Iexplorer.exe s'active seul! Problem !

Ouai ^^ je fais surtout un grand merci a tous eux qui m'ont aider a regler se contre temp !! Franchement super
Rapide , comprehensible, et simpa =P

Ferme ton navigateur Web.

Débranche ton cable ethernet si tu veux pas prendre de risques.

++

Re ,

Pas grave.

Supprime Navilog1.

Ben écoute , je vois pas comment tu peux avoir des pubs ...

On peut faire une ultime vérification si tu souhaite ;)

++

https://www.google.fr/search?q=iexplorer.exe+demarre+tout+seul&ie=utf-8&oe=utf-8&aq=t&rls=com.google:fr:official&client=firefox-a&gws_rd=ssl

Re , merci de ta reponse mais non mon problem est plus compliquer que cela .Je dois effectuer une certaine démarche qui est differente pour chaque ordinateur a se que j'ai vu.
Dans "msconfig" IE n'est pas present dans l'onglet "Démarrage" . De plus IE se lance toute les heures ( 12 h00 , 13h00 , 14h 00 , etc ) et sa toute les heures ! Je n'ai réellement aucune idée .Mais se que je sais , c'est que avant que IE se lance automatiquement il est ecrie " COALTR~1.exe " .
J'ai donc fait des recherche mais rien d'interessant .
Et dernier point ,il y a 2 IE qui se lance aufaite : 1 qui me prend à peu près 87 000Ko / 99 processus
et le 2eme à peu près 10 000 Ko / 00 processus

Merci de donner d'autre proposition

Salut !

Bizarre ton histoire .

On va voir :



→ Télécharge TrendMicro™ HijackThis™



Place le dans ' C:\programmes\ ' Une fois cela fait , merci de renommer l'icône ( clique droit > renommer )' Hijackthis.exe 'située dans le dossier dans C:\ , en ' HJT.exe ' <<<<<<<<< Important !!! <<<<<<<

Le chemin d'accés du programme doit être ressemblant à celui-ci : C:\Programme\Trend Micro\Hijackthis\HJT.exe

→ Ne pas renommer l'icône du raccourci sur le bureau bien entendu ...

/!\ Ferme toute les fenêtres encore ouvertes , et déconnecte toi du web /!\

→ Puis lance-le et choisi l'option '' do a system scan and save a logfile '' et poste moi le rapport ( qui apparait sur le bloc-note )


(CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

Tuto si tu n'y arrive pas : http://pageperso.aol.fr/balltrap34/demohijack.htm



EDIT

Fait ça aussi :

Télécharge http://www.suspectfile.com/systemscan/ ( system scan )


→ Double clic dessus (ferme ton antivirus le temps du téléchargement s'il te détecte quoi que ce soit et réactive le après)

→ Clique sur Unselect all

Coche uniquement ces cases :

_ Recent Files, 30 days

_ Registry run keys

_ Suspicious files


Puis clique sur scan now, sois patient.
Une fois le scan terminé, un rapport va s'ouvrir, copie et colle son contenu ici et vérifie qu'il soit bien en entier, si besoin crée deux messages.

(CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )







A+

Salut,
Autre idée : Regarde dans ton panneau de configuration > Tâches planifiées . Si il y a plusieurs choses non-souhaitées mis à part "Création d'une tâche" alors supprime-les et suis les instructions de Cyril.

a++

Bonjours merci d'avoir repondu .Donc ci-dessous le rapport que vous me demandier a 17h 35 ( mais j'ai enlever le problem en fesant " alt Gr + Ctrl + Supr " cela me permet de l'enlever un moment ...le Problem reviendra à 18h dites mois si vous souhaité un rapport avec le problem .

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:34:13, on 18/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\RunDll32.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
C:\Program Files\DNA\btdna.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\eMule\emule.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Trend Micro\HijackThis\HJT.exe\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Online chin internet bolt] C:\Documents and Settings\All Users\Application Data\Bags Plus Online Chin\phone seek.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [helpskip] C:\DOCUME~1\ADMINI~1\APPLIC~1\STARTS~1\CoalTrust.exe
O4 - HKCU\..\Run: [AdVantage] "C:\Program Files\AdVantage\AdVantage.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\npjpi160_04.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\npjpi160_04.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

re
on est sur le coup
examines egalement la proposition de dj fire-black en post nr 5
taches planifiées

Re voici le 2eme rapport executer avec " vitwycm" :

SystemScan - www.suspectfile.com - ver. 3.5.5 (code: holifay & bReAkdOWn)

Running on: Windows XP PROFESSIONAL Edition, Service Pack 2 (2600.5.1)
System directory: C:\WINDOWS
SystemScan file: C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\F9XDRC93\sys77150[1].exe
Running in: User mode
Date: 18/04/2008
Time: 17:40:36

Output limited to:
-Recent files
-Registry Run Keys
-Suspicious Files

===================== RECENT FILES =====================

Showing files newer than 30 days

----- recent files in C:\
21/03/2008 18:59:38 (DIR) 0 byte 28 days old -- ATI
04/04/2008 17:28:16 212 byte 14 days old -- boot.ini
12/04/2008 09:57:24 (DIR) 0 byte 6 days old -- WINDOWS
12/04/2008 18:02:10 (DIR) 0 byte 6 days old -- Config.Msi
18/04/2008 08:28:06 1610612736 byte 0 days old -- pagefile.sys
18/04/2008 17:28:13 (DIR) 0 byte 0 days old -- Program Files

----- recent files in C:\WINDOWS\
21/03/2008 09:19:16 23176 byte 28 days old -- DPINST.LOG
21/03/2008 18:43:30 (DIR) 0 byte 28 days old -- Minidump
21/03/2008 18:56:07 (DIR) 0 byte 28 days old -- Downloaded Program Files
21/03/2008 19:25:38 (DIR) 0 byte 28 days old -- SiS
21/03/2008 20:42:14 21722 byte 28 days old -- wmsetup.log
22/03/2008 15:47:13 (DIR) 0 byte 27 days old -- pss
22/03/2008 15:48:22 166652 byte 27 days old -- setupact.log
22/03/2008 18:52:14 (DIR) 0 byte 27 days old -- SxsCaPendDel
23/03/2008 16:07:56 0 byte 26 days old -- setuperr.log
24/03/2008 13:12:03 (DIR) 0 byte 25 days old -- msdownld.tmp
25/03/2008 21:05:25 287014 byte 24 days old -- DirectX.log
28/03/2008 09:54:52 0 byte 21 days old -- MEMORY.DMP
30/03/2008 18:47:23 (DIR) 0 byte 19 days old -- Fonts
30/03/2008 22:01:42 (DIR) 0 byte 19 days old -- Tasks
04/04/2008 17:28:16 533 byte 14 days old -- win.ini
04/04/2008 17:28:16 227 byte 14 days old -- system.ini
11/04/2008 23:31:04 (DIR) 0 byte 7 days old -- $NtUninstallKB945553$
11/04/2008 23:31:10 12122 byte 7 days old -- KB945553.log
11/04/2008 23:32:09 (DIR) 0 byte 7 days old -- $NtUninstallKB948590$
11/04/2008 23:32:10 12139 byte 7 days old -- KB948590.log
11/04/2008 23:32:20 (DIR) 0 byte 7 days old -- ie7updates
11/04/2008 23:32:27 71369 byte 7 days old -- updspapi.log
11/04/2008 23:32:33 19432 byte 7 days old -- KB947864-IE7.log
11/04/2008 23:32:39 (DIR) 0 byte 7 days old -- $NtUninstallKB941693$
11/04/2008 23:32:41 1374 byte 7 days old -- imsins.BAK
11/04/2008 23:32:41 18094 byte 7 days old -- KB941693.log
11/04/2008 23:32:45 (DIR) 0 byte 7 days old -- $hf_mig$
11/04/2008 23:32:47 (DIR) 0 byte 7 days old -- $NtUninstallKB948881$
11/04/2008 23:32:48 348007 byte 7 days old -- ocgen.log
11/04/2008 23:32:48 148159 byte 7 days old -- ntdtcsetup.log
11/04/2008 23:32:48 39570 byte 7 days old -- ocmsn.log
11/04/2008 23:32:48 328660 byte 7 days old -- tsoc.log
11/04/2008 23:32:48 34960 byte 7 days old -- tabletoc.log
11/04/2008 23:32:48 13566 byte 7 days old -- KB948881.log
11/04/2008 23:32:48 50052 byte 7 days old -- medctroc.Log
11/04/2008 23:32:48 246041 byte 7 days old -- comsetup.log
11/04/2008 23:32:48 702667 byte 7 days old -- FaxSetup.log
11/04/2008 23:32:48 827666 byte 7 days old -- iis6.log
11/04/2008 23:32:48 1374 byte 7 days old -- imsins.log
11/04/2008 23:32:48 121604 byte 7 days old -- netfxocm.log
11/04/2008 23:32:48 35688 byte 7 days old -- msgsocm.log
11/04/2008 23:32:48 230284 byte 7 days old -- msmqinst.log
12/04/2008 18:01:45 (DIR) 0 byte 6 days old -- WinSxS
12/04/2008 18:01:50 (DIR) 0 byte 6 days old -- system32
12/04/2008 18:02:10 (DIR) 0 byte 6 days old -- Installer
13/04/2008 18:23:31 (DIR) 0 byte 5 days old -- Microsoft.NET
13/04/2008 18:24:34 (DIR) 0 byte 5 days old -- assembly
15/04/2008 18:48:51 (DIR) 0 byte 3 days old -- inf
15/04/2008 18:48:53 619230 byte 3 days old -- setupapi.log
17/04/2008 22:38:58 32424 byte 1 days old -- SchedLgU.Txt
18/04/2008 08:28:12 2048 byte 0 days old -- bootstat.dat
18/04/2008 08:29:38 50 byte 0 days old -- wiaservc.log
18/04/2008 08:30:51 159 byte 0 days old -- wiadebug.log
18/04/2008 08:30:56 0 byte 0 days old -- 0.log
18/04/2008 08:33:14 1504025 byte 0 days old -- WindowsUpdate.log
18/04/2008 17:21:05 (DIR) 0 byte 0 days old -- Temp
18/04/2008 17:31:14 (DIR) 0 byte 0 days old -- Prefetch

----- recent files in C:\WINDOWS\Downloaded Program Files\

----- recent files in C:\WINDOWS\system\
18/04/2008 08:32:27 206 byte 0 days old -- CmiCnfg.ini

----- recent files in C:\WINDOWS\system32\
20/03/2008 10:09:22 1845376 byte 29 days old -- win32k.sys
21/03/2008 09:19:15 (DIR) 0 byte 28 days old -- DRVSTORE
22/03/2008 00:55:59 45 byte 27 days old -- initdebug.nfo
24/03/2008 13:12:11 (DIR) 0 byte 25 days old -- DirectX
29/03/2008 19:23:22 95608 byte 20 days old -- AvastSS.scr
29/03/2008 19:45:49 1146232 byte 20 days old -- aswBoot.exe
29/03/2008 22:05:05 5911 byte 20 days old -- jupdate-1.6.0_04-b12.log
02/04/2008 18:16:59 3121 byte 16 days old -- CONFIG.NT
03/04/2008 19:57:56 (DIR) 0 byte 15 days old -- drivers
06/04/2008 07:56:20 19836024 byte 12 days old -- MRT.exe
11/04/2008 23:32:40 (DIR) 0 byte 7 days old -- dllcache
12/04/2008 09:55:51 110192 byte 6 days old -- FNTCACHE.DAT
12/04/2008 18:01:11 (DIR) 0 byte 6 days old -- mui
12/04/2008 18:01:50 397560 byte 6 days old -- perfh009.dat
12/04/2008 18:01:50 464474 byte 6 days old -- perfh00C.dat
12/04/2008 18:01:50 960616 byte 6 days old -- PerfStringBackup.INI
12/04/2008 18:01:50 59780 byte 6 days old -- perfc009.dat
12/04/2008 18:01:50 73020 byte 6 days old -- perfc00C.dat
15/04/2008 22:33:13 (DIR) 0 byte 3 days old -- CatRoot2
18/04/2008 08:28:14 2206 byte 0 days old -- wpa.dbl
18/04/2008 16:49:51 (DIR) 0 byte 0 days old -- config

----- recent files in C:\WINDOWS\system32\drivers\
29/03/2008 19:26:52 26944 byte 20 days old -- aavmker4.sys
29/03/2008 19:27:33 42912 byte 20 days old -- aswTdi.sys
29/03/2008 19:29:08 23152 byte 20 days old -- aswRdr.sys
29/03/2008 19:31:34 75856 byte 20 days old -- aswSP.sys
29/03/2008 19:35:21 94544 byte 20 days old -- aswmon2.sys
29/03/2008 19:35:49 20560 byte 20 days old -- aswFsBlk.sys
18/04/2008 17:20:58 (DIR) 0 byte 0 days old -- etc

----- recent files in C:\WINDOWS\temp\
22/03/2008 18:52:34 16384 byte 27 days old -- Perflib_Perfdata_5a0.dat
23/03/2008 18:21:32 16384 byte 26 days old -- Perflib_Perfdata_578.dat
24/03/2008 01:07:49 16384 byte 25 days old -- Perflib_Perfdata_598.dat
24/03/2008 01:27:06 16384 byte 25 days old -- Perflib_Perfdata_59c.dat
24/03/2008 13:00:22 16384 byte 25 days old -- Perflib_Perfdata_ae8.dat
30/03/2008 15:34:27 (DIR) 0 byte 19 days old -- Panda Antivirus 2008
01/04/2008 16:56:44 16384 byte 17 days old -- Perflib_Perfdata_5c0.dat
12/04/2008 18:00:00 2 byte 6 days old -- dd_dotnetfx20error.txt
12/04/2008 18:00:04 21336 byte 6 days old -- dd_depcheck_NETFX20_EXP_35.txt
12/04/2008 18:01:50 5158 byte 6 days old -- ASPNETSetup_00000.log
12/04/2008 18:02:10 9330610 byte 6 days old -- dd_NET_Framework20_Setup7846.txt
12/04/2008 18:02:12 1536 byte 6 days old -- uxeventlog.txt
12/04/2008 18:02:12 65104 byte 6 days old -- dd_dotnetfx20install.txt
17/04/2008 08:17:30 409 byte 1 days old -- WGANotify.settings
18/04/2008 08:28:15 255 byte 0 days old -- WGAErrLog.txt
18/04/2008 08:28:40 16384 byte 0 days old -- Perflib_Perfdata_594.dat
18/04/2008 17:38:11 (DIR) 0 byte 0 days old -- _avast4_

----- recent files in C:\Program Files\
20/03/2008 23:40:10 (DIR) 0 byte 29 days old -- Common Files
21/03/2008 09:18:08 (DIR) 0 byte 28 days old -- Windows Live
21/03/2008 18:55:56 (DIR) 0 byte 28 days old -- ma-config.com
21/03/2008 19:08:14 (DIR) 0 byte 28 days old -- ATI Technologies
21/03/2008 19:16:30 (DIR) 0 byte 28 days old -- VIA
21/03/2008 21:36:12 (DIR) 0 byte 28 days old -- Realtek AC97
22/03/2008 15:51:08 (DIR) 0 byte 27 days old -- sisagp
24/03/2008 14:59:44 (DIR) 0 byte 25 days old -- InstallShield Installation Information
27/03/2008 21:52:13 (DIR) 0 byte 22 days old -- Gpotato.eu
29/03/2008 10:14:08 (DIR) 0 byte 20 days old -- Guitar Pro 5
29/03/2008 22:04:41 (DIR) 0 byte 20 days old -- Fichiers communs
29/03/2008 22:05:05 (DIR) 0 byte 20 days old -- Java
30/03/2008 18:47:24 (DIR) 0 byte 19 days old -- OpenOffice.org 2.4
30/03/2008 22:00:16 (DIR) 0 byte 19 days old -- Circle Developement
30/03/2008 22:00:16 (DIR) 0 byte 19 days old -- Messenger Plus! Live
30/03/2008 22:00:45 (DIR) 0 byte 19 days old -- START SIZE ACID
07/04/2008 20:54:56 (DIR) 0 byte 11 days old -- DivX
12/04/2008 18:01:11 (DIR) 0 byte 6 days old -- Internet Explorer
17/04/2008 21:23:10 (DIR) 0 byte 1 days old -- Webteh
18/04/2008 08:33:01 (DIR) 0 byte 0 days old -- eMule
18/04/2008 17:28:13 (DIR) 0 byte 0 days old -- Trend Micro

----- recent files in C:\Program Files\Fichiers communs\
21/03/2008 09:18:23 (DIR) 0 byte 28 days old -- WindowsLiveInstaller
21/03/2008 09:18:36 (DIR) 0 byte 28 days old -- Microsoft Shared
29/03/2008 22:04:41 (DIR) 0 byte 20 days old -- Java
01/04/2008 16:29:20 (DIR) 0 byte 17 days old -- Panda Software

----- recent files in C:\Documents and Settings\Administrateur\Application Data\
21/03/2008 20:33:11 (DIR) 0 byte 28 days old -- ATI
22/03/2008 00:10:37 (DIR) 0 byte 27 days old -- Microsoft
24/03/2008 14:48:11 (DIR) 0 byte 25 days old -- ma-config.com
29/03/2008 22:04:31 (DIR) 0 byte 20 days old -- Sun
30/03/2008 22:01:42 (DIR) 0 byte 19 days old -- START SIZE ACID
07/04/2008 20:55:29 (DIR) 0 byte 11 days old -- DivX
07/04/2008 20:58:41 (DIR) 0 byte 11 days old -- BSplayer Pro
17/04/2008 17:58:42 (DIR) 0 byte 1 days old -- BitTorrent
17/04/2008 19:50:51 (DIR) 0 byte 1 days old -- OpenOffice.org2
17/04/2008 21:23:09 (DIR) 0 byte 1 days old -- BSplayer
18/04/2008 17:39:18 (DIR) 0 byte 0 days old -- DNA

----- recent files in C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\
20/03/2008 23:12:00 0 byte 29 days old -- utt22.tmp
20/03/2008 23:36:46 180224 byte 29 days old -- ~DF7DEA.tmp
21/03/2008 18:56:08 16384 byte 28 days old -- ~DFAA50.tmp
21/03/2008 19:11:53 16384 byte 28 days old -- ~DFBC88.tmp
21/03/2008 19:11:58 16384 byte 28 days old -- Perflib_Perfdata_ca0.dat
21/03/2008 19:16:17 0 byte 28 days old -- ~5.tmp
21/03/2008 19:16:25 (DIR) 0 byte 28 days old -- {20D4A895-748C-4D88-871C-FDB1695B0169}
21/03/2008 19:16:37 49152 byte 28 days old -- 45d5.rra
21/03/2008 19:18:28 430 byte 28 days old -- MSIf8b7.LOG
21/03/2008 19:29:05 16384 byte 28 days old -- ~DF7806.tmp
21/03/2008 19:41:50 4533 byte 28 days old -- plf5.tmp
21/03/2008 19:41:56 (DIR) 0 byte 28 days old -- pft7~tmp
21/03/2008 19:52:55 4562 byte 28 days old -- ASPNETSetup_00000.log
21/03/2008 19:54:34 4998866 byte 28 days old -- dd_netfx20MSI16DD.txt
21/03/2008 19:54:44 16184 byte 28 days old -- dd_netfx20UI16DD.txt
21/03/2008 20:12:45 805416 byte 28 days old -- IMT87.xml
21/03/2008 20:12:45 1994 byte 28 days old -- IMT85.xml
21/03/2008 20:12:45 426 byte 28 days old -- IMT86.xml
21/03/2008 20:24:42 4533 byte 28 days old -- plf8E.tmp
21/03/2008 20:24:50 (DIR) 0 byte 28 days old -- pft90~tmp
21/03/2008 21:37:22 (DIR) 0 byte 28 days old -- pft38~tmp
22/03/2008 00:56:17 16384 byte 27 days old -- Perflib_Perfdata_bb8.dat
22/03/2008 13:33:49 0 byte 27 days old -- 37D6AD.dmp
22/03/2008 14:05:11 239754 byte 27 days old -- mps_9650.tmp
22/03/2008 17:23:19 180224 byte 27 days old -- ~DF99D5.tmp
24/03/2008 12:49:03 16384 byte 25 days old -- ~DF1406.tmp
24/03/2008 13:20:49 512 byte 25 days old -- ~DF40A7.tmp
24/03/2008 13:20:49 409600 byte 25 days old -- ~DF4038.tmp
24/03/2008 13:20:53 409600 byte 25 days old -- ~DF4858.tmp
24/03/2008 13:20:53 512 byte 25 days old -- ~DF4866.tmp
24/03/2008 15:00:57 1376256 byte 25 days old -- 20e4.rra
24/03/2008 15:00:57 (DIR) 0 byte 25 days old -- {DA1072B5-12F4-4738-A490-FBD1E4F85EF8}
24/03/2008 18:28:57 16384 byte 25 days old -- ~DF7BBF.tmp
24/03/2008 18:28:58 16384 byte 25 days old -- ~DF71D9.tmp
24/03/2008 18:29:10 409600 byte 25 days old -- ~DF7BB2.tmp
24/03/2008 18:29:10 409600 byte 25 days old -- ~DF71CC.tmp
25/03/2008 17:10:36 180224 byte 24 days old -- ~DFF49C.tmp
27/03/2008 21:30:58 81920 byte 22 days old -- ~DF79CB.tmp
27/03/2008 21:31:07 180224 byte 22 days old -- ~DF8E57.tmp
27/03/2008 21:58:44 180224 byte 22 days old -- ~DF2E44.tmp
29/03/2008 22:04:44 0 byte 20 days old -- java_install.log
30/03/2008 15:34:31 (DIR) 0 byte 19 days old -- Panda Antivirus 2008
30/03/2008 22:00:38 435712 byte 19 days old -- bis4E.exe
31/03/2008 16:29:40 0 byte 18 days old -- utt1.tmp
31/03/2008 19:57:40 (DIR) 0 byte 18 days old -- iss2A.tmp
31/03/2008 19:57:40 (DIR) 0 byte 18 days old -- isp2B.tmp
31/03/2008 19:57:45 (DIR) 0 byte 18 days old -- {A33AC506-B89B-406F-9978-335DD1435FAD}
31/03/2008 19:59:09 10937 byte 18 days old -- PavLogInst
01/04/2008 16:57:35 49152 byte 17 days old -- ~DF546B.tmp
01/04/2008 17:05:13 1900 byte 17 days old -- java_install_reg.log
01/04/2008 17:05:25 (DIR) 0 byte 17 days old -- hsperfdata_Administrateur
02/04/2008 16:40:10 (DIR) 0 byte 16 days old -- ISSCAN
03/04/2008 19:57:13 196608 byte 15 days old -- ~DFC28E.tmp
07/04/2008 20:55:30 0 byte 11 days old -- aax1E.tmp
07/04/2008 20:55:30 0 byte 11 days old -- aax1D.tmp
07/04/2008 20:55:35 0 byte 11 days old -- aax1F.tmp
07/04/2008 20:55:40 0 byte 11 days old -- aax21.tmp
07/04/2008 20:55:40 0 byte 11 days old -- aax20.tmp
07/04/2008 20:55:55 0 byte 11 days old -- aax22.tmp
11/04/2008 08:02:10 0 byte 7 days old -- utt2.tmp
14/04/2008 13:18:44 49152 byte 4 days old -- ~DF28F1.tmp
17/04/2008 21:41:16 1796 byte 1 days old -- wmplog00.sqm
18/04/2008 08:28:06 (DIR) 0 byte 0 days old -- ~nsu.tmp
18/04/2008 08:33:23 6200 byte 0 days old -- jusched.log
18/04/2008 17:21:05 (DIR) 0 byte 0 days old -- WPDNSE
18/04/2008 17:23:42 409600 byte 0 days old -- ~DF45B6.tmp
18/04/2008 17:23:42 16384 byte 0 days old -- ~DF3BC7.tmp
18/04/2008 17:23:42 409600 byte 0 days old -- ~DF3B9E.tmp
18/04/2008 17:23:42 16384 byte 0 days old -- ~DF45E5.tmp
18/04/2008 17:31:36 114688 byte 0 days old -- ~DFBCDA.tmp
18/04/2008 17:37:12 (DIR) 0 byte 0 days old -- _avast4_
18/04/2008 17:38:37 16384 byte 0 days old -- ~DFE3A3.tmp
18/04/2008 17:38:37 117 byte 0 days old -- systemscan.ini
18/04/2008 17:38:38 (DIR) 0 byte 0 days old -- nskA.tmp
18/04/2008 17:40:26 (DIR) 0 byte 0 days old -- MessengerCache

===================== REGISTRY SCAN =====================


-----HKLM\Software\Microsoft\Windows\CurrentVersion\Run-----

[Run]
"Cmaudio"="RunDll32 cmicnfg.cpl,CMICtrlWnd"
"KernelFaultCheck"=expand:"%systemroot%\system32\dumprep 0 -k"
"StartCCC"="\"C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe\""
"SoundMan"="SOUNDMAN.EXE"
"Online chin internet bolt"="C:\Documents and Settings\All Users\Application Data\Bags Plus Online Chin\phone seek.exe"
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe"
"SunJavaUpdateSched"="\"C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe\""

-----HKCU\Software\Microsoft\Windows\CurrentVersion\Run-----

[Run]
"BitTorrent DNA"="\"C:\Program Files\DNA\btdna.exe\""
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe"
"helpskip"="C:\DOCUME~1\ADMINI~1\APPLIC~1\STARTS~1\CoalTrust.exe"
"AdVantage"="\"C:\Program Files\AdVantage\AdVantage.exe\""

-----HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run-----

[Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE"

-----HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run-----

-----HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run-----

-----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows-----

[Windows]
"AppInit_DLLs"=""

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad-----

[ShellServiceObjectDelayLoad]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
#### HKCR\CLSID\{7849596a-48ea-486e-8937-a2a3009f31a9}\InprocServer32 @=expand:"%SystemRoot%\system32\SHELL32.dll"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
#### HKCR\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32 @=expand:"%SystemRoot%\system32\SHELL32.dll"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
#### HKCR\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32 @=expand:"C:\WINDOWS\system32\webcheck.dll"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
#### HKCR\CLSID\{35CEC8A3-2BE6-11D2-8773-92E220524153}\InprocServer32 @="C:\WINDOWS\System32\stobject.dll"
"WPDShServiceObj"="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"
#### HKCR\CLSID\{AAA288BA-9A4C-45B0-95D7-94D524869DB5}\InprocServer32 @="C:\WINDOWS\system32\WPDShServiceObj.dll"

-----HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks-----

[ShellExecuteHooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
#### HKCR\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\InprocServer32 @="shell32.dll"

-----HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon-----

[Winlogon]
"Shell"="Explorer.exe"
"System"=""
"Userinit"="C:\WINDOWS\system32\userinit.exe,"
"VmApplet"="rundll32 shell32,Control_RunDLL \"sysdm.cpl\""
"UIHost"=expand:"logonui.exe"
"LogonType"=dword:00000001
"WinStationsDisabled"="0"

[Winlogon\GPExtensions]

[Winlogon\GPExtensions\{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}]
"@="Sans fil"
"DllName"=expand:"gptext.dll"

[Winlogon\GPExtensions\{25537BA6-77A8-11D2-9B6C-0000F8080861}]
"@="Folder Redirection"
"DllName"=expand:"fdeploy.dll"

[Winlogon\GPExtensions\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}]
"@="Quota du disque Microsoft"
"DllName"=expand:"dskquota.dll"

[Winlogon\GPExtensions\{426031c0-0b47-4852-b0ca-ac3d37bfcb39}]
"@="Planificateur de paquets QoS"
"DllName"=expand:"gptext.dll"

[Winlogon\GPExtensions\{42B5FAAE-6536-11d2-AE5A-0000F87571E3}]
"@="Scripts"
"DllName"=expand:"gptext.dll"

[Winlogon\GPExtensions\{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}]
"@="Internet Explorer Zonemapping"
"DllName"=expand:"iedkcs32.dll"

[Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}]
"DllName"=expand:"scecli.dll"
"@="Security"

[Winlogon\GPExtensions\{A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B}]
"DllName"="iedkcs32.dll"
"@="Internet Explorer Branding"

[Winlogon\GPExtensions\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}]
"DllName"=expand:"scecli.dll"
"@="EFS recovery"

[Winlogon\GPExtensions\{c6dc5466-785a-11d2-84d0-00c04fb169f7}]
"@="Installation de logiciel"
"DllName"=expand:"appmgmts.dll"

[Winlogon\GPExtensions\{e437bc1c-aa7d-11d2-a382-00c04f991e27}]
"@="Sécurité IP"
"DllName"=expand:"gptext.dll"

[Winlogon\Notify]

[Winlogon\Notify\AtiExtEvent]
"DLLName"="Ati2evxx.dll"

[Winlogon\Notify\crypt32chain]
"DllName"=expand:"crypt32.dll"

[Winlogon\Notify\cryptnet]
"DllName"=expand:"cryptnet.dll"

[Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"

[Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"

[Winlogon\Notify\Schedule]
"DllName"=expand:"wlnotify.dll"

[Winlogon\Notify\sclgntfy]
"DllName"=expand:"sclgntfy.dll"

[Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"

[Winlogon\Notify\termsrv]
"DllName"=expand:"wlnotify.dll"

[Winlogon\Notify\WgaLogon]
"DllName"=expand:"WgaLogon.dll"

[Winlogon\Notify\WgaLogon\Settings]

[Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"

[Winlogon\SpecialAccounts]

[Winlogon\SpecialAccounts\UserList]
"HelpAssistant"=dword:00000000
"TsInternetUser"=dword:00000000
"SQLAgentCmdExec"=dword:00000000
"NetShowServices"=dword:00000000
"IWAM_"=dword:00010000
"IUSR_"=dword:00010000
"VUSR_"=dword:00010000

-----HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon-----

[Winlogon]
"ParseAutoexec"="1"
"ExcludeProfileDirs"="Local Settings;Temporary Internet Files;Historique;Temp"
"BuildNumber"=dword:00000a28

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options-----

[Image File Execution Options\Your Image File Name Here without a path]
"Debugger"="ntsd -d"

-----HKLM\System\CurrentControlSet\Control\Session Manager\-----

[Session Manager]
"BootExecute"=multi:"autocheck autochk *\00\00"

[Session Manager\SubSystems]
"Windows"=expand:"%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16"

-----HKLM\SYSTEM\CurrentControlSet\Control\WOW-----

[WOW]
"cmdline"=expand:"%SystemRoot%\system32\ntvdm.exe"
"wowcmdline"=expand:"%SystemRoot%\system32\ntvdm.exe -a %SystemRoot%\system32\krnl386"

-----HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run-----

-----HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce-----

[RunOnce]

-----HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx-----

[RunOnceEx]

-----HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices-----

-----HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce-----

-----HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce-----

-----HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx-----

-----HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices-----

-----HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run-----

-----HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce-----

-----HKLM\Software\Microsoft\Command Processor\Autorun-----

-----HKCU\Software\Microsoft\Command Processor\Autorun-----

-----HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load-----

-----HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Startup-----

-----HKCU\Software\Policies\Microsoft\Windows\System\Scripts\Logon-----

-----HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Logon-----

-----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\Runonce-----

-----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\Run-----

-----HKLM\System\CurrentControlSet\Control\Terminal Server\Wds\rdpwd\StartupPrograms-----

-----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\Runonce-----

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler-----

[SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui"
#### HKCR\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InprocServer32 @=expand:"%SystemRoot%\System32\browseui.dll"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant"
#### HKCR\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InprocServer32 @=expand:"%SystemRoot%\System32\browseui.dll"

-----HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects-----

[Browser Helper Objects]

[Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
#### HKCR\CLSID\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\InprocServer32 @="C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll"
"NoExplorer"=dword:00000001

[Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]
@=""

[Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
#### HKCR\CLSID\{9030D464-4C02-4ABF-8ECC-5164760863C6}\InprocServer32 @="C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll"

-----HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks-----

[URLSearchHooks]
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"=""
#### HKCR\CLSID\{CFBFAE00-17A6-11D0-99CB-00C04FD64497}\InprocServer32 @="C:\WINDOWS\system32\ieframe.dll"

-----HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig-----

[MSConfig]

[MSConfig\ExpandFrom]

[MSConfig\ExpandTo]

[MSConfig\services]

[MSConfig\startupfolder]

[MSConfig\startupreg]

[MSConfig\state]
"system.ini"=dword:00000000
"win.ini"=dword:00000000
"bootini"=dword:00000000
"services"=dword:00000000
"startup"=dword:00000000

-----HKCU\Control Panel\Desktop\-----

[Desktop]

[Desktop\WindowMetrics]

-----HKEY_CLASSES_ROOT\exefile\shell\open\command-----

[command]
@="\"%1\" %*"

-----HKEY_CLASSES_ROOT\comfile\shell\open\command-----

[command]
@="\"%1\" %*"

-----HKEY_CLASSES_ROOT\batfile\shell\open\command-----

[command]
@="\"%1\" %*"

-----HKEY_CLASSES_ROOT\piffile\shell\open\command-----

[command]
@="\"%1\" %*"

-----HKEY_CLASSES_ROOT\scrFile\shell\open\command-----

[command]
@="\"%1\" /S"

-----HKEY_CLASSES_ROOT\htafile\shell\open\command-----

[Command]
@="C:\WINDOWS\system32\mshta.exe \"%1\" %*"

-----HKEY_CLASSES_ROOT\logfile\shell\open\command-----

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL-----

[URL]

[URL\DefaultPrefix]
@="http://"

[URL\Prefixes]
"ftp"="ftp://"
"gopher"="gopher://"
"home"="http://"
"mosaic"="http://"
"www"="http://"

-----HKLM\SYSTEM\CurrentControlSet\Control\Lsa-----

[Lsa]

[Lsa\AccessProviders]

[Lsa\AccessProviders\Windows NT Access Provider]
"ProviderPath"=expand:"%SystemRoot%\system32\ntmarta.dll"

[Lsa\Audit]

[Lsa\Audit\PerUserAuditing]

[Lsa\Audit\PerUserAuditing\System]

[Lsa\Data]

[Lsa\SSO]

[Lsa\SSO\Passport1.4]
"SSOURL"="http://www.passport.com"

[Lsa\SspiCache]

[Lsa\SspiCache\digest.dll]
"Name"="Digest"
"Comment"="Digest SSPI Authentication Package"

[Lsa\SspiCache\msapsspc.dll]
"Name"="DPA"
"Comment"="DPA Security Package"

[Lsa\SspiCache\msnsspc.dll]
"Name"="MSN"
"Comment"="MSN Security Package"

-----HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess-----

[SharedAccess]
"Type"=dword:00000020
"Start"=dword:00000002
"ErrorControl"=dword:00000001
"ImagePath"=expand:"%SystemRoot%\System32\svchost.exe -k netsvcs"
"DisplayName"="Pare-feu Windows / Partage de connexion Internet"
"DependOnService"=multi:"Netman\00WinMgmt\00\00"
"DependOnGroup"=multi:"\00"
"ObjectName"="LocalSystem"
"Description"="Assure la traduction d'adresses de réseau, l'adressage, les services de résolution de noms et/ou les services de prévention d'intrusion pour un réseau de petite entreprise ou un réseau domestique."

[SharedAccess\Epoch]
"Epoch"=dword:0000021f

[SharedAccess\Parameters]
"ServiceDll"=expand:"%SystemRoot%\System32\ipnathlp.dll"

[SharedAccess\Parameters\FirewallPolicy]

[SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications]

[SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enaxxxxx@xxxxxres.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enaxxxxx@xxxxxres.dll,-20000"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall"=dword:00000001
"DoNotAllowExceptions"=dword:00000000
"DisableNotifications"=dword:00000000

[SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications]

[SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\DNA\btdna.exe"="C:\Program Files\DNA\btdna.exe:*:Enabled:DNA"
"C:\Program Files\BitTorrent\bittorrent.exe"="C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent"
"C:\Program Files\Valve\Steam\SteamApps\dino_91\counter-strike source\hl2.exe"="C:\Program Files\Valve\Steam\SteamApps\dino_91\counter-strike source\hl2.exe:*:Enabled:hl2"
"C:\Program Files\eMule\emule.exe"="C:\Program Files\eMule\emule.exe:*:Enabled:eMule"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Gpotato.eu\Flyff\Flyff.exe"="C:\Program Files\Gpotato.eu\Flyff\Flyff.exe:*:Enabled:Flyff"
"C:\WINDOWS\system32\sessmgr.exe"="C:\WINDOWS\system32\sessmgr.exe:*:Disaxxxxx@xxxxxres.dll,-22019"
"C:\WINDOWS\Network Diagnostic\xpnetdiag.exe"="C:\WINDOWS\Network Diagnostic\xpnetdiag.exe:*:Disaxxxxx@xxxxxres.dll,-20000"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Disabled:Windows Live Messenger (Phone)"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"

[SharedAccess\Setup]
"ServiceUpgrade"=dword:00000001

[SharedAccess\Setup\InterfacesUnfirewalledAtUpdate]
"All"=dword:00000001

-----HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Firewall\-----

-----HKEY_LOCAL_MACHINE\SOFTWARE\Winsock2-----

[Winsock2]

-----HKLM\Software\Microsoft\Ole-----

[Ole]
"DefaultLaunchPermission"=hex:01,00,04,80,64,00,00,00,80,00,00,00,00,00,00,00,\
"EnableDCOM"="Y"
"MachineLaunchRestriction"=hex:01,00,04,80,48,00,00,00,58,00,00,00,00,00,00,00,\
"MachineAccessRestriction"=hex:01,00,04,80,44,00,00,00,54,00,00,00,00,00,00,00,\

[Ole\AppCompat]

[Ole\AppCompat\ActivationSecurityCheckExemptionList]
"{A50398B8-9075-4FBF-A7A1-456BF21937AD}"="1"
"{AD65A69D-3831-40D7-9629-9B0B50A93843}"="1"
"{0040D221-54A1-11D1-9DE0-006097042D69}"="1"
"{2A6D72F1-6E7E-4702-B99C-E40D3DED33C3}"="1"

-----HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU\-----

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\-----

[Security Center]
"AntiVirusDisableNotify"=dword:00000000
"FirewallDisableNotify"=dword:00000000
"UpdatesDisableNotify"=dword:00000000
"AntiVirusOverride"=dword:00000000
"FirewallOverride"=dword:00000000

[Security Center\Monitoring]

[Security Center\Monitoring\AhnlabAntiVirus]

[Security Center\Monitoring\ComputerAssociatesAntiVirus]

[Security Center\Monitoring\KasperskyAntiVirus]

[Security Center\Monitoring\McAfeeAntiVirus]

[Security Center\Monitoring\McAfeeFirewall]

[Security Center\Monitoring\PandaAntiVirus]
"DisableMonitoring"=dword:00000000

[Security Center\Monitoring\PandaFirewall]

[Security Center\Monitoring\SophosAntiVirus]

[Security Center\Monitoring\SymantecAntiVirus]

[Security Center\Monitoring\SymantecFirewall]

[Security Center\Monitoring\TinyFirewall]

[Security Center\Monitoring\TrendAntiVirus]

[Security Center\Monitoring\TrendFirewall]

[Security Center\Monitoring\ZoneLabsFirewall]

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\-----

[SystemRestore]
"DisableSR"=dword:00000000
"CreateFirstRunRp"=dword:00000001
"DSMin"=dword:000000c8
"DSMax"=dword:00000190
"RPSessionInterval"=dword:00000000
"RPGlobalInterval"=dword:00015180
"RPLifeInterval"=dword:0076a700
"CompressionBurst"=dword:0000003c
"TimerInterval"=dword:00000078
"DiskPercent"=dword:0000000c
"ThawInterval"=dword:00000384
"RestoreDiskSpaceError"=dword:00000000

[SystemRestore\Cfg]
"DiskPercent"=dword:0000000c
"MachineGuid"="{45E9D2D6-44E0-4EF8-B676-DDBE2514BBC2}"

[SystemRestore\SnapshotCallbacks]
@=""

-----HKEY_CURRENT_USER\Software\VB and VBA Program Settings-----

-----HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\-----

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions-----

[AdvancedOptions]

-----HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions-----

-----HKLM\Software\Microsoft\Active Setup\Installed Components-----

[Installed Components]

[Installed Components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}]
"@="IE7 Uninstall Stub"
"ComponentID"="IEUDINIT"
"StubPath"="C:\WINDOWS\system32\ieudinit.exe"

[Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
#### HKCR\CLSID\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\InprocServer32 @="C:\WINDOWS\system32\wmpdxm.dll"
"@="Lecteur Windows Media"
"ComponentID"="WMPACCESS"
"StubPath"="C:\WINDOWS\inf\unregmp2.exe /ShowWMP"

[Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
"@="Internet Explorer"
"ComponentID"="IEACCESS"
"StubPath"="C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig"

[Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"@="Browser Customizations"
"ComponentiD"="BRANDING.CAB"
"StubPath"="RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP"

[Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS]
"@="Personnalisation du navigateur"
"ComponentID"="BRANDING.CAB"
"StubPath"="RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP"

[Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
"@="Outlook Express"
"ComponentID"="OEACCESS"
"StubPath"=expand:"%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE"

[Installed Components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}]
"@="Java (Sun)"
"ComponentID"="JAVAVM"
"KeyFileName"="C:\Program Files\Java\jre1.6.0_04\bin\regutils.dll"

[Installed Components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}]
"@="Rendu VML (Vector Graphics Rendering)"
"ComponentID"="MSVML"

[Installed Components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}]
#### HKCR\CLSID\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}\InprocServer32 @="C:\WINDOWS\system32\wmpdxm.dll"
"ComponentID"="NetShow"
"StubPath"=""

[Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
#### HKCR\CLSID\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\InprocServer32 @="C:\WINDOWS\system32\wmpdxm.dll"
"ComponentID"="Microsoft Windows Media Player"
"StubPath"=""
"@="Microsoft Windows Media Player 6.4"

[Installed Components\{283807B5-2C60-11D0-A31D-00AA00B92C03}]
"@="DirectAnimation"
"ComponentID"="DirectAnimation"

[Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
"@="Themes Setup"
"ComponentID"="Theme Component"
"StubPath"=expand:"%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll"

[Installed Components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}]
"@="Liaison de données Dynamic HTML pour Java"
"ComponentID"="TridataJava"

[Installed Components\{3af36230-a269-11d1-b5bf-0000f8051515}]
"@="Offline Browsing Pack"
"ComponentID"="MobilePk"

[Installed Components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}]
"@="Uniscribe"
"ComponentID"="USP10"

[Installed Components\{4278c270-a269-11d1-b5bf-0000f8051515}]
"@="Création avancée"
"ComponentID"="AdvAuth"

[Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
"@="Microsoft Outlook Express 6"
"ComponentID"="MailNews"
"StubPath"=expand:"\"%ProgramFiles%\Outlook Express\setup50.exe\" /APP:OE /CALLER:WINNT /user /install"

[Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
"@="NetMeeting 3.01"
"ComponentID"="NetMeeting"
"StubPath"="rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT"

[Installed Components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}]
"@="DirectShow"
"ComponentID"="activemovie"

[Installed Components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}]
"@="DirectDrawEx"
"ComponentID"="DirectDrawEx"

[Installed Components\{45ea75a0-a269-11d1-b5bf-0000f8051515}]
"@="Internet Explorer Help"
"ComponentID"="HelpCont"

[Installed Components\{4f216970-c90c-11d1-b5c7-0000f8051515}]
"@="Classes Java DirectAnimation"
"ComponentID"="DAJava"

[Installed Components\{4f645220-306d-11d2-995d-00c04f98bbc9}]
"@="Microsoft Windows Script 5.6"
"ComponentID"="MSVBScript"

[Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
"@="Windows Messenger 4.7"
"ComponentID"="Messenger"
"StubPath"="rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser"
"KeyFileName"="C:\Program Files\Messenger\msmsgs.exe"

[Installed Components\{5A8D6EE0-3E18-11D0-821E-444553540000}]
"(Default)"="Internet Connection Wizard"
"ComponentID"="ICW"

[Installed Components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}]
"@="Internet Explorer Setup Tools"
"ComponentID"="GenSetup"

[Installed Components\{630b1da0-b465-11d1-9948-00c04f98bbc9}]
"@="Browsing Enhancements"
"ComponentID"="ExtraPack"
"KeyFileName"="C:\WINDOWS\System32\msieftp.dll"

[Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
#### HKCR\CLSID\{6BF52A52-394A-11d3-B153-00C04F79FAA6}\InprocServer32 @="C:\WINDOWS\system32\wmp.dll"
"@="Microsoft Windows Media Player"
"ComponentID"="Microsoft Windows Media Player"
"StubPath"="rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp11.inf,PerUserStub"

[Installed Components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}]
"@="MSN Site Access"
"ComponentID"="MSN_Auth"

[Installed Components\{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}]
"ComponentID"=".NETFramework"
"@=".NET Framework"

[Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
"@="Carnet d'adresses 6"
"ComponentID"="WAB"
"StubPath"=expand:"\"%ProgramFiles%\Outlook Express\setup50.exe\" /APP:WAB /CALLER:WINNT /user /install"

[Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
"@="Mise à jour du Bureau Windows"
"ComponentID"="IE4Shell_NT"
"StubPath"=expand:"regsvr32.exe /s /n /i:U shell32.dll"

[Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
"@="Internet Explorer"
"ComponentID"="BASEIE40_W2K"
"StubPath"="C:\WINDOWS\system32\ie4uinit.exe -BaseSettings"

[Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\AuthorizedCDFPrefix]

[Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
"StubPath"="c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install"
"ComponentID"="DOTNETFRAMEWORKS"

[Installed Components\{9381D8F2-0288-11D0-9501-00AA00B911A5}]
"@="Dynamic HTML Data Binding"
"ComponentID"="Tridata"

[Installed Components\{B508B3F1-A24A-32C0-B310-85786919EF28}]
"ComponentID"=".NETFramework"
"@=".NET Framework"

[Installed Components\{C9E9A340-D1F1-11D0-821E-444553540600}]
"@="Internet Explorer Core Fonts"
"ComponentID"="Fontcore"

[Installed Components\{CC2A9BA0-3BDD-11D0-821E-444553540000}]
"@="Planificateur de tâches"
"ComponentID"="MSTASK"

[Installed Components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}]
"ComponentID"="Windows Movie Maker v2.1"

[Installed Components\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
"@="Adobe Flash Player"
"ComponentID"="Flash"

[Installed Components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}]
"@="HTML Help"
"ComponentID"="HTMLHelp"

[Installed Components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}]
"@="Active Directory Service Interface"
"ComponentID"="ADSI"

-----Comparing registry keys CCS1 vs CCS2 -----
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services

Result compared: Identical


-----Comparing registry keys CCS1 vs CCS3 -----
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Dhcp\Parameters {91AAE400-C6FB-46FF-94A2-A5795E2C0798} REG_BINARY 0600000000000000040000000000000001910948C0A801010300000000000000040000000000000001910948C0A801010100000000000000040000000000000001910948FFFFFF003600000000000000040000000000000001910948C0A80101350000000000000001000000000000000191094805000000FC0000000000000000000000000000008E400848330000000000000004000000000000000191094800015180
> Value: HKEY_LOCAL_MACHINE\system\controlset003\services\Dhcp\Parameters {91AAE400-C6FB-46FF-94A2-A5795E2C0798} REG_BINARY 0600000000000000040000000000000001910948C0A801010300000000000000040000000000000001910948C0A801010100000000000000040000000000000001910948FFFFFF003300000000000000040000000000000001910948000151803600000000000000040000000000000001910948C0A80101350000000000000001000000000000000191094805000000
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Eventlog\Application\ESENT EventMessageFile REG_EXPAND_SZ C:\WINDOWS\system32\ESENT.dll
> Value: HKEY_LOCAL_MACHINE\system\controlset003\services\Eventlog\Application\ESENT EventMessageFile REG_EXPAND_SZ c:\windows\system32\ESENT.dll
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Eventlog\Application\ESENT CategoryMessageFile REG_EXPAND_SZ C:\WINDOWS\system32\ESENT.dll
> Value: HKEY_LOCAL_MACHINE\system\controlset003\services\Eventlog\Application\ESENT CategoryMessageFile REG_EXPAND_SZ c:\windows\system32\ESENT.dll
> Value: HKEY_LOCAL_MACHINE\system\controlset003\services\Eventlog\Security\DS
> Value: HKEY_LOCAL_MACHINE\system\controlset003\services\Eventlog\Security\LSA
> Value: HKEY_LOCAL_MACHINE\system\controlset003\services\Eventlog\Security\NetDDE Object
> Value: HKEY_LOCAL_MACHINE\system\controlset003\services\Eventlog\Security\SC Manager
> Value: HKEY_LOCAL_MACHINE\system\controlset003\services\Eventlog\Security\Security Account Manager
> Value: HKEY_LOCAL_MACHINE\system\controlset003\services\Eventlog\Security\Spooler
> Value: HKEY_LOCAL_MACHINE\system\controlset003\services\MRxDAV\EncryptedDirectories
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\mssmbios\Data
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\SharedAccess\Epoch Epoch REG_DWORD 543 (0x21F)
> Value: HKEY_LOCAL_MACHINE\system\controlset003\services\SharedAccess\Epoch Epoch REG_DWORD 538 (0x21A)

Result compared: Different


===================== SUSPICIOUS FILES =====================
EXE and DLL files packed with runtime packers, found in: C:\; C:\WINDOWS\; C:\WINDOWS\system32\


==========================================
Scan completed in 1 minutes
End of report


~~~~~~~~~~~~~~~~~~~~~-----CREDITS-----~~~~~~~~~~~~~~~~~~~~~
SystemScan uses some freeware tools that remain property of their authors:

* SteelWerX Registry Console Tool, Who Am I (Bobby Flekman: www.xs4all.nl/~fstaal01) --> "Registry scan", "PC accounts "
* dumphive (Markus Stephany)--> "Registry scan"
* Listdlls (M.Russinovich, B.Cogswell: www.sysinternals.com) --> "Loaded modules"
* Catchme & MBR Rootkit detector (gmer: www.gmer.net) --> "Hidden objects", "Alternate Data Streams" & "Master Boot Record"
---> NOTE: SystemScan integrates "The Avenger" from Swandog46 (http://swandog46.geekstogo.com) to allow you to remove malwares found in this log

Thanks to all of them for their hard work

Re ,

Apparemment infection LOP en 04 :

O4 - HKCU\..\Run: [helpskip] C:\DOCUME~1\ADMINI~1\APPLIC~1\STARTS~1\CoalTrust.exe

******************************************************


→ Télécharge LOP S&D sur ton bureau.

Ton Anti-virus risque de gueuler pendant la procédure , ne t'inquiète pas. Désactive-le si necessaire.

→ Ensuite double clique sur LopSD.exe pour lancer l'installation. Accepte le contrat de license.

Un message va t'informer que le repertoire n'existe pas , répond ' oui ' à la question qui s'en suit.

→ Maintenant double clique sur Lop S&D ( raccourci Lop S&D présent sur le bureau).

Au menu principal, choisis l'option 1

--- Le programme va travailler ---

En fin d'analyse un rapport va apparaître , copie-en le contenu dans ta prochaine réponse.

( rapport sauvegardé aussi dans C:\lopR.txt )


(CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )


→ /!\ Si le Bureau ne réapparait pas presse Ctrl + Alt + Suppr , Onglet Fichier , Nouvelle tâche , tape explorer.exe et valide) /!\


Tutorial ( aide ) : http://bibou0007.com/outils-specifiques-f78/tuto-lop-sd-t956.htm


************************************


+++

Bien voila j'ai fais le scan avec " Lop S&D " Ensuite je vais faire la proposition , du message 5 que j'ai n'ai encor essailler , Merci a tous de m'aider .Scan de Lop S&D :


-----------------------[ Lop S&D 4.1.1-3 XP/Vista ]---------------------

[ Windows XP (NT 5.1) Build 2600, Service Pack 2 ]
[ USER : Administrateur ] [ "C:\Lop SD" ]
[ 18/04/2008 | 17:48:50,20 ] [ PC : FACHINET-XI20W4 ]
[ MAJ : 17-04-2008 | 19:51 ]

-------------[ Listing des dossiers dans Application Data ]------------

[07/04/2008|20:58] C:\DOCUME~1\ADMINI~1\APPLIC~1\.
[07/04/2008|20:58] C:\DOCUME~1\ADMINI~1\APPLIC~1\..
[17/02/2008|19:28] C:\DOCUME~1\ADMINI~1\APPLIC~1\Adobe
[21/03/2008|20:33] C:\DOCUME~1\ADMINI~1\APPLIC~1\ATI
[17/04/2008|17:58] C:\DOCUME~1\ADMINI~1\APPLIC~1\BitTorrent
[17/04/2008|21:23] C:\DOCUME~1\ADMINI~1\APPLIC~1\BSplayer
[07/04/2008|20:58] C:\DOCUME~1\ADMINI~1\APPLIC~1\BSplayer Pro
[17/02/2008|18:23] C:\DOCUME~1\ADMINI~1\APPLIC~1\desktop.ini
[07/04/2008|20:55] C:\DOCUME~1\ADMINI~1\APPLIC~1\DivX
[18/04/2008|17:39] C:\DOCUME~1\ADMINI~1\APPLIC~1\DNA
[17/02/2008|18:42] C:\DOCUME~1\ADMINI~1\APPLIC~1\Identities
[24/03/2008|14:48] C:\DOCUME~1\ADMINI~1\APPLIC~1\ma-config.com
[17/02/2008|19:28] C:\DOCUME~1\ADMINI~1\APPLIC~1\Macromedia
[22/03/2008|00:10] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft
[17/04/2008|19:50] C:\DOCUME~1\ADMINI~1\APPLIC~1\OpenOffice.org2
[30/03/2008|22:01] C:\DOCUME~1\ADMINI~1\APPLIC~1\START SIZE ACID
[29/03/2008|22:04] C:\DOCUME~1\ADMINI~1\APPLIC~1\Sun
[17/02/2008|21:33] C:\DOCUME~1\ADMINI~1\APPLIC~1\WinRAR

[30/03/2008|22:01] C:\DOCUME~1\ALLUSE~1\APPLIC~1\.
[30/03/2008|22:01] C:\DOCUME~1\ALLUSE~1\APPLIC~1\..
[21/03/2008|20:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ATI
[30/03/2008|22:01] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Bags Plus Online Chin
[17/02/2008|18:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\desktop.ini
[17/02/2008|20:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Downloaded Installations
[22/02/2008|19:30] C:\DOCUME~1\ALLUSE~1\APPLIC~1\DVD X Studios
[17/02/2008|21:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
[21/03/2008|09:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[24/03/2008|15:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\sentinel
[17/02/2008|20:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
[21/03/2008|09:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller

[17/02/2008|18:23] C:\DOCUME~1\DEFAUL~1\APPLIC~1\.
[17/02/2008|18:23] C:\DOCUME~1\DEFAUL~1\APPLIC~1\..
[17/02/2008|18:23] C:\DOCUME~1\DEFAUL~1\APPLIC~1\desktop.ini
[17/02/2008|18:35] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

[17/02/2008|18:42] C:\DOCUME~1\LOCALS~1\APPLIC~1\.
[17/02/2008|18:42] C:\DOCUME~1\LOCALS~1\APPLIC~1\..
[17/02/2008|20:50] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

[17/02/2008|18:42] C:\DOCUME~1\NETWOR~1\APPLIC~1\.
[17/02/2008|18:42] C:\DOCUME~1\NETWOR~1\APPLIC~1\..
[17/02/2008|18:35] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

----------------[ Tâches planifiées dans C:\WINDOWS\tasks ]---------------

[18/04/2008 17:00][--ah-----] C:\WINDOWS\tasks\AEFE82069305342E.job
[18/04/2008 08:28][--ah-----] C:\WINDOWS\tasks\SA.DAT
[28/08/2001 14:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini

---------------[ Listing des dossiers dans C:\Program Files ]--------------

[18/04/2008|17:28] C:\Program Files\.
[18/04/2008|17:28] C:\Program Files\..
[17/02/2008|22:08] C:\Program Files\Alwil Software
[21/03/2008|19:08] C:\Program Files\ATI Technologies
[21/02/2008|23:12] C:\Program Files\BitTorrent
[30/03/2008|22:00] C:\Program Files\Circle Developement
[17/02/2008|21:37] C:\Program Files\C-Media 3D Audio
[20/03/2008|23:40] C:\Program Files\Common Files
[17/02/2008|18:33] C:\Program Files\ComPlus Applications
[17/02/2008|20:38] C:\Program Files\DirectX
[07/04/2008|20:54] C:\Program Files\DivX
[21/02/2008|23:12] C:\Program Files\DNA
[18/04/2008|08:33] C:\Program Files\eMule
[29/03/2008|22:04] C:\Program Files\Fichiers communs
[27/03/2008|21:52] C:\Program Files\Gpotato.eu
[29/03/2008|10:14] C:\Program Files\Guitar Pro 5
[24/03/2008|14:59] C:\Program Files\InstallShield Installation Information
[12/04/2008|18:01] C:\Program Files\Internet Explorer
[29/03/2008|22:05] C:\Program Files\Java
[21/03/2008|18:55] C:\Program Files\ma-config.com
[17/02/2008|21:43] C:\Program Files\Messenger
[30/03/2008|22:00] C:\Program Files\Messenger Plus! Live
[17/02/2008|18:36] C:\Program Files\microsoft frontpage
[17/02/2008|20:23] C:\Program Files\Movie Maker
[17/02/2008|18:32] C:\Program Files\MSN
[17/02/2008|18:32] C:\Program Files\MSN Gaming Zone
[17/02/2008|20:22] C:\Program Files\NetMeeting
[30/03/2008|18:47] C:\Program Files\OpenOffice.org 2.4
[17/02/2008|21:42] C:\Program Files\Outlook Express
[19/02/2008|20:13] C:\Program Files\PKR
[21/03/2008|21:36] C:\Program Files\Realtek AC97
[17/02/2008|18:32] C:\Program Files\Services en ligne
[22/03/2008|15:51] C:\Program Files\sisagp
[30/03/2008|22:00] C:\Program Files\START SIZE ACID
[18/04/2008|17:28] C:\Program Files\Trend Micro
[17/02/2008|18:42] C:\Program Files\Uninstall Information
[23/02/2008|20:41] C:\Program Files\Valve
[21/03/2008|19:16] C:\Program Files\VIA
[17/04/2008|21:23] C:\Program Files\Webteh
[21/03/2008|09:18] C:\Program Files\Windows Live
[17/02/2008|20:46] C:\Program Files\Windows Media Connect 2
[17/02/2008|21:43] C:\Program Files\Windows Media Player
[17/02/2008|20:22] C:\Program Files\Windows NT
[17/02/2008|20:30] C:\Program Files\WindowsUpdate
[17/02/2008|21:30] C:\Program Files\WinRAR
[17/02/2008|18:36] C:\Program Files\xerox

------[ Listing des dossiers dans C:\Program Files\Fichiers communs ]------

[29/03/2008|22:04] C:\Program Files\Fichiers communs\.
[29/03/2008|22:04] C:\Program Files\Fichiers communs\..
[17/02/2008|21:36] C:\Program Files\Fichiers communs\InstallShield
[29/03/2008|22:04] C:\Program Files\Fichiers communs\Java
[21/03/2008|09:18] C:\Program Files\Fichiers communs\Microsoft Shared
[17/02/2008|18:33] C:\Program Files\Fichiers communs\MSSoap
[17/02/2008|18:24] C:\Program Files\Fichiers communs\ODBC
[01/04/2008|16:29] C:\Program Files\Fichiers communs\Panda Software
[17/02/2008|18:33] C:\Program Files\Fichiers communs\Services
[17/02/2008|18:24] C:\Program Files\Fichiers communs\SpeechEngines
[17/02/2008|21:42] C:\Program Files\Fichiers communs\System
[21/03/2008|09:18] C:\Program Files\Fichiers communs\WindowsLiveInstaller

----------------------[ Recherche avec S_Lop ]---------------------

C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\bis4E.exe

-----------------[ Recherche de Fichiers / Dossiers Lop ]-----------------

C:\DOCUME~1\ALLUSE~1\APPLIC~1\Bags Plus Online Chin
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Bags Plus Online Chin\phone seek.exe
C:\Program Files\Circle Developement
C:\Program Files\Circle Developement\Uninstall.exe
C:\WINDOWS\Tasks\AEFE82069305342E.job

----------------------[ Verification du Registre ]----------------------

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Online chin internet bolt"="C:\\Documents and Settings\\All Users\\Application Data\\Bags Plus Online Chin\\phone seek.exe"

--------------------[ Verification du fichier Hosts ]---------------------

Fichier Hosts PROPRE


----------------[ Recherche de fichiers avec Catchme ]-----------------

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-18 17:54:10
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 0

--------------------[ Recherche d'autres infections ]---------------------

Aucune autre infection trouvée !

/!\ [Fich:997][Doss:24] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp
/!\ [Fich:209][Doss:0] C:\DOCUME~1\ADMINI~1\Cookies
/!\ [Fich:1679][Doss:5] C:\DOCUME~1\ADMINI~1\LOCALS~1\TEMPOR~1\content.IE5

--------------------[ Fin du rapport a 17:57:16,76 ]----------------------
Il est 17 h 57 min , mon virus va apparaitre à 18 h souhaiter vous que je face quelque chose de special tant qu'il est là ou je ne rejette pour l'instant comme précedemment ?

Re ,
Touche à rien stp.

**************************

Relance Lop S&D

> option2 ( suppression )

Et poste le rapport obtenu.

( rapport situé dans C:\lopR.txt )


(CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

************************

Reposte un rapport Hijackthis.

++

Voila le 2eme rapport en option 2 .Lors de mon rapport et mon anti virus a reperer un CHEVAL DE TROIE !!!!! dans :

C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ugdqlpke-X120w4

Voici mon 2eme rapport :


-----------------------[ Lop S&D 4.1.1-3 XP/Vista ]---------------------

[ Windows XP (NT 5.1) Build 2600, Service Pack 2 ]
[ USER : Administrateur ] [ "C:\Lop SD" ]
[ 18/04/2008 | 18:03:47,90 ] [ PC : FACHINET-XI20W4 ]
[ MAJ : 17-04-2008 | 19:51 ]

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ SUPPRESSION /////////////////////////////

Supprimé! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\Bags Plus Online Chin\phone seek.exe
Supprimé! - C:\Program Files\Circle Developement\Uninstall.exe
Supprimé! - C:\WINDOWS\Tasks\AEFE82069305342E.job
Supprimé! - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\bis4E.exe
Supprimé! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\Bags Plus Online Chin
Supprimé! - C:\Program Files\Circle Developement

//////////////////////////////////////-\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\


-------------[ Listing des dossiers dans Application Data ]------------

[07/04/2008|20:58] C:\DOCUME~1\ADMINI~1\APPLIC~1\.
[07/04/2008|20:58] C:\DOCUME~1\ADMINI~1\APPLIC~1\..
[17/02/2008|19:28] C:\DOCUME~1\ADMINI~1\APPLIC~1\Adobe
[21/03/2008|20:33] C:\DOCUME~1\ADMINI~1\APPLIC~1\ATI
[17/04/2008|17:58] C:\DOCUME~1\ADMINI~1\APPLIC~1\BitTorrent
[17/04/2008|21:23] C:\DOCUME~1\ADMINI~1\APPLIC~1\BSplayer
[07/04/2008|20:58] C:\DOCUME~1\ADMINI~1\APPLIC~1\BSplayer Pro
[17/02/2008|18:23] C:\DOCUME~1\ADMINI~1\APPLIC~1\desktop.ini
[07/04/2008|20:55] C:\DOCUME~1\ADMINI~1\APPLIC~1\DivX
[18/04/2008|17:59] C:\DOCUME~1\ADMINI~1\APPLIC~1\DNA
[17/02/2008|18:42] C:\DOCUME~1\ADMINI~1\APPLIC~1\Identities
[24/03/2008|14:48] C:\DOCUME~1\ADMINI~1\APPLIC~1\ma-config.com
[17/02/2008|19:28] C:\DOCUME~1\ADMINI~1\APPLIC~1\Macromedia
[22/03/2008|00:10] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft
[17/04/2008|19:50] C:\DOCUME~1\ADMINI~1\APPLIC~1\OpenOffice.org2
[30/03/2008|22:01] C:\DOCUME~1\ADMINI~1\APPLIC~1\START SIZE ACID
[29/03/2008|22:04] C:\DOCUME~1\ADMINI~1\APPLIC~1\Sun
[17/02/2008|21:33] C:\DOCUME~1\ADMINI~1\APPLIC~1\WinRAR

[18/04/2008|18:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\.
[18/04/2008|18:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\..
[21/03/2008|20:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ATI
[17/02/2008|18:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\desktop.ini
[17/02/2008|20:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Downloaded Installations
[22/02/2008|19:30] C:\DOCUME~1\ALLUSE~1\APPLIC~1\DVD X Studios
[17/02/2008|21:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
[21/03/2008|09:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[24/03/2008|15:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\sentinel
[17/02/2008|20:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
[21/03/2008|09:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller

[17/02/2008|18:23] C:\DOCUME~1\DEFAUL~1\APPLIC~1\.
[17/02/2008|18:23] C:\DOCUME~1\DEFAUL~1\APPLIC~1\..
[17/02/2008|18:23] C:\DOCUME~1\DEFAUL~1\APPLIC~1\desktop.ini
[17/02/2008|18:35] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

[17/02/2008|18:42] C:\DOCUME~1\LOCALS~1\APPLIC~1\.
[17/02/2008|18:42] C:\DOCUME~1\LOCALS~1\APPLIC~1\..
[17/02/2008|20:50] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

[17/02/2008|18:42] C:\DOCUME~1\NETWOR~1\APPLIC~1\.
[17/02/2008|18:42] C:\DOCUME~1\NETWOR~1\APPLIC~1\..
[17/02/2008|18:35] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

----------------[ Tâches planifiées dans C:\WINDOWS\tasks ]---------------

[18/04/2008 08:28][--ah-----] C:\WINDOWS\tasks\SA.DAT
[28/08/2001 14:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini

---------------[ Listing des dossiers dans C:\Program Files ]--------------

[18/04/2008|18:03] C:\Program Files\.
[18/04/2008|18:03] C:\Program Files\..
[17/02/2008|22:08] C:\Program Files\Alwil Software
[21/03/2008|19:08] C:\Program Files\ATI Technologies
[21/02/2008|23:12] C:\Program Files\BitTorrent
[17/02/2008|21:37] C:\Program Files\C-Media 3D Audio
[20/03/2008|23:40] C:\Program Files\Common Files
[17/02/2008|18:33] C:\Program Files\ComPlus Applications
[17/02/2008|20:38] C:\Program Files\DirectX
[07/04/2008|20:54] C:\Program Files\DivX
[21/02/2008|23:12] C:\Program Files\DNA
[18/04/2008|08:33] C:\Program Files\eMule
[29/03/2008|22:04] C:\Program Files\Fichiers communs
[27/03/2008|21:52] C:\Program Files\Gpotato.eu
[29/03/2008|10:14] C:\Program Files\Guitar Pro 5
[24/03/2008|14:59] C:\Program Files\InstallShield Installation Information
[12/04/2008|18:01] C:\Program Files\Internet Explorer
[29/03/2008|22:05] C:\Program Files\Java
[21/03/2008|18:55] C:\Program Files\ma-config.com
[17/02/2008|21:43] C:\Program Files\Messenger
[30/03/2008|22:00] C:\Program Files\Messenger Plus! Live
[17/02/2008|18:36] C:\Program Files\microsoft frontpage
[17/02/2008|20:23] C:\Program Files\Movie Maker
[17/02/2008|18:32] C:\Program Files\MSN
[17/02/2008|18:32] C:\Program Files\MSN Gaming Zone
[17/02/2008|20:22] C:\Program Files\NetMeeting
[30/03/2008|18:47] C:\Program Files\OpenOffice.org 2.4
[17/02/2008|21:42] C:\Program Files\Outlook Express
[19/02/2008|20:13] C:\Program Files\PKR
[21/03/2008|21:36] C:\Program Files\Realtek AC97
[17/02/2008|18:32] C:\Program Files\Services en ligne
[22/03/2008|15:51] C:\Program Files\sisagp
[30/03/2008|22:00] C:\Program Files\START SIZE ACID
[18/04/2008|17:28] C:\Program Files\Trend Micro
[17/02/2008|18:42] C:\Program Files\Uninstall Information
[23/02/2008|20:41] C:\Program Files\Valve
[21/03/2008|19:16] C:\Program Files\VIA
[17/04/2008|21:23] C:\Program Files\Webteh
[21/03/2008|09:18] C:\Program Files\Windows Live
[17/02/2008|20:46] C:\Program Files\Windows Media Connect 2
[17/02/2008|21:43] C:\Program Files\Windows Media Player
[17/02/2008|20:22] C:\Program Files\Windows NT
[17/02/2008|20:30] C:\Program Files\WindowsUpdate
[17/02/2008|21:30] C:\Program Files\WinRAR
[17/02/2008|18:36] C:\Program Files\xerox

------[ Listing des dossiers dans C:\Program Files\Fichiers communs ]------

[29/03/2008|22:04] C:\Program Files\Fichiers communs\.
[29/03/2008|22:04] C:\Program Files\Fichiers communs\..
[17/02/2008|21:36] C:\Program Files\Fichiers communs\InstallShield
[29/03/2008|22:04] C:\Program Files\Fichiers communs\Java
[21/03/2008|09:18] C:\Program Files\Fichiers communs\Microsoft Shared
[17/02/2008|18:33] C:\Program Files\Fichiers communs\MSSoap
[17/02/2008|18:24] C:\Program Files\Fichiers communs\ODBC
[01/04/2008|16:29] C:\Program Files\Fichiers communs\Panda Software
[17/02/2008|18:33] C:\Program Files\Fichiers communs\Services
[17/02/2008|18:24] C:\Program Files\Fichiers communs\SpeechEngines
[17/02/2008|21:42] C:\Program Files\Fichiers communs\System
[21/03/2008|09:18] C:\Program Files\Fichiers communs\WindowsLiveInstaller

----------------------[ Recherche avec S_Lop ]---------------------

Aucun fichier / dossier Lop trouvé !

-----------------[ Recherche de Fichiers / Dossiers Lop ]-----------------

Aucun fichier / dossier Lop trouvé !

----------------------[ Verification du Registre ]----------------------

..... OK !

--------------------[ Verification du fichier Hosts ]---------------------

Fichier Hosts PROPRE


----------------[ Recherche de fichiers avec Catchme ]-----------------

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-18 18:06:14
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 0

--------------------[ Recherche d'autres infections ]---------------------

Aucune autre infection trouvée !

/!\ [Fich:992][Doss:24] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp
/!\ [Fich:209][Doss:0] C:\DOCUME~1\ADMINI~1\Cookies
/!\ [Fich:1724][Doss:5] C:\DOCUME~1\ADMINI~1\LOCALS~1\TEMPOR~1\content.IE5

--------------------[ Fin du rapport a 18:07:31,07 ]----------------------

Aussi j'ai fait la solution du message 5 et non il n'y a rien ce n'est pas là d'ou vien le problem .Merci quand meme de s'etre proposer .

Re ,

Rapport Hijackthis stp.

++

Le voici , et je vous rassure j'ai bien fermé toute les fenetre internet que je voyais sur mon bureau

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:16:57, on 18/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\RunDll32.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
C:\Program Files\DNA\btdna.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\SYSTEM32\taskmgr.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Alwil Software\Avast4\ashChest.exe
C:\Program Files\Trend Micro\HijackThis\HJT.exe\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [helpskip] C:\DOCUME~1\ADMINI~1\APPLIC~1\STARTS~1\CoalTrust.exe
O4 - HKCU\..\Run: [AdVantage] "C:\Program Files\AdVantage\AdVantage.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\npjpi160_04.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\npjpi160_04.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

HUMMMMM je vien de remarquer que le virus n'est plus present dans "mes processus actif " alors que je n'ai rien fait ,le
problem est t'il resolu . Quoi qu'il en soit la source vien probablement meme surment du " cheval de troie " aurriez vous
les informations sur tout les fichier infecté ?et de quel manière les supprimer ,je pense que ce ne doit pas etre aussi
simple que supprimer un fichier normal .

Re , !

/!\ Manip crée spécialement pour cet utilisateur , ne pas reproduire chez soi ... /!\


1)Télécharge OTMoveIt2 ( de Old Timer )

2)Une fois téléchargé double-clique sur OTMoveIt2.exe pour le lancer.

Assure toi que la case Unregister Dll's and Ocx's soit bien cochée

3)puis copie les lignes en gras qui se trouvent en dessous :

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\helpskip
C:\DOCUME~1\ADMINI~1\APPLIC~1\STARTS~1\CoalTrust.exe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\AdVantage
C:\Program Files\AdVantage


et colle-les dans le cadre de gauche de OTMoveIt : "Paste List Of Files/Folders to Move."
clique sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre Results.
clique sur Exit pour fermer.
4) Poste le rapport situé dans C:\_OTMoveIt\MovedFiles.


(CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

5) Il te sera peut-être demander de redémarrer le pc pour achever la suppression -> Accepte ( si il ne fait pas automatiquement , fait-le toi même )

/!\ Note : Au démarrage ton bureau RISQUE de ne plus apparaître , dans ce cas fait --> CTRL+ALT+SUPP pour ouvrir le Gestionnaire des tâches.
Puis rends toi à l'onglet "Processus". Clique en haut à gauche sur Fichiers et choisis "Exécuter"

Tape explorer.exe et valide. Cela fera re-apparaître le Bureau.

*********************************

+ un nouveau rapport Hijackthis.

++

voici ce que tu m'as demandé maintenant je redemarre

< HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\helpskip >
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\helpskip not found.
C:\DOCUME~1\ADMINI~1\APPLIC~1\STARTS~1\CoalTrust.exe moved successfully.
< HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\AdVantage >
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\AdVantage not found.
File/Folder C:\Program Files\AdVantage not found.

OTMoveIt2 by OldTimer - Version 1.0.4.1 log created on 04182008_182853