]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2004-10-08 11:24 217088]
"monitr32"="C:\Program Files\Canon\MultiPASS4\monitr32.exe" [2002-10-29 10:35 315392]
"MPTBox"="C:\Program Files\Canon\MultiPASS4\MPTBox.exe" [2001-12-12 10:56 151552]
"MSKDetectorExe"="C:\Program Files\McAfee\SpamKiller\MSKDetct.exe" [2005-08-12 15:16 1121792]
"AdobeVersionCue"="C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe" [2003-10-22 15:33 1732608]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 15:17 159744]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2006-08-01 09:36 180269]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
"NeroFilterCheck"="C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2006-01-12 15:40 155648]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 10:54 282624]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-03-02 15:24 257088]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-05-14 23:22 35328]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2006-10-23 01:48 40048]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 18:20 866584]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-06-21 21:54 919016]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312]
"fssui"="C:\Program Files\Windows Live\Contrôle parental\fssui.exe" [2007-12-17 11:12 243240]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-10 13:00 15360]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Adobe Gamma Loader.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2006-03-28 17:33:51 110592]
Adobe Reader Synchronizer.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2007-05-10 23:29:22 738968]
Assistant d'Acrobat.lnk - C:\Program Files\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe [2003-10-24 05:37:56 217194]
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-02-27 20:37:21 67128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\NetMeeting\\conf.exe"=
"C:\\Program Files\\SecondLife\\SecondLife.exe"=
"C:\\Program Files\\BitTorrent\\bittorrent.exe"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Zattoo\\zattood.exe"=
"C:\\Program Files\\Zattoo\\Zattoo1.exe"=
"C:\\Program Files\\Internet Explorer\\iexplore.exe"=
"C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"C:\\Program Files\\SecondLife\\SLVoice.exe"=
"C:\\WINDOWS\\system32\\ZoneLabs\\avsys\\ScanningProcess.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"443:TCP"= 443:TCP:*:Disabled:TCP port 443 ooVoo
"443:UDP"= 443:UDP:*:Disabled:UDP port 443 ooVoo
"37674:TCP"= 37674:TCP:*:Disabled:TCP port 37674 ooVoo
"37674:UDP"= 37674:UDP:*:Disabled:UDP port 37674 ooVoo
"37675:UDP"= 37675:UDP:*:Disabled:UDP port 37675 ooVoo

R2 cis1284;cis1284;C:\WINDOWS\system32\drivers\cis1284.sys [2001-09-03 10:02]
R2 fssfltr;FssFltr;C:\WINDOWS\system32\DRIVERS\fssfltr.sys [2007-10-17 13:53]
R2 fsssvc;Windows Live OneCare Contrôle parental;"C:\Program Files\Windows Live\Contrôle parental\fsssvc.exe" [2007-12-17 11:13]
R3 ha20x2k;Creative 20X HAL Driver;C:\WINDOWS\system32\drivers\ha20x2k.sys [2006-02-15 07:40]
R3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 21:58]
R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 00:08]
S3 sonypvs1;Sony Digital Imaging Video2;C:\WINDOWS\system32\DRIVERS\sonypvs1.sys [2002-10-15 22:41]

.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2007-03-14 05:31:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-03-02 09:28:59 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
"2008-03-02 12:36:01 C:\WINDOWS\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-02 14:19:57
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
CTHelper = CTHELPER.EXE?
CTxfiHlp = CTXFIHLP.EXE?

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-03-02 14:21:11
ComboFix2.txt 2008-03-01 22:08:28
.
2008-02-29 14:18:26 --- E O F ---

green day · Answer

tout n'a pas été supprimé ! :/

# Dans la fenêtre d'HijackThis, clique sur le bouton à droite Config 
# Clique sur le bouton Misc Tools Button 
# Clique sur le boutton ADS Spy 
# Dans la nouvelle fenêtre, clique sur le bouton Scan
# Enregistre le rapport et poste le stp 
  

++

codu · Answer

je fais un quick scan ou un scan normal (case à cocher en haut)?

codu · Answer

j'ai pris l'initative de décocher la case quick scan car avec ça ne me donnait rien, alors c'est en train de scanner le tout

green day · Answer

e fais un quick scan ou un scan normal (case à cocher en haut)?

euh ! ben il y a juste marquer "scan" normalement !

++

codu · Answer

par contre j'ai laissé cohéla case: ignore safe system info stream

codu · Answer

j'ai la vesrion 2.0.2 peut-être n'est-ce pas la même que la tienne
Je nais pas de bouton config à droite non plus d'ailleurs mais juste un bouton "Open the Misc Tools Section"

green day · Answer

si, si j'ai la même version ! :)

ok, je vois ce que tu veux dire, en bas de la fenêtre "configuration" tu as scan et save log, choisis scan, ( quick scan, oui ) tu enregistre le rapport et tu le poste stp

++

codu · Answer

alors avec quick scan coché en haut de la fenêtre le résultat du scan est tout blanc!
si je décoche la case quick scan et que je refais un scan j'obtiens un rapport long comme un jour sans pain que je n'arrive même pas à poster ici tellement il est long !!!

green day · Answer

ben poste le en plusieurs fois ! :)

codu · Answer

je te mets déjà juste le début. Le reste est semblable à la fin cet extrait !!(rapport avec Windoes Live Mail). Parce que sinon je dois au monis le splitter en 10 morceaux !!

C:\Documents and Settings\All Users\Application Data\TEMP : DDCA146A  (128 bytes)
C:\Documents and Settings\All Users\Application Data\TEMP : DDCA146A  (128 bytes)
C:\Documents and Settings\Bouchra : zylomtest  (0 bytes)
C:\Documents and Settings\Bouchra : zylomtr{00009BV5-V6E6-N99D-O8SF-9VRP3OLUMVJE}  (16 bytes)
C:\Documents and Settings\Bouchra : zylomtr{000HQ7FF-AD7A-3FG1-79JF-24IHS7M88VVQ}  (15 bytes)
C:\Documents and Settings\Bouchra : zylomtr{000HQ7FF-AD7A-3FG1-7LLS-22TDACKJ0VU0}  (16 bytes)
C:\Documents and Settings\Bouchra : zylomtr{000HQ7FF-AD7A-3FG1-7LLS-22TDACKJ0VUB}  (17 bytes)
C:\Documents and Settings\Bouchra : zylomtr{000HQ7FF-AD7A-3FG1-LJA7-23N68QP08VVO}  (15 bytes)
C:\Documents and Settings\Bouchra : zylomtr{000HQ7FF-AD7A-3FG1-UOH6-232NI3D9QVV1}  (17 bytes)
C:\Documents and Settings\Bouchra : zylomtr{000HQ7FF-AD7A-3FG4-9VJM-21SJ3RB1CVVM}  (17 bytes)
C:\Documents and Settings\Bouchra : zylomtr{000HQ7FF-AD7A-3FG5-17FO-23BO70OD4VV8}  (17 bytes)
C:\Documents and Settings\Bouchra : zylomtr{000HQ7FF-AD7A-3FG5-BPAV-24QJBB1JIVUR}  (18 bytes)
C:\Documents and Settings\Bouchra : zylomtr{000HQ7FF-AD7A-3FG6-I9DG-237E1S0U4VVI}  (17 bytes)
C:\Documents and Settings\Bouchra : zylomtr{000HQ7FF-AD7A-3FG6-OKQM-24KG7RVO4VUM}  (17 bytes)
C:\Documents and Settings\Bouchra : zylomtr{000HQ7FF-AD7A-3FG7-7R56-23RS4QKC0VUL}  (17 bytes)
C:\Documents and Settings\Bouchra : zylomtr{000HQ7FF-AD7A-3FG7-7R56-23RS4QKC0VUV}  (18 bytes)
C:\Documents and Settings\Bouchra : zylomtest  (0 bytes)
C:\Documents and Settings\Bouchra : zylomtr{00009BV5-V6E6-N99D-O8SF-9VRP3OLUMVJE}  (16 bytes)
C:\Documents and Settings\Bouchra : zylomtr{000HQ7FF-AD7A-3FG1-79JF-24IHS7M88VVQ}  (15 bytes)
C:\Documents and Settings\Bouchra : zylomtr{000HQ7FF-AD7A-3FG1-7LLS-22TDACKJ0VU0}  (16 bytes)
C:\Documents and Settings\Bouchra : zylomtr{000HQ7FF-AD7A-3FG1-7LLS-22TDACKJ0VUB}  (17 bytes)
C:\Documents and Settings\Bouchra : zylomtr{000HQ7FF-AD7A-3FG1-LJA7-23N68QP08VVO}  (15 bytes)
C:\Documents and Settings\Bouchra : zylomtr{000HQ7FF-AD7A-3FG1-UOH6-232NI3D9QVV1}  (17 bytes)
C:\Documents and Settings\Bouchra : zylomtr{000HQ7FF-AD7A-3FG4-9VJM-21SJ3RB1CVVM}  (17 bytes)
C:\Documents and Settings\Bouchra : zylomtr{000HQ7FF-AD7A-3FG5-17FO-23BO70OD4VV8}  (17 bytes)
C:\Documents and Settings\Bouchra : zylomtr{000HQ7FF-AD7A-3FG5-BPAV-24QJBB1JIVUR}  (18 bytes)
C:\Documents and Settings\Bouchra : zylomtr{000HQ7FF-AD7A-3FG6-I9DG-237E1S0U4VVI}  (17 bytes)
C:\Documents and Settings\Bouchra : zylomtr{000HQ7FF-AD7A-3FG6-OKQM-24KG7RVO4VUM}  (17 bytes)
C:\Documents and Settings\Bouchra : zylomtr{000HQ7FF-AD7A-3FG7-7R56-23RS4QKC0VUL}  (17 bytes)
C:\Documents and Settings\Bouchra : zylomtr{000HQ7FF-AD7A-3FG7-7R56-23RS4QKC0VUV}  (18 bytes)
C:\Documents and Settings\Bouchra\Favoris\Liens\- Recette anniversaire enfant Annikids.url : favicon  (1150 bytes)
C:\Documents and Settings\Bouchra\Favoris\Liens\Amuses bouche.url : favicon  (766 bytes)
C:\Documents and Settings\Bouchra\Favoris\Liens\anabama.canalblog.com.url : favicon  (766 bytes)
C:\Documents and Settings\Bouchra\Favoris\Liens\anniversaires, gateaux à thème rigolos.url : favicon  (766 bytes)
C:\Documents and Settings\Bouchra\Favoris\Liens\ASOS.com - The Online Fashion Store - Women's Clothing & Designer Clothes (2).url : favicon  (894 bytes)
C:\Documents and Settings\Bouchra\Favoris\Liens\assiettesduchef.canalblog.com.url : favicon  (766 bytes)
C:\Documents and Settings\Bouchra\Favoris\Liens\ATTENTION - l'adresse du blog change ! Nouvelle adresse .url : favicon  (2862 bytes)
C:\Documents and Settings\Bouchra\Favoris\Liens\Aux portes du Paradis.url : favicon  (766 bytes)
C:\Documents and Settings\Bouchra\Favoris\Liens\Brandalley -grandes marques.url : favicon  (318 bytes)
C:\Documents and Settings\Bouchra\Favoris\Liens\Cadeaux d'anniversaire pour vos enfants.url : favicon  (2238 bytes)
C:\Documents and Settings\Bouchra\Favoris\Liens\chateau de princesse.url : favicon  (18718 bytes)
C:\Documents and Settings\Bouchra\Favoris\Liens\Chez Lorette - La table de L.url : favicon  (766 bytes)
C:\Documents and Settings\Bouchra\Favoris\Liens\Clea cuisine....url : favicon  (766 bytes)
C:\Documents and Settings\Bouchra\Favoris\Liens\Cuisine Marocaine.url : favicon  (766 bytes)
C:\Documents and Settings\Bouchra\Favoris\Liens\default.url : favicon  (1078 bytes)
C:\Documents and Settings\Bouchra\Favoris\Liens\Dulce Leche (confiture de lait) - cocopassions.url : favicon  (766 bytes)
C:\Documents and Settings\Bouchra\Favoris\Liens\Décors de tables Couronnes, Topiaires....url : favicon  (1406 bytes)
C:\Documents and Settings\Bouchra\Favoris\Liens\et une princesse ravie, une!!!! - les délices de manon.url : favicon  (766 bytes)
C:\Documents and Settings\Bouchra\Favoris\Liens\fr.url : favicon  (3638 bytes)
C:\Documents and Settings\Bouchra\Favoris\Liens\Gamelle production.url : favicon  (766 bytes)
C:\Documents and Settings\Bouchra\Favoris\Liens\Gateaux.url : favicon  (6598 bytes)
C:\Documents and Settings\Bouchra\Favoris\Liens\ghysmo.url : favicon  (894 bytes)
C:\Documents and Settings\Bouchra\Favoris\Liens\Google.url : favicon  (1406 bytes)
C:\Documents and Settings\Bouchra\Favoris\Liens\Gâteaux drôles; [Forums - Recettes pour les enfants] - Cuisine marocaine.url : favicon  (3638 bytes)
C:\Documents and Settings\Bouchra\Favoris\Liens\Hit-parade.com  le seul classement des sites francophones par audience.url : favicon  (1406 bytes)
C:\Documents and Settings\Bouchra\Favoris\Liens\index_mes_patis.url : favicon  (3638 bytes)
C:\Documents and Settings\Bouchra\Favoris\Liens\L'univers de Mag.url : favicon  (766 bytes)
C:\Documents and Settings\Bouchra\Favoris\Liens\La cuisine de Mercotte.url : favicon  (3638 bytes)
C:\Documents and Settings\Bouchra\Favoris\Liens\La cuisine en fête de Sakya Gâteaux de fêtes, glaçages et décorations.url : favicon  (3638 bytes)
C:\Documents and Settings\Bouchra\Favoris\Liens\La cuisine marocaine est l'une des meilleure au monde - Cuisine marocaine.url : favicon  (3638 bytes)
C:\Documents and Settings\Bouchra\Favoris\Liens\La popotte de Manue.url : favicon  (766 bytes)
C:\Documents and Settings\Bouchra\Favoris\Liens\Le Palais des Délices.url : favicon  (766 bytes)
C:\Documents and Settings\Bouchra\Favoris\Liens\LES GÂTEAUX RIGOLOS DES MAMANS -.url : favicon  (3638 bytes)
C:\Documents and Settings\Bouchra\Favoris\Liens\Les Gâteaux Rigolos des Mamans.url : favicon  (18718 bytes)
C:\Documents and Settings\Bouchra\Favoris\Liens\Les Recettes - Photos du gateau d' annivers. barbie façon entremets - (Recettes de cuisine familiales).url : favicon  (3262 bytes)
C:\Documents and Settings\Bouchra\Favoris\Liens\Martine et ses gâteaux -.url : favicon  (3638 bytes)
C:\Documents and Settings\Bouchra\Favoris\Liens\Printable instructions for the cake.url : favicon  (894 bytes)
C:\Documents and Settings\Bouchra\Favoris\Liens\Profiteroles fourrées à la crème de fruit de la passion -techniques des chefs.url : favicon  (3638 bytes)
C:\Documents and Settings\Bouchra\Favoris\Liens\pâte à sucre pour décorer les gateaux d'enfants.url : favicon  (3262 bytes)
C:\Documents and Settings\Bouchra\Favoris\Liens\Recettes de Patisserie - Nombreuses recettes de patisserie sur LaPatiss.url : favicon  (1406 bytes)
C:\Documents and Settings\Bouchra\Favoris\Liens\Recettes du Québec - Recettes en photos.url : favicon  (894 bytes)
C:\Documents and Settings\Bouchra\Favoris\Liens\Rochers noirs et variantes - La cuisine de Mimine.url : favicon  (766 bytes)
C:\Documents and Settings\Bouchra\Favoris\Liens\scally.typepad.com.url : favicon  (1406 bytes)
C:\Documents and Settings\Bouchra\Favoris\Liens\Shalima bricole janvier 2007.url : favicon  (822 bytes)
C:\Documents and Settings\Christophe\Favoris\Liens\AltaVista.url : favicon  (318 bytes)
C:\Documents and Settings\Christophe\Favoris\Liens\Courbe de croissance.url : favicon  (318 bytes)
C:\Documents and Settings\Christophe\Favoris\Liens\Google.url : favicon  (1406 bytes)
C:\Documents and Settings\Christophe\Favoris\Liens\Hotmail.url : favicon  (3638 bytes)
C:\Documents and Settings\Christophe\Favoris\Liens\Infobel World - Telephone Directories.url : favicon  (318 bytes)
C:\Documents and Settings\Christophe\Favoris\Liens\Les Pages Blanches.url : favicon  (5430 bytes)
C:\Documents and Settings\Christophe\Favoris\Liens\Liens BitTorrent, Bitorrent.url : favicon  (318 bytes)
C:\Documents and Settings\Christophe\Favoris\Liens\magicticket..url : favicon  (1150 bytes)
C:\Documents and Settings\Christophe\Favoris\Liens	el.search.ch.url : favicon  (318 bytes)
C:\Documents and Settings\Christophe\Favoris\Liens\Traduction.url : favicon  (894 bytes)
C:\Documents and Settings\Christophe\Favoris\Liens\TV5 - Dictionnaire MEDIADICO.url : favicon  (1406 bytes)
C:\Documents and Settings\Christophe\Favoris\Liens\UpToTen.url : favicon  (1406 bytes)
C:\Documents and Settings\Christophe\Favoris\Liens\wwiTV.com.url : favicon  (3638 bytes)
C:\Documents and Settings\Christophe\Favoris\Liens\Yellownet.url : favicon  (894 bytes)
C:\Documents and Settings\Christophe\Favoris\Voyages\Billet d'avion pas cher (vol sec, low cost), comparez les prix sur Liligo.fr.url : favicon  (1150 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\003179C0-00000295.eml : OEStandardProperty  (1690 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\004B3B7E-000001BB.eml : OEStandardProperty  (1824 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\006B0426-0000006D.eml : OEStandardProperty  (10490 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\006F49E2-00000268.eml : OEStandardProperty  (1618 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\00784DF9-0000006F.eml : OEStandardProperty  (1820 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\008E41C7-000001EB.eml : OEStandardProperty  (1726 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\00BD2D8B-0000010A.eml : OEStandardProperty  (1590 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\00C578E2-0000026E.eml : OEStandardProperty  (2184 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\012F55BE-00000129.eml : OEStandardProperty  (2140 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\01926279-00000293.eml : OEStandardProperty  (1574 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\01B268B5-00000154.eml : OEStandardProperty  (1612 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\01CE3FEE-000000C2.eml : OEStandardProperty  (1548 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\01E8598E-0000015E.eml : OEStandardProperty  (1546 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\021C7737-0000018B.eml : OEStandardProperty  (12700 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\025112C4-00000061.eml : OEStandardProperty  (1552 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\02831BB0-00000173.eml : OEStandardProperty  (2140 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\02FA7B2E-000001EE.eml : OEStandardProperty  (1526 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\0337088D-00000239.eml : OEStandardProperty  (1584 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\037B656B-0000019C.eml : OEStandardProperty  (1670 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\03C00F1C-0000025F.eml : OEStandardProperty  (1784 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\03D164A8-00000188.eml : OEStandardProperty  (1620 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\03D832AA-0000016A.eml : OEStandardProperty  (1704 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\03FC2195-0000004B.eml : OEStandardProperty  (1518 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\042273F9-00000294.eml : OEStandardProperty  (1568 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\04C114F4-000001F2.eml : OEStandardProperty  (1638 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\04D62F40-0000014E.eml : OEStandardProperty  (1566 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\05205F7D-000000C4.eml : OEStandardProperty  (1806 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\052D164C-00000230.eml : OEStandardProperty  (1846 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\052D69B6-000001B9.eml : OEStandardProperty  (1728 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\053D1D60-00000167.eml : OEStandardProperty  (1544 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\05556B5B-0000026A.eml : OEStandardProperty  (1946 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\059031DE-00000082.eml : OEStandardProperty  (1436 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\05932879-0000027E.eml : OEStandardProperty  (1548 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\05C86E6B-0000017B.eml : OEStandardProperty  (1494 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\0601360F-000000D9.eml : OEStandardProperty  (1618 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\060A6B62-00000064.eml : OEStandardProperty  (1582 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\064E49E9-00000056.eml : OEStandardProperty  (1604 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\066774AE-0000023C.eml : OEStandardProperty  (1518 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\0670169A-000000DA.eml : OEStandardProperty  (1372 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\067C0032-00000101.eml : OEStandardProperty  (1470 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\06BF4A40-00000270.eml : OEStandardProperty  (1548 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\06DC3CF1-00000261.eml : OEStandardProperty  (1698 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\07076132-0000011D.eml : OEStandardProperty  (1620 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\071C7E7F-00000170.eml : OEStandardProperty  (1506 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\07316315-00000276.eml : OEStandardProperty  (1690 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\07395C5C-000001B5.eml : OEStandardProperty  (2244 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\07461361-00000178.eml : OEStandardProperty  (1548 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\07853A0E-0000028F.eml : OEStandardProperty  (1670 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\07C747D5-0000009B.eml : OEStandardProperty  (1512 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\07DD4BAF-000001DC.eml : OEStandardProperty  (1524 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\07F37D0A-00000291.eml : OEStandardProperty  (2210 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\08300369-000000D4.eml : OEStandardProperty  (1856 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\084F3A96-0000012C.eml : OEStandardProperty  (1548 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\08587C81-0000002F.eml : OEStandardProperty  (1492 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\08805703-00000030.eml : OEStandardProperty  (1588 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\08CD2F97-0000007C.eml : OEStandardProperty  (3968 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\08E82F21-0000002C.eml : OEStandardProperty  (1544 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\09B50D91-000000CE.eml : OEStandardProperty  (1686 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\09F128AD-000000F0.eml : OEStandardProperty  (1560 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\0A29214C-00000108.eml : OEStandardProperty  (1460 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\0A3523E8-00000168.eml : OEStandardProperty  (1662 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\0A611B80-00000060.eml : OEStandardProperty  (13784 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\0A6B21CA-0000006A.eml : OEStandardProperty  (13044 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\0A827129-00000269.eml : OEStandardProperty  (1710 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\0A82798B-000001BC.eml : OEStandardProperty  (1656 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\0A983779-00000145.eml : OEStandardProperty  (1764 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\0ADA71BA-00000055.eml : OEStandardProperty  (1698 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\0B214F5F-000001F7.eml : OEStandardProperty  (1836 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\0B432B2B-00000140.eml : OEStandardProperty  (1590 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\0B947507-000001ED.eml : OEStandardProperty  (2032 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\0BFE337A-00000058.eml : OEStandardProperty  (1452 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\0C327C5C-000001D1.eml : OEStandardProperty  (1400 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\0CC85D32-0000005F.eml : OEStandardProperty  (1504 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\0D0119F9-0000007A.eml : OEStandardProperty  (1482 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\0D6144BE-0000017F.eml : OEStandardProperty  (1544 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\0D8750A2-0000018F.eml : OEStandardProperty  (1464 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\0D896838-000000FC.eml : OEStandardProperty  (12848 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\0D945ED8-00000085.eml : OEStandardProperty  (9392 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\0DC21803-00000160.eml : OEStandardProperty  (1662 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\0DDD0B47-00000069.eml : OEStandardProperty  (2274 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\0E082015-0000027B.eml : OEStandardProperty  (1728 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\0E116A78-00000279.eml : OEStandardProperty  (1496 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\0E3A424D-00000191.eml : OEStandardProperty  (1470 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\0E652C03-00000229.eml : OEStandardProperty  (1884 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\0E9E43AD-00000233.eml : OEStandardProperty  (1528 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\0EAC0B4D-00000247.eml : OEStandardProperty  (1630 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\0EC42202-00000040.eml : OEStandardProperty  (1690 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\0F7C2BC1-0000011A.eml : OEStandardProperty  (1538 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\0F857C19-0000023E.eml : OEStandardProperty  (1812 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\0FEC0F77-00000014.eml : OEStandardProperty  (1698 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\105E63A9-00000174.eml : OEStandardProperty  (12440 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\106E1376-000001EC.eml : OEStandardProperty  (1512 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\10E7368A-00000025.eml : OEStandardProperty  (2310 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\10E94EAB-00000285.eml : OEStandardProperty  (1642 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\10EE0FF1-0000011E.eml : OEStandardProperty  (1652 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\11164D1C-0000011B.eml : OEStandardProperty  (1586 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\114621D9-0000002D.eml : OEStandardProperty  (1422 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\11770E1C-00000131.eml : OEStandardProperty  (1424 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\11B222FF-00000203.eml : OEStandardProperty  (1832 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\11B24E1C-00000155.eml : OEStandardProperty  (1530 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\12197DCF-00000255.eml : OEStandardProperty  (1710 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\1276501B-000001AA.eml : OEStandardProperty  (10298 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\12CB36AA-00000044.eml : OEStandardProperty  (1538 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\12D416CE-00000202.eml : OEStandardProperty  (1838 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\13170F24-000000FD.eml : OEStandardProperty  (1654 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\133D4E40-00000209.eml : OEStandardProperty  (1502 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\13407D87-00000198.eml : OEStandardProperty  (1572 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\138B1D1C-00000226.eml : OEStandardProperty  (1860 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\13C231F5-000000AF.eml : OEStandardProperty  (1536 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\13F50AE8-00000193.eml : OEStandardProperty  (1646 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\13FA64B7-00000121.eml : OEStandardProperty  (1502 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\1405099F-00000010.eml : OEStandardProperty  (1494 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\142B7C03-00000095.eml : OEStandardProperty  (1738 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\145143D1-0000027D.eml : OEStandardProperty  (1490 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\148262E0-00000271.eml : OEStandardProperty  (1518 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\14E35594-00000152.eml : OEStandardProperty  (1908 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\153E6BDB-00000126.eml : OEStandardProperty  (1580 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\15B00086-00000024.eml : OEStandardProperty  (1856 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\15F5390C-00000289.eml : OEStandardProperty  (1746 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\160C2F06-000001F0.eml : OEStandardProperty  (1436 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\16181F86-0000008F.eml : OEStandardProperty  (1500 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\162529D6-00000284.eml : OEStandardProperty  (1754 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\163B6F05-00000028.eml : OEStandardProperty  (1510 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\16993336-00000090.eml : OEStandardProperty  (1520 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\16D34725-00000240.eml : OEStandardProperty  (1590 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\16DE2CAA-00000187.eml : OEStandardProperty  (1478 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\17332B6C-00000111.eml : OEStandardProperty  (2712 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\17790936-000001D4.eml : OEStandardProperty  (1788 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\17850F63-00000200.eml : OEStandardProperty  (1612 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\18013DA9-000001B4.eml : OEStandardProperty  (1412 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\18155D62-000001CA.eml : OEStandardProperty  (1594 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\18302D68-000000E0.eml : OEStandardProperty  (1608 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\18576949-00000036.eml : OEStandardProperty  (1660 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\1869116D-00000062.eml : OEStandardProperty  (11680 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\18CF4B32-00000161.eml : OEStandardProperty  (1714 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\18DD7FF3-000000E6.eml : OEStandardProperty  (1478 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\191D00C9-00000223.eml : OEStandardProperty  (1768 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\19242D81-00000211.eml : OEStandardProperty  (1726 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\19265DBB-0000021D.eml : OEStandardProperty  (1502 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\19341A73-0000022A.eml : OEStandardProperty  (1552 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\193B0DC3-00000277.eml : OEStandardProperty  (1406 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\19522C9E-0000001E.eml : OEStandardProperty  (1460 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\196356D0-00000020.eml : OEStandardProperty  (1800 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\198374EB-00000254.eml : OEStandardProperty  (1522 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\19C8376C-0000024F.eml : OEStandardProperty  (1516 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\1A2C2A10-0000028D.eml : OEStandardProperty  (1536 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\1AAA0F47-00000003.eml : OEStandardProperty  (1482 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\1B66239F-00000162.eml : OEStandardProperty  (1786 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\1B944208-000001EA.eml : OEStandardProperty  (1674 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\1BCE40C5-00000222.eml : OEStandardProperty  (1872 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\1BD41DAA-00000007.eml : OEStandardProperty  (2338 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\1BD51C41-00000001.eml : OEStandardProperty  (1858 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\1BE7441C-000001D2.eml : OEStandardProperty  (1754 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\1BF5698B-000000A4.eml : OEStandardProperty  (1658 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\1C1C218A-0000017D.eml : OEStandardProperty  (1710 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\1C593E01-0000014A.eml : OEStandardProperty  (1624 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\1CB228CA-0000006E.eml : OEStandardProperty  (2098 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\1CB750FA-00000133.eml : OEStandardProperty  (2114 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\1D8C37C8-000000F6.eml : OEStandardProperty  (12914 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\1DD535E0-0000001C.eml : OEStandardProperty  (1612 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\1E4653C0-000001AE.eml : OEStandardProperty  (1578 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\1E6967A9-00000114.eml : OEStandardProperty  (11694 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\1ECC1E53-000001FA.eml : OEStandardProperty  (1816 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\1EDD6D14-0000018D.eml : OEStandardProperty  (1570 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\1EEA5E5F-00000059.eml : OEStandardProperty  (1604 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\1EFD4C1E-00000253.eml : OEStandardProperty  (1514 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\1FC9635E-00000041.eml : OEStandardProperty  (1610 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\1FCD3082-0000025D.eml : OEStandardProperty  (1852 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\1FED19CD-0000026C.eml : OEStandardProperty  (1690 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\1FF84977-0000025B.eml : OEStandardProperty  (1548 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\202B1EB9-00000263.eml : OEStandardProperty  (1548 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\207D67C5-00000124.eml : OEStandardProperty  (2404 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\20B127F9-000001CC.eml : OEStandardProperty  (1764 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\20DC1C13-0000026B.eml : OEStandardProperty  (1754 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\20F16322-000000EE.eml : OEStandardProperty  (1494 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\21003560-0000020E.eml : OEStandardProperty  (1908 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\210C62E6-000000A8.eml : OEStandardProperty  (11568 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\210E1B2D-0000010B.eml : OEStandardProperty  (1724 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\21960571-000000DE.eml : OEStandardProperty  (11462 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\219634CE-000000FA.eml : OEStandardProperty  (1754 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\22771BF9-0000001D.eml : OEStandardProperty  (1468 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\229B6514-0000021E.eml : OEStandardProperty  (1548 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\22F6169D-0000028A.eml : OEStandardProperty  (1564 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\22FE1380-00000072.eml : OEStandardProperty  (1890 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\23182D63-00000287.eml : OEStandardProperty  (1476 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\231C4543-000001A1.eml : OEStandardProperty  (1806 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\23D67176-000001FB.eml : OEStandardProperty  (2012 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\243C4190-000000B2.eml : OEStandardProperty  (1742 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\243F6A3B-00000057.eml : OEStandardProperty  (1456 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\24B065C1-000000E9.eml : OEStandardProperty  (1548 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\24D23AA6-00000011.eml : OEStandardProperty  (1524 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\24F9042E-00000237.eml : OEStandardProperty  (1730 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\25015069-00000026.eml : OEStandardProperty  (1534 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\250809F6-00000094.eml : OEStandardProperty  (1580 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\25593F8D-00000099.eml : OEStandardProperty  (1550 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\2698764C-00000242.eml : OEStandardProperty  (1422 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\26C924B6-000001CF.eml : OEStandardProperty  (1548 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\270B04BF-00000068.eml : OEStandardProperty  (2210 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\276D0D04-0000027A.eml : OEStandardProperty  (4192 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\27713243-000001C1.eml : OEStandardProperty  (1680 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\278B682C-0000010C.eml : OEStandardProperty  (1554 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\278E04F7-00000273.eml : OEStandardProperty  (1470 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\27F15B53-000001CB.eml : OEStandardProperty  (1418 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\28284B06-0000022D.eml : OEStandardProperty  (1620 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\28557DA2-00000141.eml : OEStandardProperty  (11270 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\28666E3C-000000BE.eml : OEStandardProperty  (1656 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\28772891-000000BB.eml : OEStandardProperty  (1500 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\294E10D4-0000020B.eml : OEStandardProperty  (1628 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\299F70C2-000000C8.eml : OEStandardProperty  (1658 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\29BA0183-00000144.eml : OEStandardProperty  (1626 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\29D51288-00000138.eml : OEStandardProperty  (1448 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\2A1414FA-0000026D.eml : OEStandardProperty  (1696 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\2A965ED3-000000C9.eml : OEStandardProperty  (1540 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\2AA916AA-00000077.eml : OEStandardProperty  (1598 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\2B2D0840-00000257.eml : OEStandardProperty  (1868 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\2B3F76C3-00000176.eml : OEStandardProperty  (1406 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\2B702CBA-0000022B.eml : OEStandardProperty  (1596 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\2BB92DF5-00000005.eml : OEStandardProperty  (1818 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\2BBA241E-00000100.eml : OEStandardProperty  (12910 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\2BBE7366-00000180.eml : OEStandardProperty  (1854 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\2BD36A8F-00000105.eml : OEStandardProperty  (1614 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\2C073118-0000008A.eml : OEStandardProperty  (1506 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\2C232131-00000146.eml : OEStandardProperty  (1598 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\2C37350F-00000081.eml : OEStandardProperty  (11668 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\2C674127-000001B8.eml : OEStandardProperty  (1860 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\2C7946A5-0000000E.eml : OEStandardProperty  (1512 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\2C852DC4-000001FD.eml : OEStandardProperty  (1518 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\2CFA17C3-000001A8.eml : OEStandardProperty  (1536 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\2D0D0FC4-00000142.eml : OEStandardProperty  (1518 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\2D564299-0000000A.eml : OEStandardProperty  (1830 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\2DB57177-000001F4.eml : OEStandardProperty  (1548 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\2DCC1FBB-000000B5.eml : OEStandardProperty  (1596 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\2E584537-000001A9.eml : OEStandardProperty  (1734 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\2E823448-0000019E.eml : OEStandardProperty  (1472 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\2EA20493-000000CA.eml : OEStandardProperty  (1502 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\2F2D0EAA-00000034.eml : OEStandardProperty  (1692 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\2FE82839-0000014D.eml : OEStandardProperty  (1836 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\30874464-0000008C.eml : OEStandardProperty  (1544 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\30A5788F-00000267.eml : OEStandardProperty  (2088 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\30C74AD1-0000000C.eml : OEStandardProperty  (2666 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\310512C8-000000B0.eml : OEStandardProperty  (1780 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\316D6C7C-00000288.eml : OEStandardProperty  (1664 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\31773309-000001F3.eml : OEStandardProperty  (1620 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\319909C8-000001FF.eml : OEStandardProperty  (1690 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\322D4E08-0000005B.eml : OEStandardProperty  (1428 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\32371FEB-00000107.eml : OEStandardProperty  (1580 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\325A7B5C-00000231.eml : OEStandardProperty  (1548 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\325B4CA2-000000A5.eml : OEStandardProperty  (1534 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\327239A1-00000262.eml : OEStandardProperty  (1690 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\32FA2DC1-000000AC.eml : OEStandardProperty  (11452 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\32FF3D66-000000E7.eml : OEStandardProperty  (1450 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\33176524-00000006.eml : OEStandardProperty  (1642 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\33216C3D-000000C0.eml : OEStandardProperty  (13556 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\334C3054-0000010D.eml : OEStandardProperty  (1560 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\334E5140-00000130.eml : OEStandardProperty  (1518 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\335B2829-0000002B.eml : OEStandardProperty  (1616 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\338653EA-00000235.eml : OEStandardProperty  (1680 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\33D0397E-0000012F.eml : OEStandardProperty  (11652 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\pop.net2000.ch\Inbox\34103052-00000047.eml : OEStandardProperty  (1440 bytes)

codu · Answer

Voilà encore la fin (Il manque environ 1000 lignes entre les deux mais elles sont toutes semblables !!):

C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\Storage Folders\Sent Items\7C0F640B-00000051.eml : OEStandardProperty  (1534 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\Storage Folders\Sent Items\7C367C22-000000D4.eml : OEStandardProperty  (1352 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\Storage Folders\Sent Items\7C8D5E27-0000014A.eml : OEStandardProperty  (1468 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\Storage Folders\Sent Items\7CF41F06-00000172.eml : OEStandardProperty  (1628 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\Storage Folders\Sent Items\7CF5555F-000000E8.eml : OEStandardProperty  (1494 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\Storage Folders\Sent Items\7D2C0EFA-00000155.eml : OEStandardProperty  (1600 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\Storage Folders\Sent Items\7DE6175F-000001CF.eml : OEStandardProperty  (1752 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\Storage Folders\Sent Items\7E2D3F13-000000A7.eml : OEStandardProperty  (1372 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\Storage Folders\Sent Items\7E365E60-0000013B.eml : OEStandardProperty  (2564 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\Storage Folders\Sent Items\7E453C4B-000000B8.eml : OEStandardProperty  (1336 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\Storage Folders\Sent Items\7E6521AB-000001B2.eml : OEStandardProperty  (1650 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\Storage Folders\Sent Items\7EBC0EBF-000000D6.eml : OEStandardProperty  (1292 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\Storage Folders\Sent Items\7ECE78DF-00000169.eml : OEStandardProperty  (1384 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\Storage Folders\Sent Items\7F041CF5-00000007.eml : OEStandardProperty  (1630 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\Storage Folders\Sent Items\7F312097-000000E4.eml : OEStandardProperty  (1388 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\Storage Folders\Sent Items\7F610384-0000002B.eml : OEStandardProperty  (1508 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\Storage Folders\Sent Items\7F742579-0000015E.eml : OEStandardProperty  (1410 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\Storage Folders\Sent Items\7FC56DDD-0000019D.eml : OEStandardProperty  (1586 bytes)
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Mail\Storage Folders\Sent Items\7FC63B9C-00000020.eml : OEStandardProperty  (1568 bytes)
C:\Documents and Settings\Orane\Favoris\Liens\Zouzous.url : favicon  (2238 bytes)
C:\Documents and Settings\Yanis\Favoris\Liens\Cartoon Network.url : favicon  (3638 bytes)
C:\Documents and Settings\Yanis\Favoris\Liens\Jeux sur Zylom.url : favicon  (17542 bytes)
C:\Documents and Settings\Yanis\Favoris\Liens\Jeux.com - Rise of atlantis.url : favicon  (1406 bytes)
C:\Documents and Settings\Yanis\Favoris\Liens\Jeux.com.url : favicon  (1406 bytes)
C:\Documents and Settings\Yanis\Favoris\Liens\Jeux.fr!.url : favicon  (3638 bytes)
C:\Documents and Settings\Yanis\Favoris\Liens\Les meilleurs jeux sur Jeu.FR.url : favicon  (3638 bytes)
C:\Documents and Settings\Yanis\Favoris\Liens\Prizee.url : favicon  (2238 bytes)
C:\Program Files\Bug Doctor\Get Bonuses.url : favicon  (1078 bytes)
C:\RECYCLER\S-1-5-21-3113122520-2486959141-1304036979-1006\Dc1.url : favicon  (766 bytes)
C:\RECYCLER\S-1-5-21-3113122520-2486959141-1304036979-1006\Dc2.url : favicon  (766 bytes)

codu · Answer

le fichier fais 2542 lignes !!!!

codu · Answer

Désolé, miais là je vais devoir m'absenter jusqu'en début de soirée,

alors merci de plancher sur mes soucis d'ici-là et à toute à l'heure j'espère.

codu · Answer

Me revoilou !

codu · Answer

green day, tu es par là?

green day · Answer

oui, oui, seulement j'ai plusieurs postes en cours ! :)

Télécharge SDFix sur ton bureau 

http://downloads.andymanchesta.com/RemovalTools/SDFix.exe 

Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. 
Redémarre ton ordinateur en mode sans échec 
Ouvre le dossier SDFix qui vient d'être créé sur le Bureau et double clique sur RunThis.cmd pour lancer le script. 
Appuie sur Y pour commencer le processus de nettoyage. 
Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer. 
Appuie sur une touche pour redémarrer le PC. 
Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers. 
Après le chargement du Bureau, l'outil terminera son travail et affichera Finished. 
Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau. 
Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt. 
Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum

++

codu · Answer

voici:

SDFix: Version 1.136

Run by Christophe on 02.03.2008 at 20:08

Microsoft Windows XP [version 5.1.2600]

Running From: C:\DOCUME~1\CHRIST~1\Bureau\SDFix

Safe Mode:
Checking Services: 


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


Normal Mode:
Checking Files: 

No Trojan Files Found






Removing Temp Files...

ADS Check:
 


                                 Final Check:

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-02 20:16:26
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:0000004c
"TracesSuccessful"=dword:00000010

scanning hidden files ...


scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 2


Remaining Services:
------------------



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\NetMeeting\conf.exe"="C:\Program Files\NetMeeting\conf.exe:*:Enabled:Windows® NetMeeting®"
"C:\Program Files\SecondLife\SecondLife.exe"="C:\Program Files\SecondLife\SecondLife.exe:*:Enabled:Second Life"
"C:\Program Files\BitTorrent\bittorrent.exe"="C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent"
"C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Program Files\Zattoo\zattood.exe"="C:\Program Files\Zattoo\zattood.exe:*:Enabled:zattood"
"C:\Program Files\Zattoo\Zattoo1.exe"="C:\Program Files\Zattoo\Zattoo1.exe:*:Enabled: "
"C:\Program Files\Internet Explorer\iexplore.exe"="C:\Program Files\Internet Explorer\iexplore.exe:*:Enabled:Internet Explorer"
"C:\WINDOWS\pchealth\helpctr\binaries\HelpCtr.exe"="C:\WINDOWS\pchealth\helpctr\binaries\HelpCtr.exe:*:Enabled:Assistance à distance - Windows Messenger et voix"
"C:\Program Files\SecondLife\SLVoice.exe"="C:\Program Files\SecondLife\SLVoice.exe:*:Enabled:SLVoice"
"C:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe"="C:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe:*:Enabled:Kaspersky AV Scanner"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

Remaining Files:
---------------


Files with Hidden Attributes:

Mon 27 Mar 2006           104 ..SHR --- "C:\WINDOWS\system32\D814B28974.sys"
Sat  3 Feb 2007         4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Tue  5 Feb 2008             0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Sun  2 Mar 2008         5,946 A.SH. --- "C:\Documents and Settings\All Users\Documents\TV enregistr‚e\TempRec\TempSBE\SBE1.tmp"

Finished!

green day · Answer

ok, où en sont tes soucis ??

++

codu · Answer

je vais voir

codu · Answer

Pour l'instant ça à l'air d'aller pas trop mal, je vais encore tester la chose ce soir et je te redonne des nouvelles
ok?
Merci déjà pour tout, tu es géniale !!

green day · Answer

ok, encore un petit nettoyage ! :)

 fais ce qui est indiqué ici stp :

http://www.commentcamarche.net/faq/sujet 3174 virus methode preliminaire de desinfection version fr

@+

codu · Answer

pas de bol, ça continue !!!

codu · Answer

voilà quand même les rapports:

---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

 + Créé à:	22:19:17 02.03.2008

 + Résultat de l'analyse:	



C:\Documents and Settings\Bouchra\Cookies\bouchra@2o7[2].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\Yanis\Cookies\yanis@himedia.112.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\Yanis\Cookies\yanis@tbslatinamerica.112.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\Yanis\Cookies\yanis@turnerapac.112.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\Bouchra\Cookies\bouchra@atdmt[2].txt -> TrackingCookie.Atdmt : Nettoyé.
C:\Documents and Settings\Christophe\Cookies\christophe@atdmt[2].txt -> TrackingCookie.Atdmt : Nettoyé.
C:\Documents and Settings\Yanis\Cookies\yanis@atdmt[2].txt -> TrackingCookie.Atdmt : Nettoyé.
C:\Documents and Settings\Yanis\Cookies\yanis@promo.casinotropez[1].txt -> TrackingCookie.Casinotropez : Nettoyé.
C:\Documents and Settings\Yanis\Cookies\yanis@cz4.clickzs[2].txt -> TrackingCookie.Clickzs : Nettoyé.
C:\Documents and Settings\Yanis\Cookies\yanis@fl01.ct2.comclick[2].txt -> TrackingCookie.Comclick : Nettoyé.
C:\Documents and Settings\Bouchra\Cookies\bouchra@estat[1].txt -> TrackingCookie.Estat : Nettoyé.
C:\Documents and Settings\Orane\Cookies\orane@estat[1].txt -> TrackingCookie.Estat : Nettoyé.
C:\Documents and Settings\Orane\Cookies\orane@as1.falkag[1].txt -> TrackingCookie.Falkag : Nettoyé.
C:\Documents and Settings\Yanis\Cookies\yanis@image.masterstats[1].txt -> TrackingCookie.Masterstats : Nettoyé.
C:\Documents and Settings\Bouchra\Cookies\bouchra@mediaplex[2].txt -> TrackingCookie.Mediaplex : Nettoyé.
C:\Documents and Settings\Bouchra\Cookies\bouchra@statcounter[1].txt -> TrackingCookie.Statcounter : Nettoyé.
C:\Documents and Settings\Yanis\Cookies\yanis@statcounter[1].txt -> TrackingCookie.Statcounter : Nettoyé.
C:\Documents and Settings\Bouchra\Cookies\bouchra@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Nettoyé.
C:\Documents and Settings\Yanis\Cookies\yanis@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : Nettoyé.
C:\Documents and Settings\Bouchra\Cookies\bouchra@weborama[1].txt -> TrackingCookie.Weborama : Nettoyé.
C:\Documents and Settings\Orane\Cookies\orane@m.webtrends[2].txt -> TrackingCookie.Webtrends : Nettoyé.


Fin du rapport


BitDefender Online Scanner - Real Time Virus Report
  
  
 
Generated at: Mon, Mar 03, 2008 - 00:26:02
 

--------------------------------------------------------------------------------

 
  
  
 
Scan Info
  
  
 
Scanned Files
 635671
 
Infected Files
 0
 
  
  
 
 
  
  
 
Virus Detected
  
  
 
No virus found.
 
 
  
  
 
 
  
  
 
 

--------------------------------------------------------------------------------
  
  
 
This summary of the scan process will be used by the BitDefender Antivirus Lab to create agregate statistics about virus activity around the world. 
  
  
et voilà:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:34:51, on 03.03.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32
otepad.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\CTHELPER.EXE
C:\WINDOWS\system32\CTXFIHLP.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe
C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe
C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Canon\MultiPASS4\monitr32.exe
C:\Program Files\Canon\MultiPASS4\MPTBox.exe
C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Fichiers communs\Teleca Shared\CapabilityManager.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Windows Live\Contrôle parental\fssui.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Microsoft Office\Office12\EXCEL.EXE
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.video2000.ch/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: IE7Pro - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files\IEPro\iepro.dll
O2 - BHO: Windows Live OneCare Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Contrôle parental\fssbho.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: TV5 - Dictionnaires - {CEDDA62D-5FBE-4AB2-AE2E-5E069F444444} - C:\Program Files\Dico TV5\MDTV5TB.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [CTDVDDET] "C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE"
O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" /r
O4 - HKLM\..\Run: [AudioDrvEmulator] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll"
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\ISUSPM.exe" -startup
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe 
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [monitr32] C:\Program Files\Canon\MultiPASS4\monitr32.exe
O4 - HKLM\..\Run: [MPTBox] C:\Program Files\Canon\MultiPASS4\MPTBox.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [AdobeVersionCue] C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [fssui] "C:\Program Files\Windows Live\Contrôle parental\fssui.exe" -autorun
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Assistant d'Acrobat.lnk = C:\Program Files\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://s.tf1.fr/mmdia/static/rawflow/clients/5.3.1.0/Rawflow.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://62.202.10.41/activex/AxisCamControl.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {DFB5BCF1-06AE-4ABB-BFA8-1E228F41C50A} - https://www.bobtv.fr/download/cfweb_www.bobtv.fr-download_instmodule.exe
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AdobeVersionCue - Adobe Sytems - C:\Program Files\Adobe\Adobe Version Cue\service\VersionCue.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Intel® Quick Resume Technology Drivers (ELService) - Intel Corporation - C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology\ELService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MpService - Canon Inc - C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

green day · Answer

Salut

décris moi ce qu'il te reste

++

codu · Answer

je suis redirigé sur une page dont l'adresse est: https://rencontre.sexy.voissa.com/f/public?fs=1&target=_parent&order=H&max=4&s[]=0&label=0&prvtof=8b2VkUqfXDCVzkFCuxt4PZln5PiNrPc9pOl1olEJYM5LjSKQ%2Fk0n3T3P8q%2FmFrop qui représente un site à priori commercial (même pas de cul) mais dont je n'ai absolument rien à faire !

green day · Answer

ok,

# Télécharger Hoster : http://www.funkytoad.com/download/HostsXpert.zip
# Dézipper le dossier sur le bureau.
# Lancer Hoster et cliquer sur Restore Microsoft's Hosts File 

et précise l'évolution de la situation 

++

codu · Answer

Voilà qui est fait, je te tiens au courant de l'évolution de la situation.

codu · Answer

Problème toujours pas résolu!

green day · Answer

Salut

c'est curieux là ...

télécharge CureIt : https://free.drweb.fr/?lng=fr 

Redémarre en mode sans échec. Pour cela, tapote sur F5 ou F8 au démarrage. 

* cliques sur l'icône cureit.exe du bureau et tu mets en quarantaine tout ce qui est éventuellement détecté. 
-Le scan fini, clique sur le bouton "Tout sélectionner" en bas et ensuite sur le bouton "Quarantaine" 
Seront analysés les objets suivants où se logent le plus souvent les virus: 
Mémoire vive 
Secteurs de démarrage de tous les disques 
Objets d'auto démarrage 
Répertoire racine du disque boot 
Répertoire racine du disque d'installation Windows 
Répertoire système Windows 
Dossier 'Mes documents' 
Répertoire système temporaire 
Répertoire d'utilisateur temporaire 
-Puis tu coches devant "Analyse complète" dans l'onglet "Analyse" et tu cliques sur la flèche verte sous le logo Dr.Web. 
-Le scan fini, clique sur le bouton "Tout sélectionner" en bas et ensuite sur le bouton "Quarantaine" 
-Clique sur Fichier et Enregistrer le rapport, choisis le bureau et sous DrWeb.txt à la place de .csv 
-Il n'est pas nécessaire de commander comme cela te sera proposé à la fin du scan. 
- referme et poste le rapport stp 

++

codu · Answer

Me revoilà ! Désolé je n'étais pas beaucoup là ces derniers jours.

Voilà le rapport du scan de DrWeb:

regLocal.reg	C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Backups	Probablement SCRIPT.Virus	Quarantaine.
RegUBP2b-Christophe.reg	C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Snapshots2	Trojan.StartPage.1505	Supprimé.
Process.exe	C:\Documents and Settings\Christophe\Bureau\SDFix\apps	Tool.Prockill	Quarantaine.
Process.exe	C:\Documents and Settings\Christophe\Bureau\SmitfraudFix	Tool.Prockill	Quarantaine.
restart.exe	C:\Documents and Settings\Christophe\Bureau\SmitfraudFix	Tool.ShutDown.11	Quarantaine.
Process.exe	C:\Program Files\Navilog1	Tool.Prockill	Quarantaine.
A0104567.exe	C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP415	Tool.Prockill	Quarantaine.
A0110346.exe	C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP433	Modification de BackDoor.Generic.954	Quarantaine.
A0111315.bat	C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP440	Probablement BATCH.Virus	Quarantaine.
A0111320.bat	C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP440	Probablement SCRIPT.Virus	Quarantaine.
A0111494.bat	C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP440	Probablement BATCH.Virus	Quarantaine.
A0111499.bat	C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP440	Probablement SCRIPT.Virus	Quarantaine.
A0111528.bat	C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP440	Probablement BATCH.Virus	Quarantaine.
A0111533.bat	C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP440	Probablement SCRIPT.Virus	Quarantaine.
A0111570.bat	C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP441	Probablement BATCH.Virus	Quarantaine.
A0111575.bat	C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP441	Probablement SCRIPT.Virus	Quarantaine.
A0112944.reg	C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP444	Trojan.StartPage.1505	Supprimé.
Process.exe	C:\WINDOWS\system32	Tool.Prockill	Quarantaine.

PS: Désolé pour la mise en forme, mais j'ai pas réuissi à faire mieux!

codu · Answer

Je viens de retester la chose, problème TOUJOURS PAS RESOLU !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

Grrr, ça commence à me courir sur le haricot

codu · Answer

Voilà déjà le rapport de Fixwareout. Je n'ai pas utilisé LSPfix, je ne sais pas si c'est normal (ou peut-être est-il utilisé automatiquement par Fixwareout?)

Username "Christophe" - 08.03.2008 22:32:27 [Fixwareout edited 9/01/2007]

~~~~~ Prerun check

Cache de résolution DNS vidé.


System was rebooted successfully. 
 
~~~~~ Postrun check 
HKLM\SOFTWARE\~\Winlogon\ "System"="" 
....
....
~~~~~ Misc files. 
....
~~~~~ Checking for older varients.
....

~~~~~ Current runs (hklm hkcu "run" Keys Only)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe"
"NvCplDaemon"="RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup"
"CTHelper"="CTHELPER.EXE"
"CTxfiHlp"="CTXFIHLP.EXE"
"SunJavaUpdateSched"="\"C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe\""
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe"
"DMXLauncher"="C:\Program Files\Dell\Media Experience\DMXLauncher.exe"
"CTDVDDET"="\"C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE\""
"VolPanel"="\"C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe\" /r"
"AudioDrvEmulator"="\"C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe\" -1 AudioDrvEmulator \"C:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll\""
"UpdReg"="C:\WINDOWS\UpdReg.EXE"
"ISUSPM Startup"="\"C:\Program Files\Fichiers communs\InstallShield\UpdateService\ISUSPM.exe\" -startup"
"DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE"
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE"
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe "
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe"
"monitr32"="C:\Program Files\Canon\MultiPASS4\monitr32.exe"
"MPTBox"="C:\Program Files\Canon\MultiPASS4\MPTBox.exe"
"MSKDetectorExe"="C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall"
"AdobeVersionCue"="C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe"
"Sony Ericsson PC Suite"="\"C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe\" /startoptions"
"TkBellExe"="\"C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe\"  -osboot"
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe"
"NeroFilterCheck"="C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe"
"QuickTime Task"="\"C:\Program Files\QuickTime\qttask.exe\" -atboottime"
"iTunesHelper"="\"C:\Program Files\iTunes\iTunesHelper.exe\""
"WinampAgent"="C:\Program Files\Winamp\winampa.exe"
"Adobe Reader Speed Launcher"="\"C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe\""
"Windows Defender"="\"C:\Program Files\Windows Defender\MSASCui.exe\" -hide"
"ZoneAlarm Client"="\"C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe\""
"!AVG Anti-Spyware"="\"C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe\" /minimized"
"fssui"="\"C:\Program Files\Windows Live\Contrôle parental\fssui.exe\" -autorun"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe"
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe"
"MSMSGS"="\"C:\Program Files\Messenger\msmsgs.exe\" /background"
"LogitechSoftwareUpdate"="\"C:\Program Files\Logitech\Video\ManifestEngine.exe\" boot"
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="\"C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe\""
"Yahoo! Pager"="\"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe\" -quiet"
....
Hosts file was reset, If you use a custom hosts file please replace it...
~~~~~ End report ~~~~~

Je reviens avec le rapport Kaspersky

codu · Answer

Au vu du temps que ça met, le rapport Kaspersky sera certainement pour demain !!!

codo · Answer

lol
le voilà enfin:

-------------------------------------------------------------------------------
 KASPERSKY ON-LINE SCANNER REPORT
 Sunday, March 09, 2008 1:42:48 AM
 Système d'exploitation : Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
 Kaspersky On-line Scanner version : 5.0.83.0
 Dernière mise à jour de la base antivirus Kaspersky :  8/03/2008
 Enregistrements dans la base antivirus Kaspersky : 615488
-------------------------------------------------------------------------------

Paramètres d'analyse:
	Analyser avec la base antivirus suivante: étendue
	Analyser les archives: vrai
	Analyser les bases de messagerie: vrai

Cible de l'analyse - Poste de travail:
	C:\
	D:\
	E:\
	F:\
	G:\
	H:\
	I:\
	J:\
	K:\

Statistiques de l'analyse:
	Total d'objets analysés: 188471
	Nombre de virus trouvés: 1
	Nombre d'objets infectés: 10 / 0
	Nombre d'objets suspects: 0
	Durée de l'analyse: 02:21:46

Nom de l'objet infecté / Nom du virus / Dernière action
C:\Documents and Settings\All Users\Application Data\Microsoft\eHome\logs\ehRecvr.log	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Support\MPLog-10212007-210832.log	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Documents\TV enregistrée\TempRec\TempSBE\MSDVRMM_1220778224_44040192_102142	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Documents\TV enregistrée\TempRec\TempSBE\SBE1.tmp	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Documents\TV enregistrée\TempRec\{2213C12E-D4FC-4B5B-94C0-8851BEC82F28}.TmpSBE	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\DRM\drmstore.hds	L'objet est verrouillé	ignoré
C:\Documents and Settings\Christophe\Bureau\Navilog1.exe/file09	Infecté : not-a-virus:RiskTool.Win32.Reboot.f	ignoré
C:\Documents and Settings\Christophe\Bureau\Navilog1.exe	Inno: infecté - 1	ignoré
C:\Documents and Settings\Christophe\Bureau\SmitfraudFix\Reboot.exe	Infecté : not-a-virus:RiskTool.Win32.Reboot.f	ignoré
C:\Documents and Settings\Christophe\Bureau\SmitfraudFix.exe/data.rar/SmitfraudFix/Reboot.exe	Infecté : not-a-virus:RiskTool.Win32.Reboot.f	ignoré
C:\Documents and Settings\Christophe\Bureau\SmitfraudFix.exe/data.rar	Infecté : not-a-virus:RiskTool.Win32.Reboot.f	ignoré
C:\Documents and Settings\Christophe\Bureau\SmitfraudFix.exe	RarSFX: infecté - 2	ignoré
C:\Documents and Settings\Christophe\Cookies\index.dat	L'objet est verrouillé	ignoré
C:\Documents and Settings\Christophe\Local Settings\Application Data\Ahead\Nero Home\bl.db	L'objet est verrouillé	ignoré
C:\Documents and Settings\Christophe\Local Settings\Application Data\Ahead\Nero Home\bl.db-journal	L'objet est verrouillé	ignoré
C:\Documents and Settings\Christophe\Local Settings\Application Data\Ahead\Nero Home\is2.db	L'objet est verrouillé	ignoré
C:\Documents and Settings\Christophe\Local Settings\Application Data\Ahead\Nero Home\is2.db-journal	L'objet est verrouillé	ignoré
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat	L'objet est verrouillé	ignoré
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Messenger\bidulet13@hotmail.com\SharingMetadata\Logs\Dfsr00005.log	L'objet est verrouillé	ignoré
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Messenger\bidulet13@hotmail.com\SharingMetadata\pending.dat	L'objet est verrouillé	ignoré
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Messenger\bidulet13@hotmail.com\SharingMetadata\Working\database_7848_C3DE_48C3_98F0\dfsr.db	L'objet est verrouillé	ignoré
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Messenger\bidulet13@hotmail.com\SharingMetadata\Working\database_7848_C3DE_48C3_98F0\fsr.log	L'objet est verrouillé	ignoré
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Messenger\bidulet13@hotmail.com\SharingMetadata\Working\database_7848_C3DE_48C3_98F0\fsrtmp.log	L'objet est verrouillé	ignoré
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Messenger\bidulet13@hotmail.com\SharingMetadata\Working\database_7848_C3DE_48C3_98F0	mp.edb	L'objet est verrouillé	ignoré
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Messenger	ournicoti69@hotmail.com\SharingMetadata\Logs\Dfsr00005.log	L'objet est verrouillé	ignoré
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Messenger	ournicoti69@hotmail.com\SharingMetadata\pending.dat	L'objet est verrouillé	ignoré
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Messenger	ournicoti69@hotmail.com\SharingMetadata\Working\database_7848_C3DE_48C3_98F0\dfsr.db	L'objet est verrouillé	ignoré
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Messenger	ournicoti69@hotmail.com\SharingMetadata\Working\database_7848_C3DE_48C3_98F0\fsr.log	L'objet est verrouillé	ignoré
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Messenger	ournicoti69@hotmail.com\SharingMetadata\Working\database_7848_C3DE_48C3_98F0\fsrtmp.log	L'objet est verrouillé	ignoré
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Messenger	ournicoti69@hotmail.com\SharingMetadata\Working\database_7848_C3DE_48C3_98F0	mp.edb	L'objet est verrouillé	ignoré
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat	L'objet est verrouillé	ignoré
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG	L'objet est verrouillé	ignoré
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{84FA888E-A08C-459B-BAB7-EB1EBB8BE837}	L'objet est verrouillé	ignoré
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Contacts\bidulet13@hotmail.comeal\members.stg	L'objet est verrouillé	ignoré
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Contacts\bidulet13@hotmail.com\shadow\members.stg	L'objet est verrouillé	ignoré
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Contacts	ournicoti69@hotmail.comeal\members.stg	L'objet est verrouillé	ignoré
C:\Documents and Settings\Christophe\Local Settings\Application Data\Microsoft\Windows Live Contacts	ournicoti69@hotmail.com\shadow\members.stg	L'objet est verrouillé	ignoré
C:\Documents and Settings\Christophe\Local Settings\Historique\History.IE5\index.dat	L'objet est verrouillé	ignoré
C:\Documents and Settings\Christophe\Local Settings\Historique\History.IE5\MSHist012008030820080309\index.dat	L'objet est verrouillé	ignoré
C:\Documents and Settings\Christophe\Local Settings\Temp\~DF239A.tmp	L'objet est verrouillé	ignoré
C:\Documents and Settings\Christophe\Local Settings\Temp\~DF26B6.tmp	L'objet est verrouillé	ignoré
C:\Documents and Settings\Christophe\Local Settings\Temp\~DF5ADD.tmp	L'objet est verrouillé	ignoré
C:\Documents and Settings\Christophe\Local Settings\Temp\~DF5CDF.tmp	L'objet est verrouillé	ignoré
C:\Documents and Settings\Christophe\Local Settings\Temp\~DF7F08.tmp	L'objet est verrouillé	ignoré
C:\Documents and Settings\Christophe\Local Settings\Temp\~DF80AE.tmp	L'objet est verrouillé	ignoré
C:\Documents and Settings\Christophe\Local Settings\Temp\~DFE2EB.tmp	L'objet est verrouillé	ignoré
C:\Documents and Settings\Christophe\Local Settings\Temp\~DFE671.tmp	L'objet est verrouillé	ignoré
C:\Documents and Settings\Christophe\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat	L'objet est verrouillé	ignoré
C:\Documents and Settings\Christophe\Local Settings\Temporary Internet Files\Content.IE5\index.dat	L'objet est verrouillé	ignoré
C:\Documents and Settings\Christophe\NTUSER.DAT	L'objet est verrouillé	ignoré
C:\Documents and Settings\Christophe
tuser.dat.LOG	L'objet est verrouillé	ignoré
C:\Documents and Settings\LocalService\Cookies\index.dat	L'objet est verrouillé	ignoré
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat	L'objet est verrouillé	ignoré
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG	L'objet est verrouillé	ignoré
C:\Documents and Settings\LocalService\Local Settings\Historique\History.IE5\index.dat	L'objet est verrouillé	ignoré
C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat	L'objet est verrouillé	ignoré
C:\Documents and Settings\LocalService\Local Settings\Temp\Fichiers Internet temporaires\Content.IE5\index.dat	L'objet est verrouillé	ignoré
C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat	L'objet est verrouillé	ignoré
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat	L'objet est verrouillé	ignoré
C:\Documents and Settings\LocalService\NTUSER.DAT	L'objet est verrouillé	ignoré
C:\Documents and Settings\LocalService
tuser.dat.LOG	L'objet est verrouillé	ignoré
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat	L'objet est verrouillé	ignoré
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG	L'objet est verrouillé	ignoré
C:\Documents and Settings\NetworkService\NTUSER.DAT	L'objet est verrouillé	ignoré
C:\Documents and Settings\NetworkService
tuser.dat.LOG	L'objet est verrouillé	ignoré
C:\Program Files\Alwil Software\Avast4\DATA\aswResp.dat	L'objet est verrouillé	ignoré
C:\Program Files\Alwil Software\Avast4\DATA\Avast4.db	L'objet est verrouillé	ignoré
C:\Program Files\Alwil Software\Avast4\DATA\log\AshWebSv.ws	L'objet est verrouillé	ignoré
C:\Program Files\Alwil Software\Avast4\DATA\log\aswMaiSv.log	L'objet est verrouillé	ignoré
C:\Program Files\Alwil Software\Avast4\DATA\log
shield.log	L'objet est verrouillé	ignoré
C:\Program Files\Alwil Software\Avast4\DATAeport\Protection résidente.txt	L'objet est verrouillé	ignoré
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Christophe\Data\chandir.dat	L'objet est verrouillé	ignoré
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Christophe\Data\chandir.idx	L'objet est verrouillé	ignoré
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Christophe\Data\chn.dat	L'objet est verrouillé	ignoré
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Christophe\Data\chn.idx	L'objet est verrouillé	ignoré
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Christophe\Data\D0000000.FCS	L'objet est verrouillé	ignoré
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Christophe\Data\inuse.txt	L'objet est verrouillé	ignoré
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Christophe\Data\L0000007.FCS	L'objet est verrouillé	ignoré
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Christophe\Data\main.log	L'objet est verrouillé	ignoré
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Christophe\Data\prs.dat	L'objet est verrouillé	ignoré
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Christophe\Data\prs.idx	L'objet est verrouillé	ignoré
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Christophe\Data\prs_die.dat	L'objet est verrouillé	ignoré
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Christophe\Data\prs_die.idx	L'objet est verrouillé	ignoré
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Christophe\Data\prs_dnd.dat	L'objet est verrouillé	ignoré
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Christophe\Data\prs_dnd.idx	L'objet est verrouillé	ignoré
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Christophe\Data\prs_ext.dat	L'objet est verrouillé	ignoré
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Christophe\Data\prs_ext.idx	L'objet est verrouillé	ignoré
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Christophe\Data\prs_rcv.dat	L'objet est verrouillé	ignoré
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Christophe\Data\prs_rcv.idx	L'objet est verrouillé	ignoré
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Christophe\Data\storydb.dat	L'objet est verrouillé	ignoré
C:\Program Files\Logitech\Desktop Messenger\8876480\Users\Christophe\Data\storydb.idx	L'objet est verrouillé	ignoré
C:\Program Files\Navilog1eboot.exe	Infecté : not-a-virus:RiskTool.Win32.Reboot.f	ignoré
C:\System Volume Information\MountPointManagerRemoteDatabase	L'objet est verrouillé	ignoré
C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP417\A0106209.exe/file09	Infecté : not-a-virus:RiskTool.Win32.Reboot.f	ignoré
C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP417\A0106209.exe	Inno: infecté - 1	ignoré
C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP417\A0106217.exe	Infecté : not-a-virus:RiskTool.Win32.Reboot.f	ignoré
C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP444\change.log	L'objet est verrouillé	ignoré
C:\WINDOWS\Debug\PASSWD.LOG	L'objet est verrouillé	ignoré
C:\WINDOWS\Internet Logs\D654452J.ldb	L'objet est verrouillé	ignoré
C:\WINDOWS\Internet Logs\fwpktlog.txt	L'objet est verrouillé	ignoré
C:\WINDOWS\Internet Logs\IAMDB.RDB	L'objet est verrouillé	ignoré
C:\WINDOWS\Internet Logs	vDebug.log	L'objet est verrouillé	ignoré
C:\WINDOWS\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{17B91ADA-FD9A-4A4C-BED9-C14FE64CF407}.crmlog	L'objet est verrouillé	ignoré
C:\WINDOWS\SchedLgU.Txt	L'objet est verrouillé	ignoré
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log	L'objet est verrouillé	ignoré
C:\WINDOWS\Sti_Trace.log	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\CatRoot2\edb.log	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\CatRoot2	mp.edb	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\config\Antivirus.Evt	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\config\AppEvent.Evt	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\config\DEFAULT	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\config\default.LOG	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\config\IntelDH.evt	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\config\Internet.evt	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\config\Media Ce.evt	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\config\ODiag.evt	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\config\OSession.evt	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\config\SAM	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\config\SAM.LOG	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\config\SecEvent.Evt	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\config\SECURITY	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\config\SECURITY.LOG	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\config\SOFTWARE	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\config\software.LOG	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\config\SysEvent.Evt	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\config\SYSTEM	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\config\system.LOG	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\h323log.txt	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP	L'objet est verrouillé	ignoré
C:\WINDOWS\TEMP\Perflib_Perfdata_140.dat	L'objet est verrouillé	ignoré
C:\WINDOWS\TEMP\ZLT04954.TMP	L'objet est verrouillé	ignoré
C:\WINDOWS\TEMP\ZLT063d8.TMP	L'objet est verrouillé	ignoré
C:\WINDOWS\TEMP\_avast4_\Webshlock.txt	L'objet est verrouillé	ignoré
C:\WINDOWS\wiadebug.log	L'objet est verrouillé	ignoré
C:\WINDOWS\wiaservc.log	L'objet est verrouillé	ignoré
C:\WINDOWS\WindowsUpdate.log	L'objet est verrouillé	ignoré
J:\System Volume Information\MountPointManagerRemoteDatabase	L'objet est verrouillé	ignoré
J:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP444\change.log	L'objet est verrouillé	ignoré
K:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP444\change.log	L'objet est verrouillé	ignoré

Analyse terminée.

DllD · Answer

Bonsoir,

Les virus que tu as (not-a-virus:RiskTool.Win32.Reboot.f) ne sont pas nocifs....

Peux tu poster un nouveau rapport HiJackT stp ?

As tu encore les mêmes problèmes ?

Courage,

A+

green day · Answer

Salut

Salut Dlld ;-)

oui, que veux tu dire par ; toujours le même problème ?? redirection ??

++

codu · Answer

Voilà un petit HijackThis et oui le problème est toujours de la redirection (bien que je n'ai pas vraiment retesé depuis la nuit de samedi à dimanche

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:32:43, on 10.03.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\CTHELPER.EXE
C:\WINDOWS\system32\CTXFIHLP.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE
C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe
C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Canon\MultiPASS4\monitr32.exe
C:\Program Files\Canon\MultiPASS4\MPTBox.exe
C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Fichiers communs\Teleca Shared\CapabilityManager.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Windows Live\Contrôle parental\fssui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Logitech\Video\ManifestEngine.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.video2000.ch/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: IE7Pro - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files\IEPro\iepro.dll
O2 - BHO: Windows Live OneCare Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Contrôle parental\fssbho.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: TV5 - Dictionnaires - {CEDDA62D-5FBE-4AB2-AE2E-5E069F444444} - C:\Program Files\Dico TV5\MDTV5TB.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [CTDVDDET] "C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE"
O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" /r
O4 - HKLM\..\Run: [AudioDrvEmulator] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll"
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\ISUSPM.exe" -startup
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe 
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [monitr32] C:\Program Files\Canon\MultiPASS4\monitr32.exe
O4 - HKLM\..\Run: [MPTBox] C:\Program Files\Canon\MultiPASS4\MPTBox.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [AdobeVersionCue] C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [fssui] "C:\Program Files\Windows Live\Contrôle parental\fssui.exe" -autorun
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-21-3113122520-2486959141-1304036979-1006\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Bouchra')
O4 - HKUS\S-1-5-21-3113122520-2486959141-1304036979-1006\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" (User 'Bouchra')
O4 - HKUS\S-1-5-21-3113122520-2486959141-1304036979-1006\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime (User 'Bouchra')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Assistant d'Acrobat.lnk = C:\Program Files\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://s.tf1.fr/mmdia/static/rawflow/clients/5.3.1.0/Rawflow.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://62.202.10.41/activex/AxisCamControl.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {DFB5BCF1-06AE-4ABB-BFA8-1E228F41C50A} - https://www.bobtv.fr/download/cfweb_www.bobtv.fr-download_instmodule.exe
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AdobeVersionCue - Adobe Sytems - C:\Program Files\Adobe\Adobe Version Cue\service\VersionCue.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Intel® Quick Resume Technology Drivers (ELService) - Intel Corporation - C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology\ELService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MpService - Canon Inc - C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

DllD · Answer

Bonsoir,
il est tard je te réponds demain désolé.

Peux tu me renvoyer un message sinon je risque involontairement de t'oublier.

Du genre 'salut : je suis là !'

Merci,

A+

;)

green day · Answer

Salut

 pas de trace de wareout et rapports propres ...

Télécharge Gmer sur ce lien

Déconnecte toi d'internet si possible et ferme tous les programmes.
Décompresse le fichier zip et double-clic sur gmer.exe
IMPORTANT Si une alerte de ton antivirus apparaît pour le fichier gmer.sys ou gmer.exe, laisse le s'executer.
Clic sur l'onglet "rootkit"
A droite, coche "Files" et "Services"
Clic sur Scan
Lorsque le scan est terminé, clique sur "copy"

Ouvre le bloc-note et clique sur le Menu Edition / Coller
Le rapport doit alors apparaître.
Enregistre le fichier sur ton bureau et poste le rapport dans ta prochaine réponse 


++

green day · Answer

Bonsoir

 oups !désolée ! :)

codu · Answer

Rapport tout vierge !!

green day · Answer

Je commence à sécher !

explique un peu plus en détail stp

 ce n'est que vers 1 site, plusieurs sites, après avoir fait une recherche ?, etc ...

++

DllD · Answer

Bonsoir à tous,

explique un peu plus en détail stp
ce n'est que vers 1 site, plusieurs sites, après avoir fait une recherche ?, etc ...,
en effet ce serait bien, vraiment : exemples de sites......ect....

Bon, ensuite,
> Connecte toi en mode Administrateur et télécharge DSS sur ton bureau stp : http://www.techsupportforum.com/sectools/Deckard/dss.exe
- Déconnecte toi du web et désactive ton pare feu, ton antivirus et tes autres logiciels de protections résidents le temps du scanne puis double clique sur dss.exe (préférable de les désactiver).
- Ensuite, clique sur "OK" des boîtes des dialogues qui s'affichent ( /!\ Fais le assez rapidement sinon la réponse 'Abandon' sera automatiquement validée !)
- Deux fichiers vont s'afficher (Si c'est la première fois que tu exécutes ce diagnostic / sinon un seul) : main.txt et extra.txt (le second se trouve en arrière plan).
- Réactive tes protections résidentes et reconnecte toi au web après le scanne.
- Fait un copier/coller de ces deux rapports dans ta prochaine réponse stp.

Aller : Bon courage !

A+

;)

Redirection non désirée

58 réponses

Discussions similaires

Newsletters