Virus , worms et troyans
knobi -  
Bonjour,
je viens de recupere l'ordi de mes parents et j'ai decider de faire un petit check avec avast et voila ce qui et sorti
Win32:Cloaker [Cryp]
Win32:InMorph [Cryp]
Win32:Adware-gen [Adw]
Win32:Adware-gen [Adw]
Win32:InMorph [Cryp]
Win32:Swizzor-gen [Trj]
Win32:Rootkit-gen [Rtk]
MPPT97:CVE-2006-0009 [Expl]
ceci et une liste des alertes je vous joint une liste du log file de hijackthis
je debute dans celi et ne sais donc pas quoi faire pouriiez vous maider sil vous plais
merci d'avance

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:36:41, on 06/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\svchost.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\WINDOWS\system32\hphmon05.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsoemon.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Apps\EZHome\EZStatus.exe
C:\Program Files\Fichiers communs\DataViz\DvzIncMsgr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.apple.com/itunes/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\2.bin\MWSSRCAS.DLL
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\2.bin\MWSSRCAS.DLL
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\2.bin\MWSBAR.DLL
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - c:\apps\skype\phone\IEPlugin\SKYPEI~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {AC56D8FF-9B9F-A13F-3F08-F9DDD7024174} - (no file)
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: My &Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\2.bin\MWSBAR.DLL
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsoemon.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [My Web Search Bar Search Scope Monitor] "C:\PROGRA~1\MYWEBS~1\bar\2.bin\m3SrchMn.exe" /m=0
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [EzStatus] C:\Apps\EZHome\EZStatus.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: DataViz Inc Messenger.lnk = C:\Program Files\Fichiers communs\DataViz\DvzIncMsgr.exe
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZN
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\apps\skype\phone\IEPlugin\SKYPEI~1.DLL
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\MATHILDE\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/ZwinkyInitialSetup1.0.0.15.cab
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {A1F2F2CE-06AF-483C-9F12-D3BAA72477D6} (BatchDownloader Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/DigWXMSN.cab
O16 - DPF: {A73BAEFA-EE65-494D-BEDB-DD3E5A34FA98} (Image Uploader) - http://www.extrafilm.fr/ImageUploader4.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{46875C85-3A6B-43B4-923F-ABA01E9F2193}: NameServer = 192.168.1.1,192.168.1.2
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MysqlInventime - Unknown owner - c:\mysql\bin\mysqld-nt.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe

--
End of file - 13195 bytes
Configuration: Windows XP
Internet Explorer 7.0

12 réponses

  1. jlpjlp Contributeur sécurité
    slt

    si tu as norton et avast, vire avast sinon l'ordi va planter!

    ______________

    lance cwshredder (faire fix) en allant sur un des liens suivants:

    https://www.trendmicro.com/en_us/forHome.html
    https://www.01net.com/actualites/
    https://www.01net.com/telecharger/windows/Securite/anti-spyware/fiches/27497.html
    ______________

    Télécharge Combofix de sUBs : Renomme le avant toute installation, par exemple, nomme le "KillBagle". aide ici : https://forum.pcastuces.com/sujet.asp?f=25&s=37315

    http://download.bleepingcomputer.com/sUBs/ComboFix.exe
    Sauvegarde le sur ton bureau et pas ailleurs !

    Aide à l’utilisation de combofix ici: https://bibou0007.forumpro.fr/login?redirect=%2Ft121-topic

    Double-clic sur combofix, Il va te poser une question, réponds par la touche 1 et entrée pour valider, laisse toi guider.
    Attends que combofix ait terminé, un rapport sera créé. Poste le rapport.

    _______________

    scan avec
    MalwareByte's Anti-Malware et vire ce qui est trouvé et colle le rapport

    https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

    _________________

    Télécharge ceci: (by Moe) :

    http://sosvirus.changelog.fr/Green_day/Lopxpsetup.exe

    Double clic sur Lopxpsetup.exe pour lancer l'installation
    Au menu, choisir l'option 1
    Patienter jusqu'à que l'on demande d'appuyer sur une touche, appuyer !
    Une rapport sera alors crée, à copie/colle en entier sur le forum.
    __________________
    recolle un nouveau rapport hijackhtis

    a plus
    0
    1. knobi Auteur
      voiici les rapport dans l'orde

      ComboFix 08-05-01.3 - ben 2008-05-06 16:14:55.1 - NTFSx86
      Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.1454 [GMT 2:00]
      Endroit: C:\Documents and Settings\ben\Bureau\Combo-Fix.exe
      * Création d'un nouveau point de restauration
      .

      (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
      .

      C:\Program Files\FunWebProducts
      C:\Program Files\FunWebProducts\ScreenSaver\Images\[u]0/u057096E.urr
      C:\Program Files\FunWebProducts\ScreenSaver\Images\[u]0/u152EE6B.urr
      C:\Program Files\FunWebProducts\Shared\[u]0/u14DEC8E.dat
      C:\Program Files\FunWebProducts\Shared\Cache\AvatarSmallBtn.html
      C:\Program Files\FunWebProducts\Shared\Cache\CursorManiaBtn.html
      C:\Program Files\FunWebProducts\Shared\Cache\FunBuddyIconBtn.html
      C:\Program Files\FunWebProducts\Shared\Cache\MailStampBtn.html
      C:\Program Files\FunWebProducts\Shared\Cache\MyFunCardsIMBtn.html
      C:\Program Files\FunWebProducts\Shared\Cache\MyStationeryBtn.html
      C:\Program Files\FunWebProducts\Shared\Cache\SmileyCentralBtn.html
      C:\Program Files\internet explorer\msimg32.dll
      C:\Program Files\MyWebSearch
      C:\Program Files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL
      C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
      C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
      C:\Program Files\MyWebSearch\bar\1.bin\MWSOEPLG.DLL
      C:\Program Files\MyWebSearch\bar\1.bin\MWSOESTB.DLL
      C:\Program Files\MyWebSearch\bar\2.bin\F3BKGERR.JPG
      C:\Program Files\MyWebSearch\bar\2.bin\F3BROVLY.DLL
      C:\Program Files\MyWebSearch\bar\2.bin\F3CJPEG.DLL
      C:\Program Files\MyWebSearch\bar\2.bin\F3DTACTL.DLL
      C:\Program Files\MyWebSearch\bar\2.bin\F3HISTSW.DLL
      C:\Program Files\MyWebSearch\bar\2.bin\F3HTMLMU.DLL
      C:\Program Files\MyWebSearch\bar\2.bin\F3HTTPCT.DLL
      C:\Program Files\MyWebSearch\bar\2.bin\F3IMSTUB.DLL
      C:\Program Files\MyWebSearch\bar\2.bin\F3POPSWT.DLL
      C:\Program Files\MyWebSearch\bar\2.bin\F3PSSAVR.SCR
      C:\Program Files\MyWebSearch\bar\2.bin\F3REPROX.DLL
      C:\Program Files\MyWebSearch\bar\2.bin\F3RESTUB.DLL
      C:\Program Files\MyWebSearch\bar\2.bin\F3SCHMON.EXE
      C:\Program Files\MyWebSearch\bar\2.bin\F3SCRCTR.DLL
      C:\Program Files\MyWebSearch\bar\2.bin\F3SHLLVW.DLL
      C:\Program Files\MyWebSearch\bar\2.bin\F3SPACER.WMV
      C:\Program Files\MyWebSearch\bar\2.bin\F3WALLPP.DAT
      C:\Program Files\MyWebSearch\bar\2.bin\F3WPHOOK.DLL
      C:\Program Files\MyWebSearch\bar\2.bin\M3FFXTBR.JAR
      C:\Program Files\MyWebSearch\bar\2.bin\M3FFXTBR.MANIFEST
      C:\Program Files\MyWebSearch\bar\2.bin\M3HTML.DLL
      C:\Program Files\MyWebSearch\bar\2.bin\M3IDLE.DLL
      C:\Program Files\MyWebSearch\bar\2.bin\M3IMPIPE.EXE
      C:\Program Files\MyWebSearch\bar\2.bin\M3MSG.DLL
      C:\Program Files\MyWebSearch\bar\2.bin\M3NTSTBR.JAR
      C:\Program Files\MyWebSearch\bar\2.bin\M3NTSTBR.MANIFEST
      C:\Program Files\MyWebSearch\bar\2.bin\M3OUTLCN.DLL
      C:\Program Files\MyWebSearch\bar\2.bin\M3PLUGIN.DLL
      C:\Program Files\MyWebSearch\bar\2.bin\M3SKIN.DLL
      C:\Program Files\MyWebSearch\bar\2.bin\M3SKPLAY.EXE
      C:\Program Files\MyWebSearch\bar\2.bin\M3SLSRCH.EXE
      C:\Program Files\MyWebSearch\bar\2.bin\MWSBAR.DLL
      C:\Program Files\MyWebSearch\bar\2.bin\MWSOEMON.EXE
      C:\Program Files\MyWebSearch\bar\2.bin\MWSOEPLG.DLL
      C:\Program Files\MyWebSearch\bar\2.bin\MWSOESTB.DLL
      C:\Program Files\MyWebSearch\bar\2.bin\NPMYWEBS.DLL
      C:\Program Files\MyWebSearch\bar\Avatar\COMMON.F3S
      C:\Program Files\MyWebSearch\bar\Avatar\COMMON\avatar.htm
      C:\Program Files\MyWebSearch\bar\Avatar\COMMON\bgfadel.gif
      C:\Program Files\MyWebSearch\bar\Avatar\COMMON\bgfader.gif
      C:\Program Files\MyWebSearch\bar\Avatar\COMMON\close.gif
      C:\Program Files\MyWebSearch\bar\Avatar\COMMON\common-x.css
      C:\Program Files\MyWebSearch\bar\Avatar\COMMON\common.css
      C:\Program Files\MyWebSearch\bar\Avatar\COMMON\cornerbl.gif
      C:\Program Files\MyWebSearch\bar\Avatar\COMMON\cornerbr.gif
      C:\Program Files\MyWebSearch\bar\Avatar\COMMON\htmlctrl.js
      C:\Program Files\MyWebSearch\bar\Avatar\COMMON\include.js
      C:\Program Files\MyWebSearch\bar\Avatar\COMMON\index.htm
      C:\Program Files\MyWebSearch\bar\Avatar\COMMON\loading.gif
      C:\Program Files\MyWebSearch\bar\Avatar\COMMON\login.htm
      C:\Program Files\MyWebSearch\bar\Avatar\COMMON\logo.gif
      C:\Program Files\MyWebSearch\bar\Avatar\COMMON\max.gif
      C:\Program Files\MyWebSearch\bar\Avatar\COMMON\min.gif
      C:\Program Files\MyWebSearch\bar\Avatar\COMMON\noflash.htm
      C:\Program Files\MyWebSearch\bar\Avatar\COMMON\spacer.gif
      C:\Program Files\MyWebSearch\bar\Avatar\COMMON\spacer.swf
      C:\Program Files\MyWebSearch\bar\Avatar\COMMON\unmax.gif
      C:\Program Files\MyWebSearch\bar\Avatar\COMMON\wardrobe.htm
      C:\Program Files\MyWebSearch\bar\Avatar\COMMON\window.ico
      C:\Program Files\MyWebSearch\bar\Cache\[u]0/u0061ADD
      C:\Program Files\MyWebSearch\bar\Cache\[u]0/u020E12C.bin
      C:\Program Files\MyWebSearch\bar\Cache\[u]0/u020E488.bin
      C:\Program Files\MyWebSearch\bar\Cache\[u]0/u020E61E.bin
      C:\Program Files\MyWebSearch\bar\Cache\[u]0/u0393013
      C:\Program Files\MyWebSearch\bar\Cache\[u]0/u0C4F052.bin
      C:\Program Files\MyWebSearch\bar\Cache\[u]0/u1274D98.bin
      C:\Program Files\MyWebSearch\bar\Cache\[u]0/u1274F5D.bin
      C:\Program Files\MyWebSearch\bar\Cache\[u]0/u1275132.bin
      C:\Program Files\MyWebSearch\bar\Cache\[u]0/u12752E7
      C:\Program Files\MyWebSearch\bar\Cache\[u]0/u1455844
      C:\Program Files\MyWebSearch\bar\Cache\[u]0/u14559AC.bin
      C:\Program Files\MyWebSearch\bar\Cache\[u]0/u1455C5B.bin
      C:\Program Files\MyWebSearch\bar\Cache\[u]0/u1456072.bin
      C:\Program Files\MyWebSearch\bar\Cache\[u]0/u14561CA.bin
      C:\Program Files\MyWebSearch\bar\Cache\[u]0/u149783D.bin
      C:\Program Files\MyWebSearch\bar\Cache\[u]0/u14979E2.bin
      C:\Program Files\MyWebSearch\bar\Cache\[u]0/u1497BA8.bin
      C:\Program Files\MyWebSearch\bar\Cache\[u]0/u1497CFF.bin
      C:\Program Files\MyWebSearch\bar\Cache\[u]0/u16A4BFC
      C:\Program Files\MyWebSearch\bar\Cache\[u]0/u16A5468.bin
      C:\Program Files\MyWebSearch\bar\Cache\[u]0/u16A56BA.bin
      C:\Program Files\MyWebSearch\bar\Cache\[u]0/u16A58AE.bin
      C:\Program Files\MyWebSearch\bar\Cache\[u]0/u16A5AB2.bin
      C:\Program Files\MyWebSearch\bar\Cache\[u]0/u16A62FF.bin
      C:\Program Files\MyWebSearch\bar\Cache\[u]0/u16A657F.bin
      C:\Program Files\MyWebSearch\bar\Cache\[u]0/u16A6706.bin
      C:\Program Files\MyWebSearch\bar\Cache\[u]0/u184EC25.bin
      C:\Program Files\MyWebSearch\bar\Cache\[u]0/u54691AA
      C:\Program Files\MyWebSearch\bar\Cache\files.ini
      C:\Program Files\MyWebSearch\bar\Game\CHECKERS.F3S
      C:\Program Files\MyWebSearch\bar\Game\CHESS.F3S
      C:\Program Files\MyWebSearch\bar\Game\REVERSI.F3S
      C:\Program Files\MyWebSearch\bar\History\search2
      C:\Program Files\MyWebSearch\bar\Search\COMMON.F3S
      C:\Program Files\MyWebSearch\bar\Settings\prevcfg2.htm
      C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat
      C:\Program Files\MyWebSearch\bar\Settings\setting2.htm
      C:\Program Files\MyWebSearch\bar\Settings\setting2.htm.bak
      C:\Program Files\MyWebSearch\bar\Settings\settings.dat
      C:\Program Files\MyWebSearch\bar\Settings\settings.dat.bak
      C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
      C:\Program Files\MyWebSearch\SrchAstt\2.bin\MWSSRCAS.DLL
      C:\Program Files\webmediaplayer
      C:\Program Files\webmediaplayer\resources\languages.xml
      C:\Program Files\webmediaplayer\resources\webmedias
      C:\Program Files\webmediaplayer\skins\classic.skn
      C:\Program Files\webmediaplayer\sqlite3.dll
      C:\Program Files\webmediaplayer\uninst.exe
      C:\Program Files\webmediaplayer\WebMediaPlayer.url
      C:\WINDOWS\pack.epk
      C:\WINDOWS\system32\f3PSSavr.scr
      C:\WINDOWS\system32\nvs2.inf
      c:\WINDOWS\system32\xdbnohu.dat
      C:\WINDOWS\system32\xdbnohu.exe
      c:\WINDOWS\system32\xdbnohu_nav.dat
      c:\WINDOWS\system32\xdbnohu_navps.dat
      c:\WINDOWS\system32\xdbnohu_navup.dat

      .
      ((((((((((((((((((((((((((((( Fichiers créés 2008-04-06 to 2008-05-06 ))))))))))))))))))))))))))))))))))))
      .

      2008-05-06 10:05 . 2008-05-06 10:05 54,156 --ah----- C:\WINDOWS\QTFont.qfn
      2008-05-06 10:05 . 2008-05-06 10:05 1,409 --a------ C:\WINDOWS\QTFont.for
      2008-05-05 19:48 . 2008-05-05 19:48 <REP> d-------- C:\Program Files\Trend Micro
      2008-05-04 21:57 . 2008-05-04 21:57 <REP> d-------- C:\Program Files\Alwil Software
      2008-05-04 21:43 . 2008-05-04 21:44 <REP> d-------- C:\Program Files\Windows Defender
      2008-04-20 17:24 . 2008-04-20 17:24 <REP> d-------- C:\Program Files\TVUPlayer
      2008-04-20 17:24 . 2008-04-20 17:24 <REP> d-------- C:\Documents and Settings\All Users\Application Data\TVU Networks
      2008-04-19 18:54 . 2008-04-19 18:54 <REP> d-------- C:\Documents and Settings\ben\LocalLow
      2008-04-16 11:56 . 2006-11-29 13:06 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll
      2008-04-16 11:55 . 2008-04-16 11:55 <REP> d-------- C:\Program Files\Microsoft SQL Server Compact Edition
      2008-04-16 11:43 . 2008-04-16 11:48 <REP> d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller
      2008-04-16 11:43 . 2008-04-16 11:43 <REP> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
      2008-04-15 09:32 . 2008-04-16 01:04 <REP> d-------- C:\Documents and Settings\ben\Application Data\Skype
      2008-04-15 07:58 . 2008-04-15 07:58 <REP> d-------- C:\Program Files\Gabest
      2008-04-15 07:58 . 2008-04-15 07:58 <REP> d-------- C:\Program Files\AviSynth 2.5
      2008-04-14 17:27 . 2008-04-14 17:27 <REP> d-------- C:\Program Files\CAM Development
      2008-04-14 17:27 . 2008-04-14 17:27 <REP> d-------- C:\Documents and Settings\All Users\Application Data\CAM Development
      2008-04-14 17:25 . 2008-04-14 17:25 285,134 --a------ C:\Death_Note_Japanese_R3-[cdcovers_cc]-cd1.jpg
      2008-04-14 17:23 . 2008-04-16 16:27 <REP> d-------- C:\Program Files\Visual Labels
      2008-04-13 21:24 . 2008-04-13 21:24 <REP> d-------- C:\Program Files\iPod
      2008-04-13 21:22 . 2008-04-13 21:23 <REP> d-------- C:\Program Files\QuickTime
      2008-04-13 11:12 . 2008-04-13 11:12 <REP> d-------- C:\Program Files\coverXP
      2008-04-13 09:53 . 2008-04-13 09:53 <REP> d-------- C:\Documents and Settings\ben\Application Data\Talkback
      2008-04-13 09:52 . 2008-04-13 09:52 <REP> d-------- C:\Documents and Settings\ben\Application Data\CyberLink
      2008-04-12 23:05 . 2008-04-12 23:05 <REP> d-------- C:\Documents and Settings\ben\Application Data\TVU Networks
      2008-04-12 22:58 . 2008-04-12 22:58 <REP> d-------- C:\Documents and Settings\ben\Application Data\Sonic
      2008-04-12 22:58 . 2008-04-12 22:58 <REP> d-------- C:\Documents and Settings\ben\Application Data\Leadertech
      2008-04-12 22:53 . 2008-05-06 15:50 <REP> d-------- C:\Documents and Settings\ben\Application Data\uTorrent
      2008-04-12 22:39 . 2008-04-13 14:08 <REP> d-------- C:\Documents and Settings\ben\Application Data\DivX
      2008-04-12 20:12 . 2008-05-05 00:00 <REP> d-------- C:\Program Files\OneStepSearch
      2008-04-12 19:16 . 2008-04-13 11:23 <REP> d-------- C:\Documents and Settings\ben\Application Data\Apple Computer
      2008-04-12 19:15 . 2008-04-12 19:15 <REP> d-------- C:\Documents and Settings\ben\Application Data\HotSync
      2008-04-12 19:14 . 2008-04-12 19:38 <REP> d--h----- C:\Documents and Settings\ben\Voisinage réseau
      2008-04-12 19:14 . 2004-08-16 17:55 <REP> d--h----- C:\Documents and Settings\ben\Voisinage d'impression
      2008-04-12 19:14 . 2004-08-16 17:55 <REP> d--h----- C:\Documents and Settings\ben\Modèles
      2008-04-12 19:14 . 2008-05-05 11:15 <REP> dr------- C:\Documents and Settings\ben\Mes documents
      2008-04-12 19:14 . 2004-08-16 17:55 <REP> dr------- C:\Documents and Settings\ben\Menu Démarrer
      2008-04-12 19:14 . 2008-05-06 09:58 <REP> dr------- C:\Documents and Settings\ben\Favoris
      2008-04-12 19:14 . 2008-05-06 16:12 <REP> dr------- C:\Documents and Settings\ben\Bureau
      2008-04-12 19:14 . 2005-06-10 16:33 <REP> d-------- C:\Documents and Settings\ben\Application Data\You've Got Pictures Screensaver
      2008-04-12 19:14 . 2005-06-10 16:36 <REP> d-------- C:\Documents and Settings\ben\Application Data\Symantec
      2008-04-12 19:14 . 2005-06-10 16:26 <REP> d-------- C:\Documents and Settings\ben\Application Data\ATI
      2008-04-12 19:14 . 2008-05-05 14:13 <REP> d-------- C:\Documents and Settings\ben
      2008-04-12 19:14 . 2008-05-06 16:20 327,680 --ah----- C:\Documents and Settings\ben\ntuser.dat.LOG
      2008-04-10 22:25 . 2008-04-10 22:25 <REP> d-------- C:\Program Files\Cucusoft
      2008-04-10 22:25 . 2004-10-12 14:40 2,255,360 --a------ C:\WINDOWS\system32\libavcodec.dll
      2008-04-10 22:25 . 2004-10-12 14:46 1,761,280 --a------ C:\WINDOWS\system32\ffdshow.ax
      2008-04-10 22:25 . 2004-10-05 16:16 395,776 --a------ C:\WINDOWS\system32\libmplayer.dll
      2008-04-10 22:25 . 2004-10-12 14:42 262,144 --a------ C:\WINDOWS\system32\TomsMoComp_ff.dll
      2008-04-10 22:25 . 2003-04-03 00:17 172,032 --a------ C:\WINDOWS\system32\ac3filter.ax
      2008-04-10 22:25 . 2004-10-04 01:50 112,640 --a------ C:\WINDOWS\system32\libmpeg2_ff.dll
      2008-04-10 19:06 . 2008-04-12 10:00 <REP> d-------- C:\Poker
      2008-04-10 18:11 . 2008-04-10 18:22 <REP> d-------- C:\Program Files\LimeWire
      2008-04-10 18:11 . 2008-04-12 10:39 <REP> d-------- C:\Documents and Settings\DOM\Application Data\LimeWire
      2008-04-09 15:59 . 2008-04-09 15:59 <REP> d-------- C:\Documents and Settings\All Users\Application Data\DVD Shrink

      .
      (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
      .
      2008-04-20 09:05 --------- d-----w C:\Program Files\MSN Games
      2008-04-20 09:02 --------- d-----w C:\Program Files\EA GAMES
      2008-04-17 16:04 --------- d-----w C:\Program Files\Windows Live
      2008-04-15 05:48 --------- d-----w C:\Program Files\WinAVI MP4 Converter
      2008-04-15 05:44 --------- d-----w C:\Program Files\Aglare Mp4 to AVI Converter
      2008-04-14 07:33 --------- d-----w C:\Program Files\iTunes
      2008-04-13 18:23 --------- d-----w C:\Program Files\MSN Messenger
      2008-04-13 08:21 --------- d-----w C:\Documents and Settings\DOM\Application Data\uTorrent
      2008-04-13 07:46 --------- d-----w C:\Program Files\DivX
      2008-04-06 08:23 --------- d-----w C:\Program Files\Microsoft Money 2005
      2008-04-06 08:12 --------- d-----w C:\Program Files\Messenger Plus! Live
      2008-04-05 11:52 8,585 ----a-w C:\WINDOWS\Fonts\spread_bita10.zip
      2008-04-05 11:46 7,860 ----a-w C:\WINDOWS\Fonts\fisk_bitmap_nr2.zip
      2008-04-05 11:46 6,384 ----a-w C:\WINDOWS\Fonts\mizufontalphabet.zip
      2008-04-05 11:45 61,209 ----a-w C:\WINDOWS\Fonts\oloron.zip
      2008-04-05 11:44 104,194 ----a-w C:\WINDOWS\Fonts\asenine.zip
      2008-04-05 11:43 23,754 ----a-w C:\WINDOWS\Fonts\sanserifing.zip
      2008-04-05 11:42 27,561 ----a-w C:\WINDOWS\Fonts\redhead_goddess.zip
      2008-04-05 11:42 219,972 ----a-w C:\WINDOWS\Fonts\hurtmold.zip
      2008-04-05 11:41 83,279 ----a-w C:\WINDOWS\Fonts\anywhere.zip
      2008-04-05 11:41 16,400 ----a-w C:\WINDOWS\Fonts\zebra_110.zip
      2008-04-05 11:41 15,121 ----a-w C:\WINDOWS\Fonts\vargas.zip
      2008-04-05 11:40 11,343 ----a-w C:\WINDOWS\Fonts\herrliches_script.zip
      2008-04-05 11:35 11,538 ----a-w C:\WINDOWS\Fonts\katakana.zip
      2008-03-30 06:12 --------- d-----w C:\Program Files\Java
      2008-03-27 17:51 --------- d-----w C:\Program Files\Windows Live Safety Center
      2008-03-20 08:09 1,845,376 ----a-w C:\WINDOWS\system32\win32k.sys
      2008-03-20 08:09 1,845,376 ------w C:\WINDOWS\system32\dllcache\win32k.sys
      2008-03-01 16:28 3,591,680 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
      2008-02-29 08:57 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe
      2008-02-29 08:56 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe
      2008-02-22 10:00 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
      2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
      2008-02-20 06:51 282,624 ------w C:\WINDOWS\system32\dllcache\gdi32.dll
      2008-02-20 05:35 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
      2008-02-20 05:35 45,568 ------w C:\WINDOWS\system32\dllcache\dnsrslvr.dll
      2008-02-20 05:35 148,992 ------w C:\WINDOWS\system32\dllcache\dnsapi.dll
      2008-02-15 05:44 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll
      2007-05-30 12:08 480,848 ----a-w C:\Documents and Settings\All Users\Application Data\pswi_preloaded.exe
      2007-04-05 08:38 836 ----a-w C:\Documents and Settings\DOM\Application Data\ViewerApp.dat
      2006-05-19 06:57 31 ----a-w C:\Documents and Settings\DOMINIQUE\getfile.dat
      2006-04-09 21:31 31 ----a-w C:\Documents and Settings\FAMILLE\getfile.dat
      2006-04-03 13:52 100,816 ----a-w C:\Documents and Settings\DOMINIQUE\Application Data\GDIPFONTCACHEV1.DAT
      2007-11-07 13:39 168 --sh--r C:\WINDOWS\system32\93B7F23EBD.sys
      2007-11-07 13:39 3,766 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
      .

      ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
      .
      .
      REGEDIT4
      *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

      [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
      "{4E7BD74F-2B8D-469E-A0E8-ED6AB685FA7D}"= C:\WINDOWS\system32\pbfrv2.dll [ ]

      [HKEY_CLASSES_ROOT\clsid\{4e7bd74f-2b8d-469e-a0e8-ed6ab685fa7d}]
      [HKEY_CLASSES_ROOT\pbfrv2.PBFRV2]

      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 14:00 15360]
      "EzStatus"="C:\Apps\EZHome\EZStatus.exe" [2004-12-20 21:03 94208]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-05 14:00 208952]
      "PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-05 14:00 455168]
      "PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-05 14:00 455168]
      "Raccourci vers la page des propriétés de High Definition Audio"="HDAudPropShortcut.exe" [2004-03-17 15:10 61952 C:\WINDOWS\system32\Hdaudpropshortcut.exe]
      "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
      "ccApp"="C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe" [2004-09-07 15:25 58488]
      "HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe" [2003-05-07 21:56 188416]
      "HPHUPD05"="C:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" [2003-05-23 05:03 49152]
      "HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-04-08 12:45 212992]
      "HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [2002-12-17 11:40 49152]
      "HPHmon05"="C:\WINDOWS\system32\hphmon05.exe" [2003-05-23 04:56 483328]
      "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-30 21:05 344064]
      "TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2006-11-17 12:41 180269]
      "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 20:51 39792]
      "SoundMan"="SOUNDMAN.EXE" [2005-06-21 15:09 90112 C:\WINDOWS\SOUNDMAN.EXE]
      "AlcWzrd"="ALCWZRD.EXE" [2005-06-29 13:26 2806272 C:\WINDOWS\ALCWZRD.EXE]
      "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20 866584]
      "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-03-29 19:37 79224]
      "My Web Search Bar Search Scope Monitor"="C:\PROGRA~1\MYWEBS~1\bar\2.bin\m3SrchMn.exe" [ ]
      "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-03-28 23:37 413696]

      [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
      "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 14:00 15360]
      "EzStatus"="C:\Apps\EZHome\EZStatus.exe" [2004-12-20 21:03 94208]

      [HKEY_LOCAL_MACHINE\software\microsoft\security center]
      "AntiVirusDisableNotify"=dword:00000001
      "AntiVirusOverride"=dword:00000001

      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
      "%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\logo_ubi.exe"=
      "%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\pandora.exe"=
      "%windir%\\system32\\sessmgr.exe"=
      "C:\\APPS\\Inventime\\my.exe"=
      "C:\\APPS\\skype\\phone\\Skype.exe"=
      "C:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
      "C:\\APPS\\Powercinema\\PowerCinema.exe"=
      "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"=
      "C:\\WINDOWS\\system32\\rtcshare.exe"=
      "C:\\Program Files\\Kodak\\Printer Dock\\Kodak Wireless Printer Computer Setup Assistant.exe"=
      "C:\\Program Files\\uTorrent\\utorrent.exe"=
      "C:\\Program Files\\palmOne\\Hotsync.exe"=
      "C:\\Program Files\\LimeWire\\LimeWire.exe"=
      "C:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
      "C:\\Program Files\\TVUPlayer\\TVUPlayer.exe"=
      "C:\\Program Files\\Messenger\\msmsgs.exe"=
      "C:\\Program Files\\iTunes\\iTunes.exe"=
      "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
      "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
      "C:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\Kodak Software Updater.exe"=
      "%windir%\\Network Diagnostic\\xpnetdiag.exe"=

      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
      "6112:UDP"= 6112:UDP:azur1
      "6112:TCP"= 6112:TCP:azur1

      R0 sonypvl3;sonypvl3;C:\WINDOWS\system32\drivers\sonypvl3.sys [2004-09-22 12:55]
      R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 19:31]
      R1 sonypvf3;sonypvf3;C:\WINDOWS\system32\drivers\sonypvf3.sys [2004-11-15 14:55]
      R1 sonypvt3;sonypvt3;C:\WINDOWS\system32\drivers\sonypvt3.sys [2004-12-06 15:26]
      R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]
      R3 3xHybrid;3xHybrid service;C:\WINDOWS\system32\DRIVERS\3xHybrid.sys [2004-11-08 18:59]
      R3 camvid20;Philips ToUcam Camera; Video;C:\WINDOWS\system32\DRIVERS\camdrv21.sys []
      R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]
      S1 sonypvd3;Sony DVD Handycam;C:\WINDOWS\system32\DRIVERS\sonypvd3.sys [2004-12-07 16:00]
      S3 Boonty Games;Boonty Games;"C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe" [2006-02-05 19:47]
      S3 USB_RNDIS_51;Broadcom USB Remote NDIS Device Driver;C:\WINDOWS\system32\DRIVERS\usb8023.sys [2004-08-05 14:00]
      S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
      S3 ZD1211U(Wireless);IEEE 802.11g USB Adapter Driver(Wireless);C:\WINDOWS\system32\DRIVERS\zd1211u.sys []

      *Newly Created Service* - CATCHME
      .
      Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
      "2008-05-06 14:00:00 C:\WINDOWS\Tasks\ABA93B2791A6ACC3.job"
      - c:\docume~1\mathilde\applic~1\chicsi~1\Part real the.exe
      "2008-04-10 09:32:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
      - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
      "2008-02-03 11:07:00 C:\WINDOWS\Tasks\HP DArC Task #Hewlett-Packard#7600#MY3852322CK2.job"
      - C:\Program Files\HP\hpcoretech\comp\hpdarc.exe$/#Hewlett-Packard#7600#MY3852322CK2
      "2008-05-06 14:06:00 C:\WINDOWS\Tasks\HP Usg Daily.job"
      - C:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\pexpress\hphped05.exe
      "2008-05-06 07:37:50 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
      - C:\Program Files\Windows Defender\MpCmdRun.exe
      "2005-06-17 11:18:38 C:\WINDOWS\Tasks\Rappel d'enregistrement 1.job"
      - C:\WINDOWS\system32\OOBE\oobebaln.exe
      "2008-05-06 13:10:00 C:\WINDOWS\Tasks\Symantec NetDetect.job"
      - C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE
      "2008-05-06 14:19:02 C:\WINDOWS\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job"
      - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
      .
      **************************************************************************

      catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
      Rootkit scan 2008-05-06 16:20:29
      Windows 5.1.2600 Service Pack 2 NTFS

      Balayage processus cachés ...

      Balayage caché autostart entries ...

      Balayage des fichiers cachés ...

      Scan terminé avec succès
      Les fichiers cachés: 0

      **************************************************************************

      [HKEY_LOCAL_MACHINE\system\ControlSet003\Services\MysqlInventime]
      "ImagePath"="c:\mysql\bin\mysqld-nt MysqlInventime"
      .
      Temps d'accomplissement: 2008-05-06 16:21:24
      ComboFix-quarantined-files.txt 2008-05-06 14:21:12

      Pre-Run: 99,725,164,544 octets libres
      Post-Run: 100,563,988,480 octets libres

      363 --- E O F --- 2008-05-06 01:02:29

      Malwarebytes' Anti-Malware 1.12
      Version de la base de données: 723

      Type de recherche: Examen complet (C:\|D:\|)
      Eléments examinés: 254206
      Temps écoulé: 49 minute(s), 15 second(s)

      Processus mémoire infecté(s): 0
      Module(s) mémoire infecté(s): 0
      Clé(s) du Registre infectée(s): 121
      Valeur(s) du Registre infectée(s): 4
      Elément(s) de données du Registre infecté(s): 0
      Dossier(s) infecté(s): 5
      Fichier(s) infecté(s): 111

      Processus mémoire infecté(s):
      (Aucun élément nuisible détecté)

      Module(s) mémoire infecté(s):
      (Aucun élément nuisible détecté)

      Clé(s) du Registre infectée(s):
      HKEY_CLASSES_ROOT\pbfrv2.pbfrv2 (Adware.2020Search) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\CLSID\{4e7bd74f-2b8d-469e-a0e8-ed6ab685fa7d} (Adware.2020Search) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{5b4c3b43-49b6-42a7-a602-f7acdca0d409} (Adware.OneStepSearch) -> Quarantined and deleted successfully.
      HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{5b4c3b43-49b6-42a7-a602-f7acdca0d409} (Adware.OneStepSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\CLSID\{00a6faf6-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\CLSID\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\mywebsearchtoolbar.settingsplugin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\mywebsearchtoolbar.settingsplugin.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\CLSID\{07b18eab-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{07b18eab-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\funwebproducts.iecookiesmanager (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\funwebproducts.iecookiesmanager.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\CLSID\{1e0de227-5ce4-4ea3-ab0c-8b03e1aa76bc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\funwebproducts.datacontrol.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{25560540-9571-4d7b-9389-0f166788785a} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\funwebproducts.shellviewcontrol (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\funwebproducts.shellviewcontrol.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{2eff3cf7-99c1-4c29-bc2b-68e057e22340} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\funwebproducts.htmlmenu (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\funwebproducts.htmlmenu.2 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3dc201fb-e9c9-499c-a11f-23c360d7c3f8} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\mywebsearch.htmlpanel (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\mywebsearch.htmlpanel.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3e720452-b472-4954-b7aa-33069eb53906} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\mywebsearchtoolbar.toolbarplugin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\mywebsearchtoolbar.toolbarplugin.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\funwebproducts.popswattersettingscontrol (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\funwebproducts.popswattersettingscontrol.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{63d0ed2c-b45b-4458-8b3b-60c69bbbd83c} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\mywebsearch.pseudotransparentplugin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\mywebsearch.pseudotransparentplugin.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\CLSID\{7473d294-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7473d294-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\CLSID\{7473d296-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\funwebproducts.popswatterbarbutton (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\funwebproducts.popswatterbarbutton.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\funwebproducts.htmlmenu.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{98d9753d-d73b-42d5-8c85-4469cda897ab} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\screensavercontrol.screensaverinstaller (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\screensavercontrol.screensaverinstaller.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9ff05104-b030-46fc-94b8-81276e4e27df} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\CLSID\{a4730ebe-43a6-443e-9776-36915d323ad3} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\funwebproducts.browseroverlayembed (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\funwebproducts.browseroverlayembed.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\CLSID\{a6573479-9075-4a65-98a6-19fd29cf7374} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{a6573479-9075-4a65-98a6-19fd29cf7374} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\mywebsearch.outlookaddin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\mywebsearch.outlookaddin.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\funwebproducts.killerobjmanager (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\funwebproducts.killerobjmanager.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\funwebproducts.historykillerscheduler (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\funwebproducts.historykillerscheduler.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\funwebproducts.historyswattercontrolbar (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\funwebproducts.historyswattercontrolbar.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\funwebproducts.browseroverlaybarbutton (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\funwebproducts.browseroverlaybarbutton.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\CLSID\{d778513b-1c40-4819-b0c5-49e40b39afd0} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\mywebsearch.chatsessionplugin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\mywebsearch.chatsessionplugin.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\CLSID\{e79dfbca-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{e79dfbca-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\Interface\{07b18eaa-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\Interface\{07b18eac-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\Interface\{f87d7fb5-9dc5-4c8c-b998-d8dfe02e2978} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\Typelib\{07b18ea0-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\Interface\{e342af55-b78a-4cd0-a2bb-da7f52d9d25e} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\Interface\{e342af55-b78a-4cd0-a2bb-da7f52d9d25f} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\Typelib\{0d26bc71-a633-4e71-ad31-eadc3a1b6a3a} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\Interface\{1093995a-ba37-41d2-836e-091067c4ad17} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\Interface\{120927bf-1700-43bc-810f-fab92549b390} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\Interface\{17de5e5e-bfe3-4e83-8e1f-8755795359ec} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\Interface\{1f52a5fa-a705-4415-b975-88503b291728} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\Interface\{247a115f-06c2-4fb3-967d-2d62d3cf4f0a} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\Interface\{2763e333-b168-41a0-a112-d35f96f410c0} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\Interface\{2e3537fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\Typelib\{29d67d3c-509a-4544-903f-c8c1b8236554} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\Interface\{38a7c9da-8db7-4d0f-a7b1-c4b1a305bddb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\Interface\{3e1656ed-f60e-4597-b6aa-b6a58e171495} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\Interface\{3e53e2cb-86db-4a4a-8bd9-ffeb7a64df82} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\Interface\{3e720451-b472-4954-b7aa-33069eb53906} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\Interface\{3e720453-b472-4954-b7aa-33069eb53906} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\Typelib\{3e720450-b472-4954-b7aa-33069eb53906} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\Typelib\{621feacd-8857-43a6-ae26-451d670d5370} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\Interface\{63d0ed2b-b45b-4458-8b3b-60c69bbbd83c} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\Interface\{63d0ed2d-b45b-4458-8b3b-60c69bbbd83c} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\Interface\{6e74766c-4d93-4cc0-96d1-47b8e07ff9ca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\Interface\{72ee7f04-15bd-4845-a005-d6711144d86a} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\Interface\{7473d291-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\Interface\{7473d293-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\Interface\{7473d295-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\Interface\{7473d297-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\Typelib\{7473d290-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\Interface\{90449521-d834-4703-bb4e-d3aa44042ff8} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\Interface\{991aac62-b100-47ce-8b75-253965244f69} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\Interface\{bbabdc90-f3d5-4801-863a-ee6ae529862d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\Interface\{d6ff3684-ad3b-48eb-bbb4-b9e6c5a355c1} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\Interface\{eb9e5c1c-b1f9-4c2b-be8a-27d6446fdaf8} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\Typelib\{8ca01f0e-987c-49c3-b852-2f1ac4a7094c} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\Interface\{8d292ec0-6792-4a38-82ed-73a087e41ba6} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\Typelib\{8e6f1830-9607-4440-8530-13be7c4b1d14} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\Typelib\{98635087-3f5d-418f-990c-b1efe0797a3b} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\Interface\{a626cdbd-3d13-4f78-b819-440a28d7e8fc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\Typelib\{c8cecde3-1ae1-4c4a-ad82-6d5b00212144} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\Interface\{de38c398-b328-4f4c-a3ad-1b5e4ed93477} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\Typelib\{e47caee0-deea-464a-9326-3f2801535a4d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\Interface\{e79dfbc9-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\Interface\{e79dfbcb-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\Typelib\{e79dfbc0-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\Typelib\{f42228fb-e84e-479e-b922-fbbd096e792c} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\onestepsearch (Adware.OneStepSearch) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\OneStepSearch (Adware.OneStepSearch) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\MIME\Database\Content Type\application/x-f3embed (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyWebSearch bar Uninstall (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CURRENT_USER\Software\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.

      Valeur(s) du Registre infectée(s):
      HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{4e7bd74f-2b8d-469e-a0e8-ed6ab685fa7d} (Adware.2020Search) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media\WMSDK\Sources\f3PopularScreensavers (Adware.MyWebSearch) -> Quarantined and deleted successfully.

      Elément(s) de données du Registre infecté(s):
      (Aucun élément nuisible détecté)

      Dossier(s) infecté(s):
      C:\Program Files\dynamic toolbar (Adware.2020search) -> Quarantined and deleted successfully.
      C:\Program Files\dynamic toolbar\Cache (Adware.2020search) -> Quarantined and deleted successfully.
      C:\Program Files\dynamic toolbar\PBFRV2 (Adware.2020search) -> Quarantined and deleted successfully.
      C:\Program Files\dynamic toolbar\PBFRV2\Cache (Adware.2020search) -> Quarantined and deleted successfully.
      C:\Program Files\OneStepSearch (Adware.OneStepSearch) -> Quarantined and deleted successfully.

      Fichier(s) infecté(s):
      C:\Program Files\MSN Messenger\riched20.dll (Adware.MyWeb.FunWeb) -> Quarantined and deleted successfully.
      C:\QooBox\Quarantine\C\Program Files\Internet Explorer\msimg32.dll.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\F3BROVLY.DLL.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\F3CJPEG.DLL.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\F3HISTSW.DLL.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\F3HTTPCT.DLL.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\F3IMSTUB.DLL.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\F3POPSWT.DLL.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\F3PSSAVR.SCR.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\F3REPROX.DLL.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\F3RESTUB.DLL.vir (Adware.MyWeb.FunWeb) -> Quarantined and deleted successfully.
      C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\F3SCHMON.EXE.vir (Adware.MyWeb.FunWeb) -> Quarantined and deleted successfully.
      C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\F3SCRCTR.DLL.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\F3SHLLVW.DLL.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\F3WPHOOK.DLL.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\M3IDLE.DLL.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\M3IMPIPE.EXE.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\M3OUTLCN.DLL.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\M3SKIN.DLL.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\M3SKPLAY.EXE.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\MWSOEMON.EXE.vir (Adware.MyWebSearch) -> Delete on reboot.
      C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\MWSOESTB.DLL.vir (Adware.MyWebSearch) -> Delete on reboot.
      C:\QooBox\Quarantine\C\WINDOWS\system32\f3PSSavr.scr.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP847\A0290631.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP847\A0290634.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP847\A0290635.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP847\A0290637.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP847\A0290639.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP847\A0290640.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP847\A0290641.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP847\A0290642.SCR (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP847\A0290643.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP847\A0290644.DLL (Adware.MyWeb.FunWeb) -> Quarantined and deleted successfully.
      C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP847\A0290645.EXE (Adware.MyWeb.FunWeb) -> Quarantined and deleted successfully.
      C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP847\A0290646.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP847\A0290647.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP847\A0290648.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP847\A0290651.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP847\A0290652.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP847\A0290655.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP847\A0290657.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP847\A0290658.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP847\A0290661.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP847\A0290663.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP847\A0290671.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP847\A0290672.scr (Adware.MyWebSearch) -> Quarantined and deleted successfully.
      C:\Program Files\dynamic toolbar\batch.bat (Adware.2020search) -> Quarantined and deleted successfully.
      C:\Program Files\dynamic toolbar\unins000.dat (Adware.2020search) -> Quarantined and deleted successfully.
      C:\Program Files\dynamic toolbar\unins000.exe (Adware.2020search) -> Quarantined and deleted successfully.
      C:\Program Files\dynamic toolbar\Cache\go.bmp (Adware.2020search) -> Quarantined and deleted successfully.
      C:\Program Files\dynamic toolbar\Cache\home.bmp (Adware.2020search) -> Quarantined and deleted successfully.
      C:\Program Files\dynamic toolbar\Cache\logo_pb.bmp (Adware.2020search) -> Quarantined and deleted successfully.
      C:\Program Files\dynamic toolbar\Cache\parent_off.bmp (Adware.2020search) -> Quarantined and deleted successfully.
      C:\Program Files\dynamic toolbar\Cache\parent_on.bmp (Adware.2020search) -> Quarantined and deleted successfully.
      C:\Program Files\dynamic toolbar\Cache\pbfrv2tb0200.cfg (Adware.2020search) -> Quarantined and deleted successfully.
      C:\Program Files\dynamic toolbar\Cache\popup_off.bmp (Adware.2020search) -> Quarantined and deleted successfully.
      C:\Program Files\dynamic toolbar\Cache\popup_on.bmp (Adware.2020search) -> Quarantined and deleted successfully.
      C:\Program Files\dynamic toolbar\Cache\search.bmp (Adware.2020search) -> Quarantined and deleted successfully.
      C:\Program Files\dynamic toolbar\Cache\services.bmp (Adware.2020search) -> Quarantined and deleted successfully.
      C:\Program Files\dynamic toolbar\Cache\skin.bmp (Adware.2020search) -> Quarantined and deleted successfully.
      C:\Program Files\dynamic toolbar\Cache\skin1.bmp (Adware.2020search) -> Quarantined and deleted successfully.
      C:\Program Files\dynamic toolbar\Cache\skin2.bmp (Adware.2020search) -> Quarantined and deleted successfully.
      C:\Program Files\dynamic toolbar\Cache\skin3.bmp (Adware.2020search) -> Quarantined and deleted successfully.
      C:\Program Files\dynamic toolbar\Cache\skin4.bmp (Adware.2020search) -> Quarantined and deleted successfully.
      C:\Program Files\dynamic toolbar\Cache\skin5.bmp (Adware.2020search) -> Quarantined and deleted successfully.
      C:\Program Files\dynamic toolbar\Cache\store.bmp (Adware.2020search) -> Quarantined and deleted successfully.
      C:\Program Files\dynamic toolbar\Cache\style.css (Adware.2020search) -> Quarantined and deleted successfully.
      C:\Program Files\dynamic toolbar\Cache\support.bmp (Adware.2020search) -> Quarantined and deleted successfully.
      C:\Program Files\dynamic toolbar\Cache\ticker.xml (Adware.2020search) -> Quarantined and deleted successfully.
      C:\Program Files\dynamic toolbar\PBFRV2\Cache\ErrorLog.txt (Adware.2020search) -> Quarantined and deleted successfully.
      C:\Program Files\dynamic toolbar\PBFRV2\Cache\go.bmp (Adware.2020search) -> Quarantined and deleted successfully.
      C:\Program Files\dynamic toolbar\PBFRV2\Cache\home.bmp (Adware.2020search) -> Quarantined and deleted successfully.
      C:\Program Files\dynamic toolbar\PBFRV2\Cache\logo_pb.bmp (Adware.2020search) -> Quarantined and deleted successfully.
      C:\Program Files\dynamic toolbar\PBFRV2\Cache\parent_off.bmp (Adware.2020search) -> Quarantined and deleted successfully.
      C:\Program Files\dynamic toolbar\PBFRV2\Cache\parent_on.bmp (Adware.2020search) -> Quarantined and deleted successfully.
      C:\Program Files\dynamic toolbar\PBFRV2\Cache\PBFRV2TB0200.cfg (Adware.2020search) -> Quarantined and deleted successfully.
      C:\Program Files\dynamic toolbar\PBFRV2\Cache\popup_off.bmp (Adware.2020search) -> Quarantined and deleted successfully.
      C:\Program Files\dynamic toolbar\PBFRV2\Cache\popup_on.bmp (Adware.2020search) -> Quarantined and deleted successfully.
      C:\Program Files\dynamic toolbar\PBFRV2\Cache\search.bmp (Adware.2020search) -> Quarantined and deleted successfully.
      C:\Program Files\dynamic toolbar\PBFRV2\Cache\services.bmp (Adware.2020search) -> Quarantined and deleted successfully.
      C:\Program Files\dynamic toolbar\PBFRV2\Cache\skin.bmp (Adware.2020search) -> Quarantined and deleted successfully.
      C:\Program Files\dynamic toolbar\PBFRV2\Cache\skin1.bmp (Adware.2020search) -> Quarantined and deleted successfully.
      C:\Program Files\dynamic toolbar\PBFRV2\Cache\skin2.bmp (Adware.2020search) -> Quarantined and deleted successfully.
      C:\Program Files\dynamic toolbar\PBFRV2\Cache\skin3.bmp (Adware.2020search) -> Quarantined and deleted successfully.
      C:\Program Files\dynamic toolbar\PBFRV2\Cache\skin4.bmp (Adware.2020search) -> Quarantined and deleted successfully.
      C:\Program Files\dynamic toolbar\PBFRV2\Cache\skin5.bmp (Adware.2020search) -> Quarantined and deleted successfully.
      C:\Program Files\dynamic toolbar\PBFRV2\Cache\store.bmp (Adware.2020search) -> Quarantined and deleted successfully.
      C:\Program Files\dynamic toolbar\PBFRV2\Cache\style.css (Adware.2020search) -> Quarantined and deleted successfully.
      C:\Program Files\dynamic toolbar\PBFRV2\Cache\support.bmp (Adware.2020search) -> Quarantined and deleted successfully.
      C:\Program Files\dynamic toolbar\PBFRV2\Cache\ticker.xml (Adware.2020search) -> Quarantined and deleted successfully.
      C:\Program Files\dynamic toolbar\PBFRV2\Cache\_Ticker_ticker.txt (Adware.2020search) -> Quarantined and deleted successfully.
      C:\Program Files\OneStepSearch\home.js (Adware.OneStepSearch) -> Quarantined and deleted successfully.
      C:\Program Files\OneStepSearch\onestep.dll (Adware.OneStepSearch) -> Quarantined and deleted successfully.
      C:\Program Files\OneStepSearch\osopt.exe (Adware.OneStepSearch) -> Quarantined and deleted successfully.
      C:\Program Files\OneStepSearch\readme.html (Adware.OneStepSearch) -> Quarantined and deleted successfully.
      C:\Program Files\OneStepSearch\uninstall.exe (Adware.OneStepSearch) -> Quarantined and deleted successfully.
      C:\WINDOWS\Fonts\anywhere.zip (Trojan.Downloader) -> Quarantined and deleted successfully.
      C:\WINDOWS\Fonts\asenine.zip (Trojan.Downloader) -> Quarantined and deleted successfully.
      C:\WINDOWS\Fonts\fisk_bitmap_nr2.zip (Trojan.Downloader) -> Quarantined and deleted successfully.
      C:\WINDOWS\Fonts\got_heroin.zip (Trojan.Downloader) -> Quarantined and deleted successfully.
      C:\WINDOWS\Fonts\herrliches_script.zip (Trojan.Downloader) -> Quarantined and deleted successfully.
      C:\WINDOWS\Fonts\hurtmold.zip (Trojan.Downloader) -> Quarantined and deleted successfully.
      C:\WINDOWS\Fonts\katakana.zip (Trojan.Downloader) -> Quarantined and deleted successfully.
      C:\WINDOWS\Fonts\mizufontalphabet.zip (Trojan.Downloader) -> Quarantined and deleted successfully.
      C:\WINDOWS\Fonts\oloron.zip (Trojan.Downloader) -> Quarantined and deleted successfully.
      C:\WINDOWS\Fonts\redhead_goddess.zip (Trojan.Downloader) -> Quarantined and deleted successfully.
      C:\WINDOWS\Fonts\sanserifing.zip (Trojan.Downloader) -> Quarantined and deleted successfully.
      C:\WINDOWS\Fonts\spread_bita10.zip (Trojan.Downloader) -> Quarantined and deleted successfully.
      C:\WINDOWS\Fonts\vargas.zip (Trojan.Downloader) -> Quarantined and deleted successfully.
      C:\WINDOWS\Fonts\zebra_110.zip (Trojan.Downloader) -> Quarantined and deleted successfully.

      # Rapport Lopxp fait le 06/05/2008 à 17:50:46
      # Exécuté dans : C:\Program Files\Lopxp
      # Version 3.10 - Maj du 11/04/2008

      Killing 'iexplore.exe'
      "C:\Program Files\internet explorer\iexplore.exe" (2284)

      ========== Listing des dossiers Application Data

      +- C:\Documents and Settings\Administrateur\Application Data

      2005-06-10 à 14:26:14 - ATI
      2004-08-16 à 16:19:22 - Identities
      2006-05-20 à 11:12:14 - Microsoft
      2005-06-10 à 14:39:20 - Real
      2005-06-10 à 14:26:36 - Sun
      2005-06-10 à 14:36:11 - Symantec
      2005-06-10 à 14:33:33 - You've Got Pictures Screensaver

      +- C:\Documents and Settings\Administrateur\Local Settings\Application Data

      2006-02-22 à 18:08:02 - ApplicationHistory
      2005-06-10 à 14:26:14 - ATI
      2006-05-20 à 11:12:14 - Microsoft
      2005-06-10 à 14:41:40 - PowerCinema
      2005-06-10 à 14:26:26 - {7148F0A6-6813-11D6-A77B-00B0D0142050}

      +- C:\Documents and Settings\All Users\Application Data

      2005-11-19 à 17:21:50 - 4D
      2007-08-03 à 20:06:08 - Adobe
      2005-11-29 à 13:11:52 - AOL
      2008-02-10 à 10:55:08 - Apple
      2007-01-08 à 16:28:54 - Apple Computer
      2006-02-05 à 11:25:59 - ArcSoft
      2008-01-20 à 09:47:41 - Azureus
      2006-02-05 à 17:47:07 - BOONTY
      2008-04-14 à 15:27:28 - CAM Development
      2007-02-04 à 14:28:24 - Corel
      2005-09-21 à 16:52:48 - CyberLink
      2006-12-21 à 23:44:35 - DataViz
      2008-04-09 à 13:59:54 - DVD Shrink
      2005-12-15 à 08:10:20 - Global Software Publishing
      2007-11-11 à 09:13:29 - Google
      2006-10-09 à 16:45:25 - HotSync
      2006-08-31 à 18:24:41 - Kodak
      2007-02-23 à 15:30:57 - Macrovision
      2008-05-06 à 14:41:22 - Malwarebytes
      2006-03-15 à 17:44:01 - Messenger Plus!
      2008-05-04 à 19:43:59 - Microsoft
      2006-08-27 à 14:49:09 - muvee Technologies
      2005-09-17 à 17:24:30 - NFS Underground
      2006-06-10 à 20:57:44 - PlayFirst
      2006-12-15 à 17:49:39 - Pure Scr Show Ref
      2005-08-27 à 19:22:35 - QuickTime
      2006-09-02 à 12:14:21 - Sandlot Games
      2004-08-16 à 16:28:48 - SBSI
      2007-02-03 à 18:21:13 - Skype
      2006-05-20 à 10:13:49 - Symantec
      2007-02-11 à 18:42:08 - TEMP
      2008-04-20 à 15:24:30 - TVU Networks
      2006-05-21 à 12:47:24 - Windows Genuine Advantage
      2006-12-22 à 00:32:48 - Windows Live Toolbar
      2007-10-23 à 18:04:51 - WinZip
      2008-04-16 à 09:43:23 - WLInstaller
      2007-11-11 à 09:52:53 - Yahoo! Companion
      2007-04-03 à 00:07:50 - Zylom

      +- C:\Documents and Settings\ben\Application Data

      2008-04-15 à 08:25:52 - Adobe
      2008-04-13 à 09:23:56 - Apple Computer
      2005-06-10 à 14:26:14 - ATI
      2008-04-13 à 07:52:11 - CyberLink
      2008-04-13 à 12:08:19 - DivX
      2008-04-12 à 17:15:07 - HotSync
      2004-08-16 à 16:19:22 - Identities
      2008-04-12 à 20:58:45 - Leadertech
      0
      1. knobi Auteur
        voiici les rapport dans l'orde

        ComboFix 08-05-01.3 - ben 2008-05-06 16:14:55.1 - NTFSx86
        Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.1454 [GMT 2:00]
        Endroit: C:\Documents and Settings\ben\Bureau\Combo-Fix.exe
        * Création d'un nouveau point de restauration
        .

        (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
        .

        C:\Program Files\FunWebProducts
        C:\Program Files\FunWebProducts\ScreenSaver\Images\[u]0/u057096E.urr
        C:\Program Files\FunWebProducts\ScreenSaver\Images\[u]0/u152EE6B.urr
        C:\Program Files\FunWebProducts\Shared\[u]0/u14DEC8E.dat
        C:\Program Files\FunWebProducts\Shared\Cache\AvatarSmallBtn.html
        C:\Program Files\FunWebProducts\Shared\Cache\CursorManiaBtn.html
        C:\Program Files\FunWebProducts\Shared\Cache\FunBuddyIconBtn.html
        C:\Program Files\FunWebProducts\Shared\Cache\MailStampBtn.html
        C:\Program Files\FunWebProducts\Shared\Cache\MyFunCardsIMBtn.html
        C:\Program Files\FunWebProducts\Shared\Cache\MyStationeryBtn.html
        C:\Program Files\FunWebProducts\Shared\Cache\SmileyCentralBtn.html
        C:\Program Files\internet explorer\msimg32.dll
        C:\Program Files\MyWebSearch
        C:\Program Files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL
        C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
        C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
        C:\Program Files\MyWebSearch\bar\1.bin\MWSOEPLG.DLL
        C:\Program Files\MyWebSearch\bar\1.bin\MWSOESTB.DLL
        C:\Program Files\MyWebSearch\bar\2.bin\F3BKGERR.JPG
        C:\Program Files\MyWebSearch\bar\2.bin\F3BROVLY.DLL
        C:\Program Files\MyWebSearch\bar\2.bin\F3CJPEG.DLL
        C:\Program Files\MyWebSearch\bar\2.bin\F3DTACTL.DLL
        C:\Program Files\MyWebSearch\bar\2.bin\F3HISTSW.DLL
        C:\Program Files\MyWebSearch\bar\2.bin\F3HTMLMU.DLL
        C:\Program Files\MyWebSearch\bar\2.bin\F3HTTPCT.DLL
        C:\Program Files\MyWebSearch\bar\2.bin\F3IMSTUB.DLL
        C:\Program Files\MyWebSearch\bar\2.bin\F3POPSWT.DLL
        C:\Program Files\MyWebSearch\bar\2.bin\F3PSSAVR.SCR
        C:\Program Files\MyWebSearch\bar\2.bin\F3REPROX.DLL
        C:\Program Files\MyWebSearch\bar\2.bin\F3RESTUB.DLL
        C:\Program Files\MyWebSearch\bar\2.bin\F3SCHMON.EXE
        C:\Program Files\MyWebSearch\bar\2.bin\F3SCRCTR.DLL
        C:\Program Files\MyWebSearch\bar\2.bin\F3SHLLVW.DLL
        C:\Program Files\MyWebSearch\bar\2.bin\F3SPACER.WMV
        C:\Program Files\MyWebSearch\bar\2.bin\F3WALLPP.DAT
        C:\Program Files\MyWebSearch\bar\2.bin\F3WPHOOK.DLL
        C:\Program Files\MyWebSearch\bar\2.bin\M3FFXTBR.JAR
        C:\Program Files\MyWebSearch\bar\2.bin\M3FFXTBR.MANIFEST
        C:\Program Files\MyWebSearch\bar\2.bin\M3HTML.DLL
        C:\Program Files\MyWebSearch\bar\2.bin\M3IDLE.DLL
        C:\Program Files\MyWebSearch\bar\2.bin\M3IMPIPE.EXE
        C:\Program Files\MyWebSearch\bar\2.bin\M3MSG.DLL
        C:\Program Files\MyWebSearch\bar\2.bin\M3NTSTBR.JAR
        C:\Program Files\MyWebSearch\bar\2.bin\M3NTSTBR.MANIFEST
        C:\Program Files\MyWebSearch\bar\2.bin\M3OUTLCN.DLL
        C:\Program Files\MyWebSearch\bar\2.bin\M3PLUGIN.DLL
        C:\Program Files\MyWebSearch\bar\2.bin\M3SKIN.DLL
        C:\Program Files\MyWebSearch\bar\2.bin\M3SKPLAY.EXE
        C:\Program Files\MyWebSearch\bar\2.bin\M3SLSRCH.EXE
        C:\Program Files\MyWebSearch\bar\2.bin\MWSBAR.DLL
        C:\Program Files\MyWebSearch\bar\2.bin\MWSOEMON.EXE
        C:\Program Files\MyWebSearch\bar\2.bin\MWSOEPLG.DLL
        C:\Program Files\MyWebSearch\bar\2.bin\MWSOESTB.DLL
        C:\Program Files\MyWebSearch\bar\2.bin\NPMYWEBS.DLL
        C:\Program Files\MyWebSearch\bar\Avatar\COMMON.F3S
        C:\Program Files\MyWebSearch\bar\Avatar\COMMON\avatar.htm
        C:\Program Files\MyWebSearch\bar\Avatar\COMMON\bgfadel.gif
        C:\Program Files\MyWebSearch\bar\Avatar\COMMON\bgfader.gif
        C:\Program Files\MyWebSearch\bar\Avatar\COMMON\close.gif
        C:\Program Files\MyWebSearch\bar\Avatar\COMMON\common-x.css
        C:\Program Files\MyWebSearch\bar\Avatar\COMMON\common.css
        C:\Program Files\MyWebSearch\bar\Avatar\COMMON\cornerbl.gif
        C:\Program Files\MyWebSearch\bar\Avatar\COMMON\cornerbr.gif
        C:\Program Files\MyWebSearch\bar\Avatar\COMMON\htmlctrl.js
        C:\Program Files\MyWebSearch\bar\Avatar\COMMON\include.js
        C:\Program Files\MyWebSearch\bar\Avatar\COMMON\index.htm
        C:\Program Files\MyWebSearch\bar\Avatar\COMMON\loading.gif
        C:\Program Files\MyWebSearch\bar\Avatar\COMMON\login.htm
        C:\Program Files\MyWebSearch\bar\Avatar\COMMON\logo.gif
        C:\Program Files\MyWebSearch\bar\Avatar\COMMON\max.gif
        C:\Program Files\MyWebSearch\bar\Avatar\COMMON\min.gif
        C:\Program Files\MyWebSearch\bar\Avatar\COMMON\noflash.htm
        C:\Program Files\MyWebSearch\bar\Avatar\COMMON\spacer.gif
        C:\Program Files\MyWebSearch\bar\Avatar\COMMON\spacer.swf
        C:\Program Files\MyWebSearch\bar\Avatar\COMMON\unmax.gif
        C:\Program Files\MyWebSearch\bar\Avatar\COMMON\wardrobe.htm
        C:\Program Files\MyWebSearch\bar\Avatar\COMMON\window.ico
        C:\Program Files\MyWebSearch\bar\Cache\[u]0/u0061ADD
        C:\Program Files\MyWebSearch\bar\Cache\[u]0/u020E12C.bin
        C:\Program Files\MyWebSearch\bar\Cache\[u]0/u020E488.bin
        C:\Program Files\MyWebSearch\bar\Cache\[u]0/u020E61E.bin
        C:\Program Files\MyWebSearch\bar\Cache\[u]0/u0393013
        C:\Program Files\MyWebSearch\bar\Cache\[u]0/u0C4F052.bin
        C:\Program Files\MyWebSearch\bar\Cache\[u]0/u1274D98.bin
        C:\Program Files\MyWebSearch\bar\Cache\[u]0/u1274F5D.bin
        C:\Program Files\MyWebSearch\bar\Cache\[u]0/u1275132.bin
        C:\Program Files\MyWebSearch\bar\Cache\[u]0/u12752E7
        C:\Program Files\MyWebSearch\bar\Cache\[u]0/u1455844
        C:\Program Files\MyWebSearch\bar\Cache\[u]0/u14559AC.bin
        C:\Program Files\MyWebSearch\bar\Cache\[u]0/u1455C5B.bin
        C:\Program Files\MyWebSearch\bar\Cache\[u]0/u1456072.bin
        C:\Program Files\MyWebSearch\bar\Cache\[u]0/u14561CA.bin
        C:\Program Files\MyWebSearch\bar\Cache\[u]0/u149783D.bin
        C:\Program Files\MyWebSearch\bar\Cache\[u]0/u14979E2.bin
        C:\Program Files\MyWebSearch\bar\Cache\[u]0/u1497BA8.bin
        C:\Program Files\MyWebSearch\bar\Cache\[u]0/u1497CFF.bin
        C:\Program Files\MyWebSearch\bar\Cache\[u]0/u16A4BFC
        C:\Program Files\MyWebSearch\bar\Cache\[u]0/u16A5468.bin
        C:\Program Files\MyWebSearch\bar\Cache\[u]0/u16A56BA.bin
        C:\Program Files\MyWebSearch\bar\Cache\[u]0/u16A58AE.bin
        C:\Program Files\MyWebSearch\bar\Cache\[u]0/u16A5AB2.bin
        C:\Program Files\MyWebSearch\bar\Cache\[u]0/u16A62FF.bin
        C:\Program Files\MyWebSearch\bar\Cache\[u]0/u16A657F.bin
        C:\Program Files\MyWebSearch\bar\Cache\[u]0/u16A6706.bin
        C:\Program Files\MyWebSearch\bar\Cache\[u]0/u184EC25.bin
        C:\Program Files\MyWebSearch\bar\Cache\[u]0/u54691AA
        C:\Program Files\MyWebSearch\bar\Cache\files.ini
        C:\Program Files\MyWebSearch\bar\Game\CHECKERS.F3S
        C:\Program Files\MyWebSearch\bar\Game\CHESS.F3S
        C:\Program Files\MyWebSearch\bar\Game\REVERSI.F3S
        C:\Program Files\MyWebSearch\bar\History\search2
        C:\Program Files\MyWebSearch\bar\Search\COMMON.F3S
        C:\Program Files\MyWebSearch\bar\Settings\prevcfg2.htm
        C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat
        C:\Program Files\MyWebSearch\bar\Settings\setting2.htm
        C:\Program Files\MyWebSearch\bar\Settings\setting2.htm.bak
        C:\Program Files\MyWebSearch\bar\Settings\settings.dat
        C:\Program Files\MyWebSearch\bar\Settings\settings.dat.bak
        C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
        C:\Program Files\MyWebSearch\SrchAstt\2.bin\MWSSRCAS.DLL
        C:\Program Files\webmediaplayer
        C:\Program Files\webmediaplayer\resources\languages.xml
        C:\Program Files\webmediaplayer\resources\webmedias
        C:\Program Files\webmediaplayer\skins\classic.skn
        C:\Program Files\webmediaplayer\sqlite3.dll
        C:\Program Files\webmediaplayer\uninst.exe
        C:\Program Files\webmediaplayer\WebMediaPlayer.url
        C:\WINDOWS\pack.epk
        C:\WINDOWS\system32\f3PSSavr.scr
        C:\WINDOWS\system32\nvs2.inf
        c:\WINDOWS\system32\xdbnohu.dat
        C:\WINDOWS\system32\xdbnohu.exe
        c:\WINDOWS\system32\xdbnohu_nav.dat
        c:\WINDOWS\system32\xdbnohu_navps.dat
        c:\WINDOWS\system32\xdbnohu_navup.dat

        .
        ((((((((((((((((((((((((((((( Fichiers créés 2008-04-06 to 2008-05-06 ))))))))))))))))))))))))))))))))))))
        .

        2008-05-06 10:05 . 2008-05-06 10:05 54,156 --ah----- C:\WINDOWS\QTFont.qfn
        2008-05-06 10:05 . 2008-05-06 10:05 1,409 --a------ C:\WINDOWS\QTFont.for
        2008-05-05 19:48 . 2008-05-05 19:48 <REP> d-------- C:\Program Files\Trend Micro
        2008-05-04 21:57 . 2008-05-04 21:57 <REP> d-------- C:\Program Files\Alwil Software
        2008-05-04 21:43 . 2008-05-04 21:44 <REP> d-------- C:\Program Files\Windows Defender
        2008-04-20 17:24 . 2008-04-20 17:24 <REP> d-------- C:\Program Files\TVUPlayer
        2008-04-20 17:24 . 2008-04-20 17:24 <REP> d-------- C:\Documents and Settings\All Users\Application Data\TVU Networks
        2008-04-19 18:54 . 2008-04-19 18:54 <REP> d-------- C:\Documents and Settings\ben\LocalLow
        2008-04-16 11:56 . 2006-11-29 13:06 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll
        2008-04-16 11:55 . 2008-04-16 11:55 <REP> d-------- C:\Program Files\Microsoft SQL Server Compact Edition
        2008-04-16 11:43 . 2008-04-16 11:48 <REP> d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller
        2008-04-16 11:43 . 2008-04-16 11:43 <REP> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
        2008-04-15 09:32 . 2008-04-16 01:04 <REP> d-------- C:\Documents and Settings\ben\Application Data\Skype
        2008-04-15 07:58 . 2008-04-15 07:58 <REP> d-------- C:\Program Files\Gabest
        2008-04-15 07:58 . 2008-04-15 07:58 <REP> d-------- C:\Program Files\AviSynth 2.5
        2008-04-14 17:27 . 2008-04-14 17:27 <REP> d-------- C:\Program Files\CAM Development
        2008-04-14 17:27 . 2008-04-14 17:27 <REP> d-------- C:\Documents and Settings\All Users\Application Data\CAM Development
        2008-04-14 17:25 . 2008-04-14 17:25 285,134 --a------ C:\Death_Note_Japanese_R3-[cdcovers_cc]-cd1.jpg
        2008-04-14 17:23 . 2008-04-16 16:27 <REP> d-------- C:\Program Files\Visual Labels
        2008-04-13 21:24 . 2008-04-13 21:24 <REP> d-------- C:\Program Files\iPod
        2008-04-13 21:22 . 2008-04-13 21:23 <REP> d-------- C:\Program Files\QuickTime
        2008-04-13 11:12 . 2008-04-13 11:12 <REP> d-------- C:\Program Files\coverXP
        2008-04-13 09:53 . 2008-04-13 09:53 <REP> d-------- C:\Documents and Settings\ben\Application Data\Talkback
        2008-04-13 09:52 . 2008-04-13 09:52 <REP> d-------- C:\Documents and Settings\ben\Application Data\CyberLink
        2008-04-12 23:05 . 2008-04-12 23:05 <REP> d-------- C:\Documents and Settings\ben\Application Data\TVU Networks
        2008-04-12 22:58 . 2008-04-12 22:58 <REP> d-------- C:\Documents and Settings\ben\Application Data\Sonic
        2008-04-12 22:58 . 2008-04-12 22:58 <REP> d-------- C:\Documents and Settings\ben\Application Data\Leadertech
        2008-04-12 22:53 . 2008-05-06 15:50 <REP> d-------- C:\Documents and Settings\ben\Application Data\uTorrent
        2008-04-12 22:39 . 2008-04-13 14:08 <REP> d-------- C:\Documents and Settings\ben\Application Data\DivX
        2008-04-12 20:12 . 2008-05-05 00:00 <REP> d-------- C:\Program Files\OneStepSearch
        2008-04-12 19:16 . 2008-04-13 11:23 <REP> d-------- C:\Documents and Settings\ben\Application Data\Apple Computer
        2008-04-12 19:15 . 2008-04-12 19:15 <REP> d-------- C:\Documents and Settings\ben\Application Data\HotSync
        2008-04-12 19:14 . 2008-04-12 19:38 <REP> d--h----- C:\Documents and Settings\ben\Voisinage réseau
        2008-04-12 19:14 . 2004-08-16 17:55 <REP> d--h----- C:\Documents and Settings\ben\Voisinage d'impression
        2008-04-12 19:14 . 2004-08-16 17:55 <REP> d--h----- C:\Documents and Settings\ben\Modèles
        2008-04-12 19:14 . 2008-05-05 11:15 <REP> dr------- C:\Documents and Settings\ben\Mes documents
        2008-04-12 19:14 . 2004-08-16 17:55 <REP> dr------- C:\Documents and Settings\ben\Menu Démarrer
        2008-04-12 19:14 . 2008-05-06 09:58 <REP> dr------- C:\Documents and Settings\ben\Favoris
        2008-04-12 19:14 . 2008-05-06 16:12 <REP> dr------- C:\Documents and Settings\ben\Bureau
        2008-04-12 19:14 . 2005-06-10 16:33 <REP> d-------- C:\Documents and Settings\ben\Application Data\You've Got Pictures Screensaver
        2008-04-12 19:14 . 2005-06-10 16:36 <REP> d-------- C:\Documents and Settings\ben\Application Data\Symantec
        2008-04-12 19:14 . 2005-06-10 16:26 <REP> d-------- C:\Documents and Settings\ben\Application Data\ATI
        2008-04-12 19:14 . 2008-05-05 14:13 <REP> d-------- C:\Documents and Settings\ben
        2008-04-12 19:14 . 2008-05-06 16:20 327,680 --ah----- C:\Documents and Settings\ben\ntuser.dat.LOG
        2008-04-10 22:25 . 2008-04-10 22:25 <REP> d-------- C:\Program Files\Cucusoft
        2008-04-10 22:25 . 2004-10-12 14:40 2,255,360 --a------ C:\WINDOWS\system32\libavcodec.dll
        2008-04-10 22:25 . 2004-10-12 14:46 1,761,280 --a------ C:\WINDOWS\system32\ffdshow.ax
        2008-04-10 22:25 . 2004-10-05 16:16 395,776 --a------ C:\WINDOWS\system32\libmplayer.dll
        2008-04-10 22:25 . 2004-10-12 14:42 262,144 --a------ C:\WINDOWS\system32\TomsMoComp_ff.dll
        2008-04-10 22:25 . 2003-04-03 00:17 172,032 --a------ C:\WINDOWS\system32\ac3filter.ax
        2008-04-10 22:25 . 2004-10-04 01:50 112,640 --a------ C:\WINDOWS\system32\libmpeg2_ff.dll
        2008-04-10 19:06 . 2008-04-12 10:00 <REP> d-------- C:\Poker
        2008-04-10 18:11 . 2008-04-10 18:22 <REP> d-------- C:\Program Files\LimeWire
        2008-04-10 18:11 . 2008-04-12 10:39 <REP> d-------- C:\Documents and Settings\DOM\Application Data\LimeWire
        2008-04-09 15:59 . 2008-04-09 15:59 <REP> d-------- C:\Documents and Settings\All Users\Application Data\DVD Shrink

        .
        (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
        .
        2008-04-20 09:05 --------- d-----w C:\Program Files\MSN Games
        2008-04-20 09:02 --------- d-----w C:\Program Files\EA GAMES
        2008-04-17 16:04 --------- d-----w C:\Program Files\Windows Live
        2008-04-15 05:48 --------- d-----w C:\Program Files\WinAVI MP4 Converter
        2008-04-15 05:44 --------- d-----w C:\Program Files\Aglare Mp4 to AVI Converter
        2008-04-14 07:33 --------- d-----w C:\Program Files\iTunes
        2008-04-13 18:23 --------- d-----w C:\Program Files\MSN Messenger
        2008-04-13 08:21 --------- d-----w C:\Documents and Settings\DOM\Application Data\uTorrent
        2008-04-13 07:46 --------- d-----w C:\Program Files\DivX
        2008-04-06 08:23 --------- d-----w C:\Program Files\Microsoft Money 2005
        2008-04-06 08:12 --------- d-----w C:\Program Files\Messenger Plus! Live
        2008-04-05 11:52 8,585 ----a-w C:\WINDOWS\Fonts\spread_bita10.zip
        2008-04-05 11:46 7,860 ----a-w C:\WINDOWS\Fonts\fisk_bitmap_nr2.zip
        2008-04-05 11:46 6,384 ----a-w C:\WINDOWS\Fonts\mizufontalphabet.zip
        2008-04-05 11:45 61,209 ----a-w C:\WINDOWS\Fonts\oloron.zip
        2008-04-05 11:44 104,194 ----a-w C:\WINDOWS\Fonts\asenine.zip
        2008-04-05 11:43 23,754 ----a-w C:\WINDOWS\Fonts\sanserifing.zip
        2008-04-05 11:42 27,561 ----a-w C:\WINDOWS\Fonts\redhead_goddess.zip
        2008-04-05 11:42 219,972 ----a-w C:\WINDOWS\Fonts\hurtmold.zip
        2008-04-05 11:41 83,279 ----a-w C:\WINDOWS\Fonts\anywhere.zip
        2008-04-05 11:41 16,400 ----a-w C:\WINDOWS\Fonts\zebra_110.zip
        2008-04-05 11:41 15,121 ----a-w C:\WINDOWS\Fonts\vargas.zip
        2008-04-05 11:40 11,343 ----a-w C:\WINDOWS\Fonts\herrliches_script.zip
        2008-04-05 11:35 11,538 ----a-w C:\WINDOWS\Fonts\katakana.zip
        2008-03-30 06:12 --------- d-----w C:\Program Files\Java
        2008-03-27 17:51 --------- d-----w C:\Program Files\Windows Live Safety Center
        2008-03-20 08:09 1,845,376 ----a-w C:\WINDOWS\system32\win32k.sys
        2008-03-20 08:09 1,845,376 ------w C:\WINDOWS\system32\dllcache\win32k.sys
        2008-03-01 16:28 3,591,680 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
        2008-02-29 08:57 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe
        2008-02-29 08:56 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe
        2008-02-22 10:00 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
        2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
        2008-02-20 06:51 282,624 ------w C:\WINDOWS\system32\dllcache\gdi32.dll
        2008-02-20 05:35 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
        2008-02-20 05:35 45,568 ------w C:\WINDOWS\system32\dllcache\dnsrslvr.dll
        2008-02-20 05:35 148,992 ------w C:\WINDOWS\system32\dllcache\dnsapi.dll
        2008-02-15 05:44 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll
        2007-05-30 12:08 480,848 ----a-w C:\Documents and Settings\All Users\Application Data\pswi_preloaded.exe
        2007-04-05 08:38 836 ----a-w C:\Documents and Settings\DOM\Application Data\ViewerApp.dat
        2006-05-19 06:57 31 ----a-w C:\Documents and Settings\DOMINIQUE\getfile.dat
        2006-04-09 21:31 31 ----a-w C:\Documents and Settings\FAMILLE\getfile.dat
        2006-04-03 13:52 100,816 ----a-w C:\Documents and Settings\DOMINIQUE\Application Data\GDIPFONTCACHEV1.DAT
        2007-11-07 13:39 168 --sh--r C:\WINDOWS\system32\93B7F23EBD.sys
        2007-11-07 13:39 3,766 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
        .

        ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
        .
        .
        REGEDIT4
        *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

        [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
        "{4E7BD74F-2B8D-469E-A0E8-ED6AB685FA7D}"= C:\WINDOWS\system32\pbfrv2.dll [ ]

        [HKEY_CLASSES_ROOT\clsid\{4e7bd74f-2b8d-469e-a0e8-ed6ab685fa7d}]
        [HKEY_CLASSES_ROOT\pbfrv2.PBFRV2]

        [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 14:00 15360]
        "EzStatus"="C:\Apps\EZHome\EZStatus.exe" [2004-12-20 21:03 94208]

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-05 14:00 208952]
        "PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-05 14:00 455168]
        "PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-05 14:00 455168]
        "Raccourci vers la page des propriétés de High Definition Audio"="HDAudPropShortcut.exe" [2004-03-17 15:10 61952 C:\WINDOWS\system32\Hdaudpropshortcut.exe]
        "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
        "ccApp"="C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe" [2004-09-07 15:25 58488]
        "HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe" [2003-05-07 21:56 188416]
        "HPHUPD05"="C:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" [2003-05-23 05:03 49152]
        "HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-04-08 12:45 212992]
        "HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [2002-12-17 11:40 49152]
        "HPHmon05"="C:\WINDOWS\system32\hphmon05.exe" [2003-05-23 04:56 483328]
        "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-30 21:05 344064]
        "TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2006-11-17 12:41 180269]
        "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 20:51 39792]
        "SoundMan"="SOUNDMAN.EXE" [2005-06-21 15:09 90112 C:\WINDOWS\SOUNDMAN.EXE]
        "AlcWzrd"="ALCWZRD.EXE" [2005-06-29 13:26 2806272 C:\WINDOWS\ALCWZRD.EXE]
        "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20 866584]
        "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-03-29 19:37 79224]
        "My Web Search Bar Search Scope Monitor"="C:\PROGRA~1\MYWEBS~1\bar\2.bin\m3SrchMn.exe" [ ]
        "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-03-28 23:37 413696]

        [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
        "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 14:00 15360]
        "EzStatus"="C:\Apps\EZHome\EZStatus.exe" [2004-12-20 21:03 94208]

        [HKEY_LOCAL_MACHINE\software\microsoft\security center]
        "AntiVirusDisableNotify"=dword:00000001
        "AntiVirusOverride"=dword:00000001

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
        "%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\logo_ubi.exe"=
        "%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\pandora.exe"=
        "%windir%\\system32\\sessmgr.exe"=
        "C:\\APPS\\Inventime\\my.exe"=
        "C:\\APPS\\skype\\phone\\Skype.exe"=
        "C:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
        "C:\\APPS\\Powercinema\\PowerCinema.exe"=
        "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"=
        "C:\\WINDOWS\\system32\\rtcshare.exe"=
        "C:\\Program Files\\Kodak\\Printer Dock\\Kodak Wireless Printer Computer Setup Assistant.exe"=
        "C:\\Program Files\\uTorrent\\utorrent.exe"=
        "C:\\Program Files\\palmOne\\Hotsync.exe"=
        "C:\\Program Files\\LimeWire\\LimeWire.exe"=
        "C:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
        "C:\\Program Files\\TVUPlayer\\TVUPlayer.exe"=
        "C:\\Program Files\\Messenger\\msmsgs.exe"=
        "C:\\Program Files\\iTunes\\iTunes.exe"=
        "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
        "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
        "C:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\Kodak Software Updater.exe"=
        "%windir%\\Network Diagnostic\\xpnetdiag.exe"=

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
        "6112:UDP"= 6112:UDP:azur1
        "6112:TCP"= 6112:TCP:azur1

        R0 sonypvl3;sonypvl3;C:\WINDOWS\system32\drivers\sonypvl3.sys [2004-09-22 12:55]
        R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 19:31]
        R1 sonypvf3;sonypvf3;C:\WINDOWS\system32\drivers\sonypvf3.sys [2004-11-15 14:55]
        R1 sonypvt3;sonypvt3;C:\WINDOWS\system32\drivers\sonypvt3.sys [2004-12-06 15:26]
        R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]
        R3 3xHybrid;3xHybrid service;C:\WINDOWS\system32\DRIVERS\3xHybrid.sys [2004-11-08 18:59]
        R3 camvid20;Philips ToUcam Camera; Video;C:\WINDOWS\system32\DRIVERS\camdrv21.sys []
        R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]
        S1 sonypvd3;Sony DVD Handycam;C:\WINDOWS\system32\DRIVERS\sonypvd3.sys [2004-12-07 16:00]
        S3 Boonty Games;Boonty Games;"C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe" [2006-02-05 19:47]
        S3 USB_RNDIS_51;Broadcom USB Remote NDIS Device Driver;C:\WINDOWS\system32\DRIVERS\usb8023.sys [2004-08-05 14:00]
        S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
        S3 ZD1211U(Wireless);IEEE 802.11g USB Adapter Driver(Wireless);C:\WINDOWS\system32\DRIVERS\zd1211u.sys []

        *Newly Created Service* - CATCHME
        .
        Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
        "2008-05-06 14:00:00 C:\WINDOWS\Tasks\ABA93B2791A6ACC3.job"
        - c:\docume~1\mathilde\applic~1\chicsi~1\Part real the.exe
        "2008-04-10 09:32:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
        - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
        "2008-02-03 11:07:00 C:\WINDOWS\Tasks\HP DArC Task #Hewlett-Packard#7600#MY3852322CK2.job"
        - C:\Program Files\HP\hpcoretech\comp\hpdarc.exe$/#Hewlett-Packard#7600#MY3852322CK2
        "2008-05-06 14:06:00 C:\WINDOWS\Tasks\HP Usg Daily.job"
        - C:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\pexpress\hphped05.exe
        "2008-05-06 07:37:50 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
        - C:\Program Files\Windows Defender\MpCmdRun.exe
        "2005-06-17 11:18:38 C:\WINDOWS\Tasks\Rappel d'enregistrement 1.job"
        - C:\WINDOWS\system32\OOBE\oobebaln.exe
        "2008-05-06 13:10:00 C:\WINDOWS\Tasks\Symantec NetDetect.job"
        - C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE
        "2008-05-06 14:19:02 C:\WINDOWS\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job"
        - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
        .
        **************************************************************************

        catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
        Rootkit scan 2008-05-06 16:20:29
        Windows 5.1.2600 Service Pack 2 NTFS

        Balayage processus cachés ...

        Balayage caché autostart entries ...

        Balayage des fichiers cachés ...

        Scan terminé avec succès
        Les fichiers cachés: 0

        **************************************************************************

        [HKEY_LOCAL_MACHINE\system\ControlSet003\Services\MysqlInventime]
        "ImagePath"="c:\mysql\bin\mysqld-nt MysqlInventime"
        .
        Temps d'accomplissement: 2008-05-06 16:21:24
        ComboFix-quarantined-files.txt 2008-05-06 14:21:12

        Pre-Run: 99,725,164,544 octets libres
        Post-Run: 100,563,988,480 octets libres

        363 --- E O F --- 2008-05-06 01:02:29

        Malwarebytes' Anti-Malware 1.12
        Version de la base de données: 723

        Type de recherche: Examen complet (C:\|D:\|)
        Eléments examinés: 254206
        Temps écoulé: 49 minute(s), 15 second(s)

        Processus mémoire infecté(s): 0
        Module(s) mémoire infecté(s): 0
        Clé(s) du Registre infectée(s): 121
        Valeur(s) du Registre infectée(s): 4
        Elément(s) de données du Registre infecté(s): 0
        Dossier(s) infecté(s): 5
        Fichier(s) infecté(s): 111

        Processus mémoire infecté(s):
        (Aucun élément nuisible détecté)

        Module(s) mémoire infecté(s):
        (Aucun élément nuisible détecté)

        Clé(s) du Registre infectée(s):
        HKEY_CLASSES_ROOT\pbfrv2.pbfrv2 (Adware.2020Search) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\CLSID\{4e7bd74f-2b8d-469e-a0e8-ed6ab685fa7d} (Adware.2020Search) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{5b4c3b43-49b6-42a7-a602-f7acdca0d409} (Adware.OneStepSearch) -> Quarantined and deleted successfully.
        HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{5b4c3b43-49b6-42a7-a602-f7acdca0d409} (Adware.OneStepSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\CLSID\{00a6faf6-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\CLSID\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\mywebsearchtoolbar.settingsplugin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\mywebsearchtoolbar.settingsplugin.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\CLSID\{07b18eab-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{07b18eab-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\funwebproducts.iecookiesmanager (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\funwebproducts.iecookiesmanager.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\CLSID\{1e0de227-5ce4-4ea3-ab0c-8b03e1aa76bc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\funwebproducts.datacontrol.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{25560540-9571-4d7b-9389-0f166788785a} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\funwebproducts.shellviewcontrol (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\funwebproducts.shellviewcontrol.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{2eff3cf7-99c1-4c29-bc2b-68e057e22340} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\funwebproducts.htmlmenu (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\funwebproducts.htmlmenu.2 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3dc201fb-e9c9-499c-a11f-23c360d7c3f8} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\mywebsearch.htmlpanel (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\mywebsearch.htmlpanel.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3e720452-b472-4954-b7aa-33069eb53906} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\mywebsearchtoolbar.toolbarplugin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\mywebsearchtoolbar.toolbarplugin.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\funwebproducts.popswattersettingscontrol (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\funwebproducts.popswattersettingscontrol.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{63d0ed2c-b45b-4458-8b3b-60c69bbbd83c} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\mywebsearch.pseudotransparentplugin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\mywebsearch.pseudotransparentplugin.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\CLSID\{7473d294-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7473d294-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\CLSID\{7473d296-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\funwebproducts.popswatterbarbutton (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\funwebproducts.popswatterbarbutton.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\funwebproducts.htmlmenu.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{98d9753d-d73b-42d5-8c85-4469cda897ab} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\screensavercontrol.screensaverinstaller (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\screensavercontrol.screensaverinstaller.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9ff05104-b030-46fc-94b8-81276e4e27df} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\CLSID\{a4730ebe-43a6-443e-9776-36915d323ad3} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\funwebproducts.browseroverlayembed (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\funwebproducts.browseroverlayembed.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\CLSID\{a6573479-9075-4a65-98a6-19fd29cf7374} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{a6573479-9075-4a65-98a6-19fd29cf7374} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\mywebsearch.outlookaddin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\mywebsearch.outlookaddin.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\funwebproducts.killerobjmanager (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\funwebproducts.killerobjmanager.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\funwebproducts.historykillerscheduler (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\funwebproducts.historykillerscheduler.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\funwebproducts.historyswattercontrolbar (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\funwebproducts.historyswattercontrolbar.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\funwebproducts.browseroverlaybarbutton (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\funwebproducts.browseroverlaybarbutton.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\CLSID\{d778513b-1c40-4819-b0c5-49e40b39afd0} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\mywebsearch.chatsessionplugin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\mywebsearch.chatsessionplugin.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\CLSID\{e79dfbca-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{e79dfbca-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\Interface\{07b18eaa-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\Interface\{07b18eac-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\Interface\{f87d7fb5-9dc5-4c8c-b998-d8dfe02e2978} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\Typelib\{07b18ea0-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\Interface\{e342af55-b78a-4cd0-a2bb-da7f52d9d25e} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\Interface\{e342af55-b78a-4cd0-a2bb-da7f52d9d25f} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\Typelib\{0d26bc71-a633-4e71-ad31-eadc3a1b6a3a} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\Interface\{1093995a-ba37-41d2-836e-091067c4ad17} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\Interface\{120927bf-1700-43bc-810f-fab92549b390} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\Interface\{17de5e5e-bfe3-4e83-8e1f-8755795359ec} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\Interface\{1f52a5fa-a705-4415-b975-88503b291728} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\Interface\{247a115f-06c2-4fb3-967d-2d62d3cf4f0a} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\Interface\{2763e333-b168-41a0-a112-d35f96f410c0} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\Interface\{2e3537fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\Typelib\{29d67d3c-509a-4544-903f-c8c1b8236554} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\Interface\{38a7c9da-8db7-4d0f-a7b1-c4b1a305bddb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\Interface\{3e1656ed-f60e-4597-b6aa-b6a58e171495} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\Interface\{3e53e2cb-86db-4a4a-8bd9-ffeb7a64df82} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\Interface\{3e720451-b472-4954-b7aa-33069eb53906} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\Interface\{3e720453-b472-4954-b7aa-33069eb53906} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\Typelib\{3e720450-b472-4954-b7aa-33069eb53906} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\Typelib\{621feacd-8857-43a6-ae26-451d670d5370} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\Interface\{63d0ed2b-b45b-4458-8b3b-60c69bbbd83c} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\Interface\{63d0ed2d-b45b-4458-8b3b-60c69bbbd83c} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\Interface\{6e74766c-4d93-4cc0-96d1-47b8e07ff9ca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\Interface\{72ee7f04-15bd-4845-a005-d6711144d86a} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\Interface\{7473d291-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\Interface\{7473d293-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\Interface\{7473d295-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\Interface\{7473d297-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\Typelib\{7473d290-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\Interface\{90449521-d834-4703-bb4e-d3aa44042ff8} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\Interface\{991aac62-b100-47ce-8b75-253965244f69} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\Interface\{bbabdc90-f3d5-4801-863a-ee6ae529862d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\Interface\{d6ff3684-ad3b-48eb-bbb4-b9e6c5a355c1} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\Interface\{eb9e5c1c-b1f9-4c2b-be8a-27d6446fdaf8} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\Typelib\{8ca01f0e-987c-49c3-b852-2f1ac4a7094c} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\Interface\{8d292ec0-6792-4a38-82ed-73a087e41ba6} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\Typelib\{8e6f1830-9607-4440-8530-13be7c4b1d14} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\Typelib\{98635087-3f5d-418f-990c-b1efe0797a3b} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\Interface\{a626cdbd-3d13-4f78-b819-440a28d7e8fc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\Typelib\{c8cecde3-1ae1-4c4a-ad82-6d5b00212144} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\Interface\{de38c398-b328-4f4c-a3ad-1b5e4ed93477} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\Typelib\{e47caee0-deea-464a-9326-3f2801535a4d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\Interface\{e79dfbc9-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\Interface\{e79dfbcb-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\Typelib\{e79dfbc0-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\Typelib\{f42228fb-e84e-479e-b922-fbbd096e792c} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\onestepsearch (Adware.OneStepSearch) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\OneStepSearch (Adware.OneStepSearch) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\MIME\Database\Content Type\application/x-f3embed (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyWebSearch bar Uninstall (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CURRENT_USER\Software\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.

        Valeur(s) du Registre infectée(s):
        HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{4e7bd74f-2b8d-469e-a0e8-ed6ab685fa7d} (Adware.2020Search) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media\WMSDK\Sources\f3PopularScreensavers (Adware.MyWebSearch) -> Quarantined and deleted successfully.

        Elément(s) de données du Registre infecté(s):
        (Aucun élément nuisible détecté)

        Dossier(s) infecté(s):
        C:\Program Files\dynamic toolbar (Adware.2020search) -> Quarantined and deleted successfully.
        C:\Program Files\dynamic toolbar\Cache (Adware.2020search) -> Quarantined and deleted successfully.
        C:\Program Files\dynamic toolbar\PBFRV2 (Adware.2020search) -> Quarantined and deleted successfully.
        C:\Program Files\dynamic toolbar\PBFRV2\Cache (Adware.2020search) -> Quarantined and deleted successfully.
        C:\Program Files\OneStepSearch (Adware.OneStepSearch) -> Quarantined and deleted successfully.

        Fichier(s) infecté(s):
        C:\Program Files\MSN Messenger\riched20.dll (Adware.MyWeb.FunWeb) -> Quarantined and deleted successfully.
        C:\QooBox\Quarantine\C\Program Files\Internet Explorer\msimg32.dll.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\F3BROVLY.DLL.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\F3CJPEG.DLL.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\F3HISTSW.DLL.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\F3HTTPCT.DLL.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\F3IMSTUB.DLL.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\F3POPSWT.DLL.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\F3PSSAVR.SCR.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\F3REPROX.DLL.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\F3RESTUB.DLL.vir (Adware.MyWeb.FunWeb) -> Quarantined and deleted successfully.
        C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\F3SCHMON.EXE.vir (Adware.MyWeb.FunWeb) -> Quarantined and deleted successfully.
        C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\F3SCRCTR.DLL.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\F3SHLLVW.DLL.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\F3WPHOOK.DLL.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\M3IDLE.DLL.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\M3IMPIPE.EXE.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\M3OUTLCN.DLL.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\M3SKIN.DLL.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\M3SKPLAY.EXE.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\MWSOEMON.EXE.vir (Adware.MyWebSearch) -> Delete on reboot.
        C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\2.bin\MWSOESTB.DLL.vir (Adware.MyWebSearch) -> Delete on reboot.
        C:\QooBox\Quarantine\C\WINDOWS\system32\f3PSSavr.scr.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP847\A0290631.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP847\A0290634.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP847\A0290635.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP847\A0290637.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP847\A0290639.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP847\A0290640.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP847\A0290641.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP847\A0290642.SCR (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP847\A0290643.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP847\A0290644.DLL (Adware.MyWeb.FunWeb) -> Quarantined and deleted successfully.
        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP847\A0290645.EXE (Adware.MyWeb.FunWeb) -> Quarantined and deleted successfully.
        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP847\A0290646.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP847\A0290647.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP847\A0290648.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP847\A0290651.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP847\A0290652.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP847\A0290655.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP847\A0290657.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP847\A0290658.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP847\A0290661.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP847\A0290663.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP847\A0290671.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP847\A0290672.scr (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\dynamic toolbar\batch.bat (Adware.2020search) -> Quarantined and deleted successfully.
        C:\Program Files\dynamic toolbar\unins000.dat (Adware.2020search) -> Quarantined and deleted successfully.
        C:\Program Files\dynamic toolbar\unins000.exe (Adware.2020search) -> Quarantined and deleted successfully.
        C:\Program Files\dynamic toolbar\Cache\go.bmp (Adware.2020search) -> Quarantined and deleted successfully.
        C:\Program Files\dynamic toolbar\Cache\home.bmp (Adware.2020search) -> Quarantined and deleted successfully.
        C:\Program Files\dynamic toolbar\Cache\logo_pb.bmp (Adware.2020search) -> Quarantined and deleted successfully.
        C:\Program Files\dynamic toolbar\Cache\parent_off.bmp (Adware.2020search) -> Quarantined and deleted successfully.
        C:\Program Files\dynamic toolbar\Cache\parent_on.bmp (Adware.2020search) -> Quarantined and deleted successfully.
        C:\Program Files\dynamic toolbar\Cache\pbfrv2tb0200.cfg (Adware.2020search) -> Quarantined and deleted successfully.
        C:\Program Files\dynamic toolbar\Cache\popup_off.bmp (Adware.2020search) -> Quarantined and deleted successfully.
        C:\Program Files\dynamic toolbar\Cache\popup_on.bmp (Adware.2020search) -> Quarantined and deleted successfully.
        C:\Program Files\dynamic toolbar\Cache\search.bmp (Adware.2020search) -> Quarantined and deleted successfully.
        C:\Program Files\dynamic toolbar\Cache\services.bmp (Adware.2020search) -> Quarantined and deleted successfully.
        C:\Program Files\dynamic toolbar\Cache\skin.bmp (Adware.2020search) -> Quarantined and deleted successfully.
        C:\Program Files\dynamic toolbar\Cache\skin1.bmp (Adware.2020search) -> Quarantined and deleted successfully.
        C:\Program Files\dynamic toolbar\Cache\skin2.bmp (Adware.2020search) -> Quarantined and deleted successfully.
        C:\Program Files\dynamic toolbar\Cache\skin3.bmp (Adware.2020search) -> Quarantined and deleted successfully.
        C:\Program Files\dynamic toolbar\Cache\skin4.bmp (Adware.2020search) -> Quarantined and deleted successfully.
        C:\Program Files\dynamic toolbar\Cache\skin5.bmp (Adware.2020search) -> Quarantined and deleted successfully.
        C:\Program Files\dynamic toolbar\Cache\store.bmp (Adware.2020search) -> Quarantined and deleted successfully.
        C:\Program Files\dynamic toolbar\Cache\style.css (Adware.2020search) -> Quarantined and deleted successfully.
        C:\Program Files\dynamic toolbar\Cache\support.bmp (Adware.2020search) -> Quarantined and deleted successfully.
        C:\Program Files\dynamic toolbar\Cache\ticker.xml (Adware.2020search) -> Quarantined and deleted successfully.
        C:\Program Files\dynamic toolbar\PBFRV2\Cache\ErrorLog.txt (Adware.2020search) -> Quarantined and deleted successfully.
        C:\Program Files\dynamic toolbar\PBFRV2\Cache\go.bmp (Adware.2020search) -> Quarantined and deleted successfully.
        C:\Program Files\dynamic toolbar\PBFRV2\Cache\home.bmp (Adware.2020search) -> Quarantined and deleted successfully.
        C:\Program Files\dynamic toolbar\PBFRV2\Cache\logo_pb.bmp (Adware.2020search) -> Quarantined and deleted successfully.
        C:\Program Files\dynamic toolbar\PBFRV2\Cache\parent_off.bmp (Adware.2020search) -> Quarantined and deleted successfully.
        C:\Program Files\dynamic toolbar\PBFRV2\Cache\parent_on.bmp (Adware.2020search) -> Quarantined and deleted successfully.
        C:\Program Files\dynamic toolbar\PBFRV2\Cache\PBFRV2TB0200.cfg (Adware.2020search) -> Quarantined and deleted successfully.
        C:\Program Files\dynamic toolbar\PBFRV2\Cache\popup_off.bmp (Adware.2020search) -> Quarantined and deleted successfully.
        C:\Program Files\dynamic toolbar\PBFRV2\Cache\popup_on.bmp (Adware.2020search) -> Quarantined and deleted successfully.
        C:\Program Files\dynamic toolbar\PBFRV2\Cache\search.bmp (Adware.2020search) -> Quarantined and deleted successfully.
        C:\Program Files\dynamic toolbar\PBFRV2\Cache\services.bmp (Adware.2020search) -> Quarantined and deleted successfully.
        C:\Program Files\dynamic toolbar\PBFRV2\Cache\skin.bmp (Adware.2020search) -> Quarantined and deleted successfully.
        C:\Program Files\dynamic toolbar\PBFRV2\Cache\skin1.bmp (Adware.2020search) -> Quarantined and deleted successfully.
        C:\Program Files\dynamic toolbar\PBFRV2\Cache\skin2.bmp (Adware.2020search) -> Quarantined and deleted successfully.
        C:\Program Files\dynamic toolbar\PBFRV2\Cache\skin3.bmp (Adware.2020search) -> Quarantined and deleted successfully.
        C:\Program Files\dynamic toolbar\PBFRV2\Cache\skin4.bmp (Adware.2020search) -> Quarantined and deleted successfully.
        C:\Program Files\dynamic toolbar\PBFRV2\Cache\skin5.bmp (Adware.2020search) -> Quarantined and deleted successfully.
        C:\Program Files\dynamic toolbar\PBFRV2\Cache\store.bmp (Adware.2020search) -> Quarantined and deleted successfully.
        C:\Program Files\dynamic toolbar\PBFRV2\Cache\style.css (Adware.2020search) -> Quarantined and deleted successfully.
        C:\Program Files\dynamic toolbar\PBFRV2\Cache\support.bmp (Adware.2020search) -> Quarantined and deleted successfully.
        C:\Program Files\dynamic toolbar\PBFRV2\Cache\ticker.xml (Adware.2020search) -> Quarantined and deleted successfully.
        C:\Program Files\dynamic toolbar\PBFRV2\Cache\_Ticker_ticker.txt (Adware.2020search) -> Quarantined and deleted successfully.
        C:\Program Files\OneStepSearch\home.js (Adware.OneStepSearch) -> Quarantined and deleted successfully.
        C:\Program Files\OneStepSearch\onestep.dll (Adware.OneStepSearch) -> Quarantined and deleted successfully.
        C:\Program Files\OneStepSearch\osopt.exe (Adware.OneStepSearch) -> Quarantined and deleted successfully.
        C:\Program Files\OneStepSearch\readme.html (Adware.OneStepSearch) -> Quarantined and deleted successfully.
        C:\Program Files\OneStepSearch\uninstall.exe (Adware.OneStepSearch) -> Quarantined and deleted successfully.
        C:\WINDOWS\Fonts\anywhere.zip (Trojan.Downloader) -> Quarantined and deleted successfully.
        C:\WINDOWS\Fonts\asenine.zip (Trojan.Downloader) -> Quarantined and deleted successfully.
        C:\WINDOWS\Fonts\fisk_bitmap_nr2.zip (Trojan.Downloader) -> Quarantined and deleted successfully.
        C:\WINDOWS\Fonts\got_heroin.zip (Trojan.Downloader) -> Quarantined and deleted successfully.
        C:\WINDOWS\Fonts\herrliches_script.zip (Trojan.Downloader) -> Quarantined and deleted successfully.
        C:\WINDOWS\Fonts\hurtmold.zip (Trojan.Downloader) -> Quarantined and deleted successfully.
        C:\WINDOWS\Fonts\katakana.zip (Trojan.Downloader) -> Quarantined and deleted successfully.
        C:\WINDOWS\Fonts\mizufontalphabet.zip (Trojan.Downloader) -> Quarantined and deleted successfully.
        C:\WINDOWS\Fonts\oloron.zip (Trojan.Downloader) -> Quarantined and deleted successfully.
        C:\WINDOWS\Fonts\redhead_goddess.zip (Trojan.Downloader) -> Quarantined and deleted successfully.
        C:\WINDOWS\Fonts\sanserifing.zip (Trojan.Downloader) -> Quarantined and deleted successfully.
        C:\WINDOWS\Fonts\spread_bita10.zip (Trojan.Downloader) -> Quarantined and deleted successfully.
        C:\WINDOWS\Fonts\vargas.zip (Trojan.Downloader) -> Quarantined and deleted successfully.
        C:\WINDOWS\Fonts\zebra_110.zip (Trojan.Downloader) -> Quarantined and deleted successfully.

        # Rapport Lopxp fait le 06/05/2008 à 17:50:46
        # Exécuté dans : C:\Program Files\Lopxp
        # Version 3.10 - Maj du 11/04/2008

        Killing 'iexplore.exe'
        "C:\Program Files\internet explorer\iexplore.exe" (2284)

        ========== Listing des dossiers Application Data

        +- C:\Documents and Settings\Administrateur\Application Data

        2005-06-10 à 14:26:14 - ATI
        2004-08-16 à 16:19:22 - Identities
        2006-05-20 à 11:12:14 - Microsoft
        2005-06-10 à 14:39:20 - Real
        2005-06-10 à 14:26:36 - Sun
        2005-06-10 à 14:36:11 - Symantec
        2005-06-10 à 14:33:33 - You've Got Pictures Screensaver

        +- C:\Documents and Settings\Administrateur\Local Settings\Application Data

        2006-02-22 à 18:08:02 - ApplicationHistory
        2005-06-10 à 14:26:14 - ATI
        2006-05-20 à 11:12:14 - Microsoft
        2005-06-10 à 14:41:40 - PowerCinema
        2005-06-10 à 14:26:26 - {7148F0A6-6813-11D6-A77B-00B0D0142050}

        +- C:\Documents and Settings\All Users\Application Data

        2005-11-19 à 17:21:50 - 4D
        2007-08-03 à 20:06:08 - Adobe
        2005-11-29 à 13:11:52 - AOL
        2008-02-10 à 10:55:08 - Apple
        2007-01-08 à 16:28:54 - Apple Computer
        2006-02-05 à 11:25:59 - ArcSoft
        2008-01-20 à 09:47:41 - Azureus
        2006-02-05 à 17:47:07 - BOONTY
        2008-04-14 à 15:27:28 - CAM Development
        2007-02-04 à 14:28:24 - Corel
        2005-09-21 à 16:52:48 - CyberLink
        2006-12-21 à 23:44:35 - DataViz
        2008-04-09 à 13:59:54 - DVD Shrink
        2005-12-15 à 08:10:20 - Global Software Publishing
        2007-11-11 à 09:13:29 - Google
        2006-10-09 à 16:45:25 - HotSync
        2006-08-31 à 18:24:41 - Kodak
        2007-02-23 à 15:30:57 - Macrovision
        2008-05-06 à 14:41:22 - Malwarebytes
        2006-03-15 à 17:44:01 - Messenger Plus!
        2008-05-04 à 19:43:59 - Microsoft
        2006-08-27 à 14:49:09 - muvee Technologies
        2005-09-17 à 17:24:30 - NFS Underground
        2006-06-10 à 20:57:44 - PlayFirst
        2006-12-15 à 17:49:39 - Pure Scr Show Ref
        2005-08-27 à 19:22:35 - QuickTime
        2006-09-02 à 12:14:21 - Sandlot Games
        2004-08-16 à 16:28:48 - SBSI
        2007-02-03 à 18:21:13 - Skype
        2006-05-20 à 10:13:49 - Symantec
        2007-02-11 à 18:42:08 - TEMP
        2008-04-20 à 15:24:30 - TVU Networks
        2006-05-21 à 12:47:24 - Windows Genuine Advantage
        2006-12-22 à 00:32:48 - Windows Live Toolbar
        2007-10-23 à 18:04:51 - WinZip
        2008-04-16 à 09:43:23 - WLInstaller
        2007-11-11 à 09:52:53 - Yahoo! Companion
        2007-04-03 à 00:07:50 - Zylom

        +- C:\Documents and Settings\ben\Application Data

        2008-04-15 à 08:25:52 - Adobe
        2008-04-13 à 09:23:56 - Apple Computer
        2005-06-10 à 14:26:14 - ATI
        2008-04-13 à 07:52:11 - CyberLink
        2008-04-13 à 12:08:19 - DivX
        2008-04-12 à 17:15:07 - HotSync
        2004-08-16 à 16:19:22 - Identities
        2008-04-12 à 20:58:45 - Leadertech
        0
        1. jlpjlp Contributeur sécurité
          pour fusionner:

          http://img.photobucket.com/albums/v666/sUBs/CFScript.gif

          _______________

          telecharge combofix:

          http://download.bleepingcomputer.com/sUBs/ComboFix.exe
          Sauvegarde le sur ton bureau et pas ailleurs !

          Ferme tout tes navigateurs (donc copie ou imprime les instructions avant)

          Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :

          File::
          C:\WINDOWS\system32\pbfrv2.dll

          Registry::
          [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
          "{4E7BD74F-2B8D-469E-A0E8-ED6AB685FA7D}"=-
          [HKEY_CLASSES_ROOT\pbfrv2.PBFRV2]

          Enregistre ce fichier sous le nom CFscript

          Fait un glisser/déposer de ce fichier CFscrïpt sur le fichier ComboFix.exe

          Clique sur le fichier CFScript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFScript vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.

          Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

          Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

          Ne touche à rien tant que le scan n'est pas terminé.

          Une fois le scan achevé, un rapport va s'afficher: poste son contenu.

          Remets aussi un rapport Hijackthis

          Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

          _________________

          refais lop xp et colle un rapport entier cette fois
          0
          2. knobi Auteur
            desole pour le timing g ete tres occupe voila donc les 3 rapports

            ComboFix 08-05-15.3 - ben 2008-05-16 19:00:16.2 - NTFSx86
            Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.1515 [GMT 2:00]
            Endroit: C:\Documents and Settings\ben\Bureau\Combo-Fix3.exe
            Command switches used :: C:\Documents and Settings\ben\Bureau\CFscript.doc
            * Création d'un nouveau point de restauration
            .

            (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
            .

            C:\Documents and Settings\DOM\Menu Démarrer\Programmes\Spyware-Secure
            C:\Documents and Settings\DOM\Menu Démarrer\Programmes\Spyware-Secure\Spyware-Secure.lnk
            C:\Documents and Settings\DOM\Menu Démarrer\Programmes\Spyware-Secure\Website.lnk
            C:\WINDOWS\system32\MSINET.oca

            .
            ((((((((((((((((((((((((((((( Fichiers créés 2008-04-16 to 2008-05-16 ))))))))))))))))))))))))))))))))))))
            .

            2008-05-16 18:58 . 2008-05-16 18:58 <REP> d-------- C:\Combo-Fix2
            2008-05-16 14:32 . 2008-05-16 14:32 130,960 --a------ C:\Documents and Settings\ben\Application Data\GDIPFONTCACHEV1.DAT
            2008-05-13 09:27 . 2008-05-13 09:27 <REP> d-------- C:\Documents and Settings\DOM\Application Data\Search Settings
            2008-05-07 16:03 . 2008-05-07 16:03 <REP> d-------- C:\Documents and Settings\ben\Application Data\Search Settings
            2008-05-07 14:00 . 2008-05-07 14:00 <REP> d-------- C:\Program Files\Search Settings
            2008-05-07 13:59 . 2008-05-07 20:47 <REP> d-------- C:\Program Files\Free Audio Pack
            2008-05-07 13:49 . 2008-05-09 16:32 <REP> d-------- C:\Documents and Settings\ben\Application Data\LimeWire
            2008-05-07 10:00 . 2008-05-07 10:04 <REP> d-------- C:\Program Files\MediaCoder
            2008-05-06 17:50 . 2008-05-06 17:50 <REP> d-------- C:\Program Files\Lopxp
            2008-05-06 16:41 . 2008-05-06 16:41 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
            2008-05-06 16:41 . 2008-05-06 16:41 <REP> d-------- C:\Documents and Settings\ben\Application Data\Malwarebytes
            2008-05-06 16:41 . 2008-05-06 16:41 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
            2008-05-06 16:41 . 2008-05-05 20:46 27,048 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
            2008-05-06 16:41 . 2008-05-05 20:46 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
            2008-05-06 16:14 . 2008-05-06 16:21 <REP> d-------- C:\Combo-Fix
            2008-05-05 19:48 . 2008-05-05 19:48 <REP> d-------- C:\Program Files\Trend Micro
            2008-05-04 21:57 . 2008-05-04 21:57 <REP> d-------- C:\Program Files\Alwil Software
            2008-05-04 21:43 . 2008-05-04 21:44 <REP> d-------- C:\Program Files\Windows Defender
            2008-04-20 17:24 . 2008-04-20 17:24 <REP> d-------- C:\Documents and Settings\All Users\Application Data\TVU Networks
            2008-04-19 18:54 . 2008-04-19 18:54 <REP> d-------- C:\Documents and Settings\ben\LocalLow
            2008-04-16 11:56 . 2006-11-29 13:06 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll
            2008-04-16 11:55 . 2008-04-16 11:55 <REP> d-------- C:\Program Files\Microsoft SQL Server Compact Edition
            2008-04-16 11:43 . 2008-04-16 11:48 <REP> d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller
            2008-04-16 11:43 . 2008-04-16 11:43 <REP> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller

            .
            (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
            .
            2008-05-16 16:51 --------- d-----w C:\Documents and Settings\ben\Application Data\uTorrent
            2008-05-10 09:49 --------- d-----w C:\Program Files\LimeWire
            2008-04-20 09:05 --------- d-----w C:\Program Files\MSN Games
            2008-04-20 09:02 --------- d-----w C:\Program Files\EA GAMES
            2008-04-17 16:04 --------- d-----w C:\Program Files\Windows Live
            2008-04-16 14:27 --------- d-----w C:\Program Files\Visual Labels
            2008-04-15 23:04 --------- d-----w C:\Documents and Settings\ben\Application Data\Skype
            2008-04-15 05:58 --------- d-----w C:\Program Files\Gabest
            2008-04-15 05:58 --------- d-----w C:\Program Files\AviSynth 2.5
            2008-04-15 05:48 --------- d-----w C:\Program Files\WinAVI MP4 Converter
            2008-04-15 05:44 --------- d-----w C:\Program Files\Aglare Mp4 to AVI Converter
            2008-04-14 15:27 --------- d-----w C:\Program Files\CAM Development
            2008-04-14 15:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\CAM Development
            2008-04-14 07:33 --------- d-----w C:\Program Files\iTunes
            2008-04-13 19:24 --------- d-----w C:\Program Files\iPod
            2008-04-13 19:23 --------- d-----w C:\Program Files\QuickTime
            2008-04-13 18:23 --------- d-----w C:\Program Files\MSN Messenger
            2008-04-13 12:08 --------- d-----w C:\Documents and Settings\ben\Application Data\DivX
            2008-04-13 09:23 --------- d-----w C:\Documents and Settings\ben\Application Data\Apple Computer
            2008-04-13 09:12 --------- d-----w C:\Program Files\coverXP
            2008-04-13 08:21 --------- d-----w C:\Documents and Settings\DOM\Application Data\uTorrent
            2008-04-13 07:53 --------- d-----w C:\Documents and Settings\ben\Application Data\Talkback
            2008-04-13 07:52 --------- d-----w C:\Documents and Settings\ben\Application Data\CyberLink
            2008-04-13 07:46 --------- d-----w C:\Program Files\DivX
            2008-04-12 21:05 --------- d-----w C:\Documents and Settings\ben\Application Data\TVU Networks
            2008-04-12 20:58 --------- d-----w C:\Documents and Settings\ben\Application Data\Sonic
            2008-04-12 20:58 --------- d-----w C:\Documents and Settings\ben\Application Data\Leadertech
            2008-04-12 17:15 --------- d-----w C:\Documents and Settings\ben\Application Data\HotSync
            2008-04-12 08:39 --------- d-----w C:\Documents and Settings\DOM\Application Data\LimeWire
            2008-04-10 20:25 --------- d-----w C:\Program Files\Cucusoft
            2008-04-09 13:59 --------- d-----w C:\Documents and Settings\All Users\Application Data\DVD Shrink
            2008-04-06 08:23 --------- d-----w C:\Program Files\Microsoft Money 2005
            2008-04-06 08:12 --------- d-----w C:\Program Files\Messenger Plus! Live
            2008-03-30 06:12 --------- d-----w C:\Program Files\Java
            2008-03-27 17:51 --------- d-----w C:\Program Files\Windows Live Safety Center
            2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
            2008-03-25 04:51 621,344 ------w C:\WINDOWS\system32\dllcache\mswstr10.dll
            2008-03-25 04:51 194,144 ----a-w C:\WINDOWS\system32\msjint40.dll
            2008-03-25 04:51 194,144 ------w C:\WINDOWS\system32\dllcache\msjint40.dll
            2008-03-20 08:09 1,845,376 ----a-w C:\WINDOWS\system32\win32k.sys
            2008-03-20 08:09 1,845,376 ------w C:\WINDOWS\system32\dllcache\win32k.sys
            2008-03-01 16:28 3,591,680 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
            2008-02-29 08:57 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe
            2008-02-29 08:56 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe
            2008-02-22 10:00 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
            2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
            2008-02-20 06:51 282,624 ------w C:\WINDOWS\system32\dllcache\gdi32.dll
            2008-02-20 05:35 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
            2008-02-20 05:35 45,568 ------w C:\WINDOWS\system32\dllcache\dnsrslvr.dll
            2008-02-20 05:35 148,992 ------w C:\WINDOWS\system32\dllcache\dnsapi.dll
            2007-05-30 12:08 480,848 ----a-w C:\Documents and Settings\All Users\Application Data\pswi_preloaded.exe
            2007-04-05 08:38 836 ----a-w C:\Documents and Settings\DOM\Application Data\ViewerApp.dat
            2006-05-19 06:57 31 ----a-w C:\Documents and Settings\DOMINIQUE\getfile.dat
            2006-04-09 21:31 31 ----a-w C:\Documents and Settings\FAMILLE\getfile.dat
            2006-04-03 13:52 100,816 ----a-w C:\Documents and Settings\DOMINIQUE\Application Data\GDIPFONTCACHEV1.DAT
            2007-11-07 13:39 168 --sh--r C:\WINDOWS\system32\93B7F23EBD.sys
            2007-11-07 13:39 3,766 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
            .

            ((((((((((((((((((((((((((((( snapshot@2008-05-06_16.21.03,07 )))))))))))))))))))))))))))))))))))))))))
            .
            + 2008-01-23 04:56:21 554,008 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\dao360.dll
            + 2007-12-10 12:41:11 518,944 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msexch40.dll
            + 2007-12-10 12:41:11 326,432 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msexcl40.dll
            + 2007-12-10 12:41:11 1,516,568 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msjet40.dll
            + 2007-12-10 12:41:11 355,112 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msjetol1.dll
            + 2008-03-25 06:56:31 194,144 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msjint40.dll
            + 2007-12-10 12:41:12 60,192 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msjter40.dll
            + 2007-12-10 12:41:12 248,608 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msjtes40.dll
            + 2007-12-10 12:41:12 219,936 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msltus40.dll
            + 2007-12-10 12:41:12 355,104 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\mspbde40.dll
            + 2007-12-10 12:41:13 432,928 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msrd2x40.dll
            + 2007-12-10 12:41:13 322,336 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msrd3x40.dll
            + 2007-12-10 12:41:13 559,904 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msrepl40.dll
            + 2007-12-10 12:41:13 264,992 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\mstext40.dll
            + 2007-12-10 12:41:13 838,432 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\mswdat10.dll
            + 2007-11-01 05:15:27 621,344 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\mswstr10.dll
            + 2007-12-10 12:41:14 355,104 ----a-w C:\WINDOWS\$hf_mig$\KB950749\SP2QFE\msxbde40.dll
            + 2007-03-06 01:34:33 15,072 ----a-w C:\WINDOWS\$hf_mig$\KB950749\spmsg.dll
            + 2007-03-06 01:34:38 216,800 ----a-w C:\WINDOWS\$hf_mig$\KB950749\spuninst.exe
            + 2007-03-06 01:34:31 22,752 ----a-w C:\WINDOWS\$hf_mig$\KB950749\update\spcustom.dll
            + 2007-03-06 01:34:56 727,776 ----a-w C:\WINDOWS\$hf_mig$\KB950749\update\update.exe
            + 2007-03-06 01:35:48 394,976 ----a-w C:\WINDOWS\$hf_mig$\KB950749\update\updspapi.dll
            - 2008-05-06 07:34:16 2,048 --s-a-w C:\WINDOWS\bootstat.dat
            + 2008-05-16 11:11:24 2,048 --s-a-w C:\WINDOWS\bootstat.dat
            + 2007-03-21 16:58:40 4,145,520 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u00021090200C0400000000000F01FEC\12.0.6021\WRD12CNV.DLL
            + 2007-03-21 16:58:46 24,416 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0/u00021090200C0400000000000F01FEC\12.0.6021\WRD12EXE.EXE
            - 2008-03-13 08:27:02 38,240 ----a-r C:\WINDOWS\Installer\{90120000-0020-040C-0000-0000000FF1CE}\O12ConvIcon.exe
            + 2008-05-14 09:45:45 38,240 ----a-r C:\WINDOWS\Installer\{90120000-0020-040C-0000-0000000FF1CE}\O12ConvIcon.exe
            - 2008-03-13 08:22:26 2,560 ----a-r C:\WINDOWS\Installer\{911B040C-6000-11D3-8CFE-0050048383C9}\cagicon.exe
            + 2008-05-14 09:46:51 2,560 ----a-r C:\WINDOWS\Installer\{911B040C-6000-11D3-8CFE-0050048383C9}\cagicon.exe
            - 2008-03-13 08:22:26 34,304 ----a-r C:\WINDOWS\Installer\{911B040C-6000-11D3-8CFE-0050048383C9}\misc.exe
            + 2008-05-14 09:46:51 34,304 ----a-r C:\WINDOWS\Installer\{911B040C-6000-11D3-8CFE-0050048383C9}\misc.exe
            - 2008-03-13 08:22:26 8,192 ----a-r C:\WINDOWS\Installer\{911B040C-6000-11D3-8CFE-0050048383C9}\mspicons.exe
            + 2008-05-14 09:46:51 8,192 ----a-r C:\WINDOWS\Installer\{911B040C-6000-11D3-8CFE-0050048383C9}\mspicons.exe
            - 2008-03-13 08:22:26 3,584 ----a-r C:\WINDOWS\Installer\{911B040C-6000-11D3-8CFE-0050048383C9}\opwicon.exe
            + 2008-05-14 09:46:51 3,584 ----a-r C:\WINDOWS\Installer\{911B040C-6000-11D3-8CFE-0050048383C9}\opwicon.exe
            - 2008-03-13 08:22:26 16,384 ----a-r C:\WINDOWS\Installer\{911B040C-6000-11D3-8CFE-0050048383C9}\PEicons.exe
            + 2008-05-14 09:46:51 16,384 ----a-r C:\WINDOWS\Installer\{911B040C-6000-11D3-8CFE-0050048383C9}\PEicons.exe
            - 2008-03-13 08:22:26 22,528 ----a-r C:\WINDOWS\Installer\{911B040C-6000-11D3-8CFE-0050048383C9}\unbndico.exe
            + 2008-05-14 09:46:51 22,528 ----a-r C:\WINDOWS\Installer\{911B040C-6000-11D3-8CFE-0050048383C9}\unbndico.exe
            - 2008-03-13 08:22:26 45,056 ----a-r C:\WINDOWS\Installer\{911B040C-6000-11D3-8CFE-0050048383C9}\wordicon.exe
            + 2008-05-14 09:46:51 45,056 ----a-r C:\WINDOWS\Installer\{911B040C-6000-11D3-8CFE-0050048383C9}\wordicon.exe
            + 2008-05-07 12:00:21 10,134 ----a-r C:\WINDOWS\Installer\{D0C73318-7B4A-4D16-A0C4-3B83F075EA88}\ARPPRODUCTICON.exe
            + 2008-05-25 08:46:52 11,856 ----a-w C:\WINDOWS\SoftwareDistribution\EventCache\{C1289A86-5CD1-4429-91A8-7FDD287E2150}.bin
            + 2005-02-24 10:10:10 2,084,864 ----a-w C:\WINDOWS\system32\AudDesign.dll
            + 2005-02-24 10:10:30 417,792 ----a-w C:\WINDOWS\system32\AudDisplay.dll
            + 2005-03-11 15:37:10 1,986,560 ----a-w C:\WINDOWS\system32\AudFile.dll
            + 2005-02-24 10:11:06 1,212,416 ----a-w C:\WINDOWS\system32\AudioInfos.dll
            + 2005-03-10 14:00:30 454,656 ----a-w C:\WINDOWS\system32\AudioRecord.dll
            + 2005-02-24 10:11:56 479,232 ----a-w C:\WINDOWS\system32\AudioVisu.dll
            + 2005-02-24 13:21:12 458,752 ----a-w C:\WINDOWS\system32\AudPlayer.dll
            + 2008-03-25 04:50:25 554,008 ------w C:\WINDOWS\system32\dllcache\dao360.dll
            + 2008-03-25 04:50:28 518,944 ------w C:\WINDOWS\system32\dllcache\msexch40.dll
            + 2008-03-25 04:50:30 326,432 ------w C:\WINDOWS\system32\dllcache\msexcl40.dll
            + 2008-03-25 04:50:34 1,516,568 ------w C:\WINDOWS\system32\dllcache\msjet40.dll
            + 2008-03-25 04:50:40 355,112 ------w C:\WINDOWS\system32\dllcache\msjetol1.dll
            + 2008-03-25 04:50:42 60,192 ------w C:\WINDOWS\system32\dllcache\msjter40.dll
            + 2008-03-25 04:50:42 248,608 ------w C:\WINDOWS\system32\dllcache\msjtes40.dll
            + 2008-03-25 04:50:44 219,936 ------w C:\WINDOWS\system32\dllcache\msltus40.dll
            + 2008-03-25 04:50:45 355,104 ------w C:\WINDOWS\system32\dllcache\mspbde40.dll
            + 2008-03-25 04:50:47 432,928 ------w C:\WINDOWS\system32\dllcache\msrd2x40.dll
            + 2008-03-25 04:50:49 322,336 ------w C:\WINDOWS\system32\dllcache\msrd3x40.dll
            + 2008-03-25 04:50:52 559,904 ------w C:\WINDOWS\system32\dllcache\msrepl40.dll
            + 2008-03-25 04:50:55 264,992 ------w C:\WINDOWS\system32\dllcache\mstext40.dll
            + 2008-03-25 04:50:57 838,432 ------w C:\WINDOWS\system32\dllcache\mswdat10.dll
            + 2008-03-25 04:50:58 355,104 ------w C:\WINDOWS\system32\dllcache\msxbde40.dll
            + 1998-07-12 21:00:00 15,360 ----a-w C:\WINDOWS\system32\inetfr.DLL
            - 2008-04-06 05:56:20 19,836,024 ----a-w C:\WINDOWS\system32\MRT.exe
            + 2008-05-09 21:35:04 16,863,864 ----a-w C:\WINDOWS\system32\MRT.exe
            + 1998-07-12 21:00:00 59,904 ----a-w C:\WINDOWS\system32\Mscc2fr.dll
            + 1998-07-12 21:00:00 141,312 ----a-w C:\WINDOWS\system32\MSCMCFR.DLL
            - 2004-08-05 12:00:00 512,029 ----a-w C:\WINDOWS\system32\msexch40.dll
            + 2008-03-25 04:50:28 518,944 ----a-w C:\WINDOWS\system32\msexch40.dll
            - 2004-08-05 12:00:00 319,517 ----a-w C:\WINDOWS\system32\msexcl40.dll
            + 2008-03-25 04:50:30 326,432 ----a-w C:\WINDOWS\system32\msexcl40.dll
            - 2004-08-05 12:00:00 1,507,356 ----a-w C:\WINDOWS\system32\msjet40.dll
            + 2008-03-25 04:50:34 1,516,568 ----a-w C:\WINDOWS\system32\msjet40.dll
            - 2004-08-05 12:00:00 358,976 ----a-w C:\WINDOWS\system32\msjetoledb40.dll
            + 2008-03-25 04:50:40 355,112 ----a-w C:\WINDOWS\system32\msjetoledb40.dll
            - 2004-08-05 12:00:00 53,279 ----a-w C:\WINDOWS\system32\msjter40.dll
            + 2008-03-25 04:50:42 60,192 ----a-w C:\WINDOWS\system32\msjter40.dll
            - 2004-08-05 12:00:00 241,693 ----a-w C:\WINDOWS\system32\msjtes40.dll
            + 2008-03-25 04:50:42 248,608 ----a-w C:\WINDOWS\system32\msjtes40.dll
            - 2004-08-05 12:00:00 213,023 ----a-w C:\WINDOWS\system32\msltus40.dll
            + 2008-03-25 04:50:44 219,936 ----a-w C:\WINDOWS\system32\msltus40.dll
            - 2004-08-05 12:00:00 348,189 ----a-w C:\WINDOWS\system32\mspbde40.dll
            + 2008-03-25 04:50:45 355,104 ----a-w C:\WINDOWS\system32\mspbde40.dll
            - 2004-08-05 12:00:00 421,919 ----a-w C:\WINDOWS\system32\msrd2x40.dll
            + 2008-03-25 04:50:47 432,928 ----a-w C:\WINDOWS\system32\msrd2x40.dll
            - 2004-08-05 12:00:00 315,423 ----a-w C:\WINDOWS\system32\msrd3x40.dll
            + 2008-03-25 04:50:49 322,336 ----a-w C:\WINDOWS\system32\msrd3x40.dll
            - 2004-08-05 12:00:00 552,989 ----a-w C:\WINDOWS\system32\msrepl40.dll
            + 2008-03-25 04:50:52 559,904 ----a-w C:\WINDOWS\system32\msrepl40.dll
            - 2004-08-05 12:00:00 258,077 ----a-w C:\WINDOWS\system32\mstext40.dll
            + 2008-03-25 04:50:55 264,992 ----a-w C:\WINDOWS\system32\mstext40.dll
            - 2004-08-05 12:00:00 831,519 ----a-w C:\WINDOWS\system32\mswdat10.dll
            + 2008-03-25 04:50:57 838,432 ----a-w C:\WINDOWS\system32\mswdat10.dll
            - 2004-08-05 12:00:00 348,189 ----a-w C:\WINDOWS\system32\msxbde40.dll
            + 2008-03-25 04:50:58 355,104 ----a-w C:\WINDOWS\system32\msxbde40.dll
            + 1998-07-12 21:00:00 21,504 ----a-w C:\WINDOWS\system32\TABCTFR.DLL
            + 2000-10-01 17:00:00 119,568 ----a-w C:\WINDOWS\system32\VB6FR.DLL
            + 1999-03-25 17:00:00 101,888 ----a-w C:\WINDOWS\system32\VB6STKIT.DLL
            + 2005-02-24 09:51:38 348,160 ----a-w C:\WINDOWS\system32\WMAFile.dll
            + 2008-05-16 11:12:00 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_60c.dat
            .
            -- Snapshot reset to current date --
            .
            ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
            .
            .
            REGEDIT4
            *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

            [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}]
            2008-04-16 17:56 1107296 --a------ C:\Program Files\Search Settings\kb127\SearchSettings.dll

            [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
            "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 14:00 15360]
            "EzStatus"="C:\Apps\EZHome\EZStatus.exe" [2004-12-20 21:03 94208]

            [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
            "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-05 14:00 208952]
            "PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-05 14:00 455168]
            "PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-05 14:00 455168]
            "Raccourci vers la page des propriétés de High Definition Audio"="HDAudPropShortcut.exe" [2004-03-17 15:10 61952 C:\WINDOWS\system32\Hdaudpropshortcut.exe]
            "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
            "ccApp"="C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe" [2004-09-07 15:25 58488]
            "HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe" [2003-05-07 21:56 188416]
            "HPHUPD05"="C:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" [2003-05-23 05:03 49152]
            "HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-04-08 12:45 212992]
            "HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [2002-12-17 11:40 49152]
            "HPHmon05"="C:\WINDOWS\system32\hphmon05.exe" [2003-05-23 04:56 483328]
            "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-30 21:05 344064]
            "TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2006-11-17 12:41 180269]
            "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 20:51 39792]
            "SoundMan"="SOUNDMAN.EXE" [2005-06-21 15:09 90112 C:\WINDOWS\SOUNDMAN.EXE]
            "AlcWzrd"="ALCWZRD.EXE" [2005-06-29 13:26 2806272 C:\WINDOWS\ALCWZRD.EXE]
            "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20 866584]
            "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-03-29 19:37 79224]
            "My Web Search Bar Search Scope Monitor"="C:\PROGRA~1\MYWEBS~1\bar\2.bin\m3SrchMn.exe" [ ]
            "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-03-28 23:37 413696]
            "SearchSettings"="C:\Program Files\Search Settings\SearchSettings.exe" [2008-04-16 17:56 985440]

            [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
            "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 14:00 15360]
            "EzStatus"="C:\Apps\EZHome\EZStatus.exe" [2004-12-20 21:03 94208]

            C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
            DataViz Inc Messenger.lnk - C:\Program Files\Fichiers communs\DataViz\DvzIncMsgr.exe [2006-11-17 12:25:12 28672]

            [HKEY_LOCAL_MACHINE\software\microsoft\security center]
            "AntiVirusDisableNotify"=dword:00000001
            "AntiVirusOverride"=dword:00000001

            [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
            "%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\logo_ubi.exe"=
            "%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\pandora.exe"=
            "%windir%\\system32\\sessmgr.exe"=
            "C:\\APPS\\Inventime\\my.exe"=
            "C:\\APPS\\skype\\phone\\Skype.exe"=
            "C:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
            "C:\\APPS\\Powercinema\\PowerCinema.exe"=
            "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"=
            "C:\\WINDOWS\\system32\\rtcshare.exe"=
            "C:\\Program Files\\Kodak\\Printer Dock\\Kodak Wireless Printer Computer Setup Assistant.exe"=
            "C:\\Program Files\\uTorrent\\utorrent.exe"=
            "C:\\Program Files\\palmOne\\Hotsync.exe"=
            "C:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
            "C:\\Program Files\\Messenger\\msmsgs.exe"=
            "C:\\Program Files\\iTunes\\iTunes.exe"=
            "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
            "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
            "C:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\Kodak Software Updater.exe"=
            "%windir%\\Network Diagnostic\\xpnetdiag.exe"=

            [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
            "6112:UDP"= 6112:UDP:azur1
            "6112:TCP"= 6112:TCP:azur1

            R0 sonypvl3;sonypvl3;C:\WINDOWS\system32\drivers\sonypvl3.sys [2004-09-22 12:55]
            R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 19:31]
            R1 sonypvf3;sonypvf3;C:\WINDOWS\system32\drivers\sonypvf3.sys [2004-11-15 14:55]
            R1 sonypvt3;sonypvt3;C:\WINDOWS\system32\drivers\sonypvt3.sys [2004-12-06 15:26]
            R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]
            R3 3xHybrid;3xHybrid service;C:\WINDOWS\system32\DRIVERS\3xHybrid.sys [2004-11-08 18:59]
            R3 camvid20;Philips ToUcam Camera; Video;C:\WINDOWS\system32\DRIVERS\camdrv21.sys []
            R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]
            S1 sonypvd3;Sony DVD Handycam;C:\WINDOWS\system32\DRIVERS\sonypvd3.sys [2004-12-07 16:00]
            S3 Boonty Games;Boonty Games;"C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe" [2006-02-05 19:47]
            S3 USB_RNDIS_51;Broadcom USB Remote NDIS Device Driver;C:\WINDOWS\system32\DRIVERS\usb8023.sys [2004-08-05 14:00]
            S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
            S3 ZD1211U(Wireless);IEEE 802.11g USB Adapter Driver(Wireless);C:\WINDOWS\system32\DRIVERS\zd1211u.sys []

            .
            Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
            "2008-05-16 17:00:00 C:\WINDOWS\Tasks\ABA93B2791A6ACC3.job"
            - c:\docume~1\mathilde\applic~1\chicsi~1\Part real the.exe
            "2008-05-08 09:32:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
            - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
            "2008-02-03 11:07:00 C:\WINDOWS\Tasks\HP DArC Task #Hewlett-Packard#7600#MY3852322CK2.job"
            - C:\Program Files\HP\hpcoretech\comp\hpdarc.exe$/#Hewlett-Packard#7600#MY3852322CK2
            "2008-05-16 14:06:00 C:\WINDOWS\Tasks\HP Usg Daily.job"
            - C:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\pexpress\hphped05.exe
            "2008-05-16 11:37:07 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
            - C:\Program Files\Windows Defender\MpCmdRun.exe
            "2005-06-17 11:18:38 C:\WINDOWS\Tasks\Rappel d'enregistrement 1.job"
            - C:\WINDOWS\system32\OOBE\oobebaln.exe
            "2008-05-16 13:10:00 C:\WINDOWS\Tasks\Symantec NetDetect.job"
            - C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE
            "2008-05-16 16:19:01 C:\WINDOWS\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job"
            - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
            .
            **************************************************************************

            catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
            Rootkit scan 2008-05-16 19:04:06
            Windows 5.1.2600 Service Pack 2 NTFS

            Balayage processus cachés ...

            Balayage caché autostart entries ...

            Balayage des fichiers cachés ...

            Scan terminé avec succès
            Les fichiers cachés: 0

            **************************************************************************

            [HKEY_LOCAL_MACHINE\system\ControlSet003\Services\MysqlInventime]
            "ImagePath"="c:\mysql\bin\mysqld-nt MysqlInventime"
            .
            Temps d'accomplissement: 2008-05-16 19:04:40
            ComboFix-quarantined-files.txt 2008-05-16 17:04:37
            ComboFix2.txt 2008-05-06 14:21:25

            Pre-Run: 95,188,557,824 octets libres
            Post-Run: 95,411,531,776 octets libres

            322 --- E O F --- 2008-05-16 11:39:29

            Logfile of Trend Micro HijackThis v2.0.2
            Scan saved at 19:05:06, on 16/05/2008
            Platform: Windows XP SP2 (WinNT 5.01.2600)
            MSIE: Internet Explorer v7.00 (7.00.6000.16640)
            Boot mode: Normal

            Running processes:
            C:\WINDOWS\System32\smss.exe
            C:\WINDOWS\system32\winlogon.exe
            C:\WINDOWS\system32\services.exe
            C:\WINDOWS\system32\lsass.exe
            C:\WINDOWS\system32\Ati2evxx.exe
            C:\WINDOWS\system32\svchost.exe
            C:\Program Files\Windows Defender\MsMpEng.exe
            C:\WINDOWS\System32\svchost.exe
            C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
            C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
            C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
            C:\Program Files\Alwil Software\Avast4\ashServ.exe
            C:\WINDOWS\system32\Ati2evxx.exe
            C:\WINDOWS\system32\spoolsv.exe
            C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
            C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
            c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
            C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
            C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
            C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
            C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
            C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
            C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
            C:\WINDOWS\system32\hphmon05.exe
            C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
            C:\WINDOWS\system32\PSIService.exe
            C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
            C:\WINDOWS\SOUNDMAN.EXE
            C:\WINDOWS\ALCWZRD.EXE
            C:\Program Files\Windows Defender\MSASCui.exe
            C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
            C:\Program Files\Search Settings\SearchSettings.exe
            C:\WINDOWS\system32\svchost.exe
            c:\APPS\Powercinema\Kernel\TV\CLSched.exe
            C:\WINDOWS\system32\ctfmon.exe
            C:\Apps\EZHome\EZStatus.exe
            C:\Program Files\Fichiers communs\DataViz\DvzIncMsgr.exe
            C:\WINDOWS\System32\svchost.exe
            C:\Program Files\iPod\bin\iPodService.exe
            C:\WINDOWS\system32\HPZipm12.exe
            C:\WINDOWS\system32\wuauclt.exe
            C:\WINDOWS\system32\notepad.exe
            C:\WINDOWS\explorer.exe
            C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

            R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
            R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
            R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.apple.com/itunes/
            R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
            R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll
            O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
            O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
            O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - c:\apps\skype\phone\IEPlugin\SKYPEI~1.DLL
            O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
            O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
            O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
            O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll
            O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
            O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
            O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
            O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
            O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
            O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAudPropShortcut.exe
            O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
            O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
            O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
            O4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
            O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
            O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
            O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe
            O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
            O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
            O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
            O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
            O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
            O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
            O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
            O4 - HKLM\..\Run: [My Web Search Bar Search Scope Monitor] "C:\PROGRA~1\MYWEBS~1\bar\2.bin\m3SrchMn.exe" /m=0
            O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
            O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\Search Settings\SearchSettings.exe
            O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
            O4 - HKCU\..\Run: [EzStatus] C:\Apps\EZHome\EZStatus.exe
            O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
            O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
            O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
            O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
            O4 - Global Startup: DataViz Inc Messenger.lnk = C:\Program Files\Fichiers communs\DataViz\DvzIncMsgr.exe
            O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
            O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
            O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
            O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\apps\skype\phone\IEPlugin\SKYPEI~1.DLL
            O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
            O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
            O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\MATHILDE\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk (file missing)
            O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
            O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
            O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
            O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
            O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
            O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
            O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
            O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
            O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
            O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
            O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
            O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
            O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
            O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
            O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
            O16 - DPF: {A1F2F2CE-06AF-483C-9F12-D3BAA72477D6} (BatchDownloader Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/DigWXMSN.cab
            O16 - DPF: {A73BAEFA-EE65-494D-BEDB-DD3E5A34FA98} (Image Uploader) - http://www.extrafilm.fr/ImageUploader4.cab
            O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab
            O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
            O17 - HKLM\System\CCS\Services\Tcpip\..\{46875C85-3A6B-43B4-923F-ABA01E9F2193}: NameServer = 192.168.1.1,192.168.1.2
            O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
            O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
            O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
            O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
            O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
            O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
            O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
            O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
            O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
            O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
            O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
            O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
            O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
            O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
            O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
            O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
            O23 - Service: MysqlInventime - Unknown owner - c:\mysql\bin\mysqld-nt.exe
            O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
            O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
            0
            1. jlpjlp Contributeur sécurité
              parfait!!!

              va dans : Démarrer > Exécuter puis copie/colle la ligne suivante :

              "%programfiles%\Lopxp\Lopxp.bat" /Fixme

              puis valide, accepte toutes les demandes de suppression et poste le rapport stp

              _____________

              telecharge combofix:

              http://download.bleepingcomputer.com/sUBs/ComboFix.exe
              Sauvegarde le sur ton bureau et pas ailleurs !

              Ferme tout tes navigateurs (donc copie ou imprime les instructions avant)

              Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :

              File::
              C:\Program Files\Search Settings
              C:\Program Files\Search Settings\kb127\SearchSettings.dll
              C:\Program Files\Search Settings\SearchSettings.exe
              C:\PROGRA~1\MYWEBS~1\bar\2.bin\m3SrchMn.exe

              Registry::
              [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}]
              [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
              "My Web Search Bar Search Scope Monitor"=-
              "SearchSettings"=-

              Enregistre ce fichier sous le nom CFscript

              Fait un glisser/déposer de ce fichier CFscrïpt sur le fichier ComboFix.exe

              Clique sur le fichier CFScript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFScript vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.

              Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

              Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

              Ne touche à rien tant que le scan n'est pas terminé.

              Une fois le scan achevé, un rapport va s'afficher: poste son contenu.

              Remets aussi un rapport Hijackthis

              Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

              _______________

              Fais un clic droit sur ce lien : (IL-MAFIOSO)
              http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe
              Enregistrer la cible (du lien) sous... et enregistre-le sur ton bureau.
              Ensuite double clique sur navilog1.exe pour lancer l'installation.
              Une fois l'installation terminée, le fix s'exécutera automatiquement.
              (Si ce n'est pas le cas, double-clique sur le raccourci Navilog1 présent sur le bureau).

              Laisse-toi guider. Au menu principal, choisis 1 et valides.
              (ne fais pas le choix 2,3 ou 4 sans notre avis/accord)

              Patiente jusqu'au message :
              *** Analyse Termine le ..... ***
              Appuie sur une touche comme demandé, le blocnote va s'ouvrir.
              Copie-colle l'intégralité dans une réponse. Referme le blocnote.
              Le rapport est en outre sauvegardé à la racine du disque (fixnavi.txt)
              0
              1. knobi
                # Rapport Lopxp fait le 17/05/2008 à 12:29:14
                # Exécuté dans : C:\Program Files\Lopxp
                # Version 3.10 - Maj du 11/04/2008

                ========== FixLog ==========

                +- C:\Documents and Settings\All Users\Application Data\Pure Scr Show Ref
                Choix utilisateur : Suppression acceptée.
                Déplacé avec succès.

                +- C:\WINDOWS\tasks\ABA93B2791A6ACC3.job
                Choix utilisateur : Suppression acceptée.
                Déplacé avec succès.

                +- Fichiers temporaires :
                Nettoyage effectué.

                ========== Listing des dossiers Application Data

                +- C:\Documents and Settings\Administrateur\Application Data

                2005-06-10 à 14:26:14 - ATI
                2004-08-16 à 16:19:22 - Identities
                2006-05-20 à 11:12:14 - Microsoft
                2005-06-10 à 14:39:20 - Real
                2005-06-10 à 14:26:36 - Sun
                2005-06-10 à 14:36:11 - Symantec
                2005-06-10 à 14:33:33 - You've Got Pictures Screensaver

                +- C:\Documents and Settings\Administrateur\Local Settings\Application Data

                2006-02-22 à 18:08:02 - ApplicationHistory
                2005-06-10 à 14:26:14 - ATI
                2006-05-20 à 11:12:14 - Microsoft
                2005-06-10 à 14:41:40 - PowerCinema
                2005-06-10 à 14:26:26 - {7148F0A6-6813-11D6-A77B-00B0D0142050}

                +- C:\Documents and Settings\All Users\Application Data

                2005-11-19 à 17:21:50 - 4D
                2007-08-03 à 20:06:08 - Adobe
                2005-11-29 à 13:11:52 - AOL
                2008-02-10 à 10:55:08 - Apple
                2007-01-08 à 16:28:54 - Apple Computer
                2006-02-05 à 11:25:59 - ArcSoft
                2008-01-20 à 09:47:41 - Azureus
                2006-02-05 à 17:47:07 - BOONTY
                2008-04-14 à 15:27:28 - CAM Development
                2007-02-04 à 14:28:24 - Corel
                2005-09-21 à 16:52:48 - CyberLink
                2006-12-21 à 23:44:35 - DataViz
                2008-05-17 à 09:02:53 - DVD Shrink
                2005-12-15 à 08:10:20 - Global Software Publishing
                2007-11-11 à 09:13:29 - Google
                2006-10-09 à 16:45:25 - HotSync
                2006-08-31 à 18:24:41 - Kodak
                2007-02-23 à 15:30:57 - Macrovision
                2008-05-06 à 14:41:22 - Malwarebytes
                2006-03-15 à 17:44:01 - Messenger Plus!
                2008-05-04 à 19:43:59 - Microsoft
                2006-08-27 à 14:49:09 - muvee Technologies
                2005-09-17 à 17:24:30 - NFS Underground
                2006-06-10 à 20:57:44 - PlayFirst
                2005-08-27 à 19:22:35 - QuickTime
                2006-09-02 à 12:14:21 - Sandlot Games
                2004-08-16 à 16:28:48 - SBSI
                2007-02-03 à 18:21:13 - Skype
                2006-05-20 à 10:13:49 - Symantec
                2007-02-11 à 18:42:08 - TEMP
                2008-04-20 à 15:24:30 - TVU Networks
                2006-05-21 à 12:47:24 - Windows Genuine Advantage
                2006-12-22 à 00:32:48 - Windows Live Toolbar
                2007-10-23 à 18:04:51 - WinZip
                2008-04-16 à 09:43:23 - WLInstaller
                2007-11-11 à 09:52:53 - Yahoo! Companion
                2007-04-03 à 00:07:50 - Zylom

                +- C:\Documents and Settings\ben\Application Data

                2008-04-15 à 08:25:52 - Adobe
                2008-04-13 à 09:23:56 - Apple Computer
                2005-06-10 à 14:26:14 - ATI
                2008-04-13 à 07:52:11 - CyberLink
                2008-04-13 à 12:08:19 - DivX
                2008-04-12 à 17:15:07 - HotSync
                2004-08-16 à 16:19:22 - Identities
                2008-04-12 à 20:58:45 - Leadertech
                2008-05-09 à 14:32:56 - LimeWire
                2008-04-12 à 17:45:52 - Macromedia
                2008-05-06 à 14:41:26 - Malwarebytes
                2008-05-12 à 09:50:46 - Microsoft
                2008-04-13 à 07:53:04 - Mozilla
                2008-04-12 à 18:18:47 - Real
                2008-05-07 à 14:03:14 - Search Settings
                2008-04-15 à 23:04:36 - Skype
                2008-04-12 à 20:58:46 - Sonic
                2005-06-10 à 14:26:36 - Sun
                2005-06-10 à 14:36:11 - Symantec
                2008-04-13 à 07:53:22 - Talkback
                2008-04-12 à 21:05:46 - TVU Networks
                2008-05-17 à 10:24:11 - uTorrent
                2008-04-12 à 18:02:22 - WinRAR
                2005-06-10 à 14:33:33 - You've Got Pictures Screensaver

                +- C:\Documents and Settings\ben\Local Settings\Application Data

                2008-04-15 à 08:25:58 - Adobe
                2008-04-12 à 17:16:28 - Apple Computer
                2005-06-10 à 14:20:40 - ApplicationHistory
                2005-06-10 à 14:26:14 - ATI
                2008-04-13 à 08:00:19 - Google
                2008-04-19 à 18:01:06 - Identities
                2008-05-15 à 08:56:13 - Microsoft
                2008-04-13 à 07:53:03 - Mozilla
                2008-04-16 à 14:29:15 - PowerCinema
                2008-04-19 à 16:54:41 - TVU Networks
                2005-06-10 à 14:26:26 - {7148F0A6-6813-11D6-A77B-00B0D0142050}

                +- C:\Documents and Settings\DOM\Application Data

                2008-04-08 à 19:17:40 - Adobe
                2007-03-18 à 01:58:33 - Apple Computer
                2005-06-10 à 14:26:14 - ATI
                2008-01-20 à 16:39:31 - Azureus
                2007-02-25 à 17:35:40 - Corel
                2008-01-20 à 09:57:00 - CyberLink
                2008-01-20 à 17:41:41 - DivX
                2007-02-12 à 12:48:33 - Google
                2007-02-14 à 09:18:56 - Help
                2007-02-12 à 12:34:16 - HotSync
                2007-04-03 à 00:07:53 - Identities
                2008-01-22 à 10:09:34 - Leadertech
                2008-04-12 à 08:39:37 - LimeWire
                2007-02-12 à 12:49:06 - Macromedia
                2008-04-12 à 07:35:55 - Microsoft
                2007-02-24 à 11:51:51 - Real
                2008-05-13 à 07:27:52 - Search Settings
                2007-04-27 à 15:55:48 - Skype
                2008-01-22 à 10:09:35 - Sonic
                2005-06-10 à 14:26:36 - Sun
                2005-06-10 à 14:36:11 - Symantec
                2008-04-13 à 08:21:41 - uTorrent
                2008-04-09 à 13:59:32 - WinRAR
                2005-06-10 à 14:33:33 - You've Got Pictures Screensaver
                2007-04-03 à 00:07:53 - Zylom

                +- C:\Documents and Settings\DOM\Local Settings\Application Data

                2007-06-12 à 11:00:37 - Adobe
                2008-03-13 à 08:24:25 - Apple Computer
                2005-06-10 à 14:20:40 - ApplicationHistory
                2005-06-10 à 14:26:14 - ATI
                2007-02-12 à 12:48:33 - Google
                2007-02-14 à 09:18:56 - Help
                2007-02-18 à 15:50:14 - Identities
                2008-04-12 à 12:16:23 - Microsoft
                2008-01-20 à 17:37:43 - PowerCinema
                2008-04-12 à 12:22:11 - WMTools Downloaded Files
                2005-06-10 à 14:26:26 - {7148F0A6-6813-11D6-A77B-00B0D0142050}

                +- C:\Documents and Settings\DOMINIQUE\Application Data

                2006-05-29 à 08:08:04 - Adobe
                2006-04-14 à 10:33:49 - AdobeUM
                2006-01-09 à 10:33:54 - ArcSoft
                2005-06-10 à 14:26:14 - ATI
                2005-06-20 à 11:50:06 - CyberLink
                2006-08-14 à 07:13:34 - Google
                2005-09-08 à 16:33:16 - Help
                2005-12-14 à 17:06:30 - Hewlett-Packard
                2006-11-01 à 13:46:17 - HotSync
                2006-04-03 à 15:06:45 - Identities
                2006-04-12 à 09:36:34 - Image Zone Express
                2005-07-07 à 07:54:33 - Leadertech
                2005-09-22 à 12:44:44 - Macromedia
                2006-03-23 à 11:05:09 - Microsoft
                2007-02-11 à 17:05:17 - Mozilla
                2005-06-10 à 14:39:20 - Real
                2005-07-06 à 15:40:07 - Skype
                2005-07-07 à 08:33:55 - Sonic
                2005-06-10 à 14:26:36 - Sun
                2005-10-21 à 06:40:42 - Symantec
                2005-06-10 à 14:33:33 - You've Got Pictures Screensaver

                +- C:\Documents and Settings\DOMINIQUE\Local Settings\Application Data

                2006-05-29 à 08:08:00 - Adobe
                2005-06-10 à 14:20:40 - ApplicationHistory
                2005-06-10 à 14:26:14 - ATI
                2006-09-24 à 20:03:32 - Google
                2005-09-08 à 16:33:16 - Help
                2006-04-03 à 15:06:45 - Identities
                2006-12-12 à 19:01:27 - Microsoft
                2006-03-16 à 16:13:38 - MicroVision Applications
                2007-02-11 à 17:05:17 - Mozilla
                2006-05-17 à 18:55:34 - PowerCinema
                2005-07-02 à 07:50:14 - WMTools Downloaded Files
                2005-06-10 à 14:26:26 - {7148F0A6-6813-11D6-A77B-00B0D0142050}

                +- C:\Documents and Settings\FAMILLE\Application Data

                2007-02-09 à 16:21:13 - Adobe
                2005-06-10 à 14:26:14 - ATI
                2006-02-22 à 17:58:14 - CyberLink
                2006-12-04 à 12:53:25 - Google
                2006-05-21 à 14:18:58 - Help
                2006-12-01 à 17:04:18 - HotSync
                2004-08-16 à 16:19:22 - Identities
                2006-06-14 à 16:41:36 - Macromedia
                2006-05-20 à 11:12:14 - Microsoft
                2005-06-10 à 14:39:20 - Real
                2005-06-10 à 14:26:36 - Sun
                2005-06-10 à 14:36:11 - Symantec
                2005-06-10 à 14:33:33 - You've Got Pictures Screensaver

                +- C:\Documents and Settings\FAMILLE\Local Settings\Application Data

                2007-02-09 à 16:21:41 - Adobe
                2007-01-17 à 16:55:58 - Apple Computer
                2005-06-10 à 14:20:40 - ApplicationHistory
                2005-06-10 à 14:26:14 - ATI
                2006-12-04 à 12:53:25 - Google
                2006-05-21 à 14:18:58 - Help
                2007-01-15 à 20:36:32 - Microsoft
                2006-02-22 à 17:58:51 - PowerCinema
                2005-09-15 à 08:56:09 - WMTools Downloaded Files
                2005-06-10 à 14:26:26 - {7148F0A6-6813-11D6-A77B-00B0D0142050}

                +- C:\Documents and Settings\Invit‚\Application Data

                2007-02-13 à 19:58:00 - Adobe
                2005-06-10 à 14:26:14 - ATI
                2007-02-14 à 08:09:54 - Google
                2007-02-13 à 19:58:15 - HotSync
                2004-08-16 à 16:19:22 - Identities
                2007-12-02 à 16:15:48 - Microsoft
                2005-06-10 à 14:39:20 - Real
                2005-06-10 à 14:26:36 - Sun
                2005-06-10 à 14:36:11 - Symantec
                2005-06-10 à 14:33:33 - You've Got Pictures Screensaver

                +- C:\Documents and Settings\Invit‚\Local Settings\Application Data

                2007-02-14 à 07:11:24 - Adobe
                2005-06-10 à 14:20:40 - ApplicationHistory
                2005-06-10 à 14:26:14 - ATI
                2007-02-14 à 08:09:54 - Google
                2007-02-13 à 19:57:29 - Microsoft
                2005-06-10 à 14:41:40 - PowerCinema
                2005-06-10 à 14:26:26 - {7148F0A6-6813-11D6-A77B-00B0D0142050}

                +- C:\Documents and Settings\Propri‚taire\Application Data

                2005-06-20 à 10:20:10 - You've Got Pictures Screensaver

                ========== Listing du dossier Program Files

                +- C:\Program Files

                2007-02-06 à 07:33:39 - 3B Software
                2007-08-03 à 20:05:55 - Adobe
                2008-04-15 à 05:44:35 - Aglare Mp4 to AVI Converter
                2007-11-25 à 11:38:39 - Alice
                2008-05-04 à 19:57:52 - Alwil Software
                2005-09-29 à 17:37:13 - ArcSoft
                2006-05-21 à 14:06:06 - ATI Technologies
                2006-08-27 à 14:48:39 - Autofr
                2008-04-15 à 05:58:50 - AviSynth 2.5
                2008-01-20 à 16:40:13 - Azureus
                2007-11-11 à 09:05:07 - Boonty
                2007-11-11 à 09:10:20 - BoontyGames
                2008-04-14 à 15:27:30 - CAM Development
                2006-03-26 à 09:26:13 - CCleaner
                2006-03-16 à 16:27:17 - CompuPic
                2007-11-11 à 09:09:15 - Corel
                2005-06-22 à 15:54:42 - CosmoSoftware
                2008-04-13 à 09:12:31 - coverXP
                2008-04-10 à 20:25:45 - Cucusoft
                2005-06-10 à 14:41:12 - CyberLink
                2005-06-22 à 15:52:04 - directx
                2008-04-13 à 07:46:45 - DivX
                2007-03-05 à 21:25:02 - Documents To Go
                2008-05-17 à 09:02:53 - DVD Shrink
                2008-04-20 à 09:02:27 - EA GAMES
                2008-04-16 à 09:43:46 - Fichiers communs
                2006-05-03 à 16:24:27 - Fire International
                2008-05-07 à 18:47:23 - Free Audio Pack
                2008-04-15 à 05:58:02 - Gabest
                2007-11-11 à 09:13:30 - Google
                2008-04-12 à 08:03:22 - Grisoft
                2005-07-03 à 10:06:33 - Hewlett-Packard
                2005-06-29 à 06:23:25 - Hits Collection
                2005-11-21 à 17:08:14 - HP
                2007-10-25 à 19:52:27 - IMVU
                2005-08-26 à 06:50:13 - Infogrames
                2005-11-19 à 17:21:33 - Innomatix
                2008-02-10 à 10:09:02 - InstallShield Installation Information
                2008-05-06 à 14:15:39 - Internet Explorer
                2008-04-13 à 19:24:41 - iPod
                2008-04-14 à 07:33:28 - iTunes
                2008-03-30 à 06:12:52 - Java
                2006-08-31 à 18:30:34 - Kodak
                2005-10-10 à 16:12:40 - Larousse
                2005-06-10 à 14:33:33 - Learn2.com
                2007-11-11 à 09:16:09 - Les Boucliers de Quetzalcoatl
                2008-05-10 à 09:49:05 - LimeWire
                2008-05-17 à 10:29:38 - Lopxp
                2008-05-06 à 14:41:23 - Malwarebytes' Anti-Malware
                2005-08-27 à 12:07:27 - Maxis
                2008-05-07 à 08:04:33 - MediaCoder
                2007-02-23 à 15:31:08 - Mes Jeux Téléchargés
                2005-10-15 à 13:00:46 - Messenger
                2008-04-06 à 08:12:45 - Messenger Plus! Live
                2007-06-13 à 17:46:26 - MessengerPlus! 3
                2005-07-08 à 14:02:17 - Micro Application
                2007-05-14 à 13:33:36 - Microsoft CAPICOM 2.1.0.2
                2004-08-16 à 16:11:16 - microsoft frontpage
                2005-12-08 à 19:13:48 - Microsoft Games
                2008-04-06 à 08:23:58 - Microsoft Money 2005
                2007-09-03 à 09:29:45 - microsoft office
                2008-04-16 à 09:55:33 - Microsoft SQL Server Compact Edition
                2005-06-10 à 14:40:37 - Microsoft Visual Studio
                2005-06-28 à 14:50:08 - Microsoft Works
                2005-06-28 à 14:49:47 - Microsoft.NET
                2005-08-28 à 09:19:19 - Monte Cristo
                2004-08-16 à 16:06:24 - Movie Maker
                2008-05-05 à 17:21:34 - Mozilla Firefox
                2007-09-03 à 09:29:33 - MSECache
                2005-10-15 à 13:00:50 - MSN
                2008-04-20 à 09:05:59 - MSN Games
                2004-08-16 à 16:03:38 - MSN Gaming Zone
                2008-04-13 à 18:23:30 - MSN Messenger
                2005-06-25 à 17:10:27 - MSWorks
                2006-11-17 à 16:30:56 - MSXML 4.0
                2006-08-27 à 14:50:12 - muvee Technologies
                2004-08-16 à 16:06:14 - NetMeeting
                2008-02-02 à 16:22:53 - NRJ
                2005-09-21 à 14:57:48 - Nullsoft
                2004-08-16 à 16:03:54 - Online Services
                2006-09-07 à 08:30:25 - OriaSoft
                2007-06-13 à 20:32:38 - Outlook Express
                2006-05-20 à 13:39:00 - Packard Bell ImageWriter
                2007-04-28 à 15:01:25 - palmOne
                2008-01-20 à 10:05:04 - PFConfig
                2005-09-29 à 17:38:35 - Philips ToUcam Camera
                2007-02-04 à 15:08:50 - PhotoFiltre Studio
                2005-07-08 à 14:15:33 - PIXELA
                2008-04-13 à 19:23:03 - QuickTime
                2006-12-21 à 22:26:35 - Real
                2006-06-16 à 16:12:42 - Samsung
                2008-05-07 à 12:00:20 - Search Settings
                2005-08-25 à 18:09:08 - Sega
                2007-02-01 à 17:45:24 - Services en ligne
                2008-02-10 à 10:07:05 - Shareaza
                2005-06-10 à 14:42:01 - Sonic
                2005-07-08 à 14:13:59 - Sony Corporation
                2006-03-26 à 12:39:04 - Symantec
                2008-05-05 à 17:48:19 - Trend Micro
                2005-09-10 à 18:38:10 - Ubi Soft
                2006-05-08 à 10:19:34 - UFDisk Format Tool2
                2004-08-16 à 16:19:06 - Uninstall Information
                2008-01-20 à 16:41:37 - uTorrent
                2008-04-16 à 14:27:05 - Visual Labels
                2006-08-27 à 14:13:14 - VSO
                2008-04-15 à 05:48:23 - WinAVI MP4 Converter
                2008-05-04 à 19:44:00 - Windows Defender
                2008-04-17 à 16:04:17 - Windows Live
                2008-03-27 à 17:51:57 - Windows Live Safety Center
                2007-11-30 à 20:20:04 - Windows Live Toolbar
                2008-02-02 à 16:42:28 - Windows Media Components
                2007-02-02 à 08:48:33 - Windows Media Connect 2
                2007-03-06 à 13:55:33 - Windows Media Player
                2004-08-16 à 16:03:06 - Windows NT
                2004-08-16 à 16:07:42 - WindowsUpdate
                2007-11-11 à 18:13:27 - WinRAR
                2007-10-23 à 18:04:18 - WinZip
                2005-06-24 à 20:46:58 - WON
                2004-08-16 à 16:11:16 - xerox
                2007-11-11 à 09:50:29 - Yahoo!
                2007-04-03 à 18:46:12 - Zylom Games

                ========== Tâches planifiées

                AppleSoftwareUpdate.job: C:\Program Files\Apple Software Update\SoftwareUpdate.exe -Task
                HP DArC Task #Hewlett-Packard#7600#MY3852322CK2.job: C:\Program Files\HP\hpcoretech\comp\hpdarc.exe /#Hewlett-Packard#7600#MY3852322CK2
                HP Usg Daily.job: C:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\pexpress\hphped05.exe
                MP Scheduled Scan.job: C:\Program Files\Windows Defender\MpCmdRun.exe Scan -RestrictPrivileges
                Rappel d'enregistrement 1.job: C:\WINDOWS\system32\OOBE\oobebaln.exe /sys /r /n:1
                Symantec NetDetect.job: C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE
                Vérifier les mises à jour de Windows Live Toolbar.job: C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE

                ========== Clés registre

                ========== Bloqueur popups Internet Explorer

                www.packardbell.co.uk
                www.packardbell.at
                www.packardbell.dk
                www.packardbell.fi
                www.packardbell.fr
                www.packardbell.de
                www.packardbell.it
                www.packardbell.no
                www.packardbell.es
                www.packardbell.se
                www.packardbell.ch
                PopupMgr
                apps.facebook.com

                ========== Suggestion ( /!\ Nécessite une interprétation.) ==========

                +- Dossiers\Fichiers : Aucune suggestion.

                +- Registre : Aucune suggestion.

                - Fin du rapport -

                apres avoir executer lopxp dont le raport est ci dessus j'ai donc executer combofix avec le doc text ke tu ma ecrit
                lors de lexecution l'odi ma mis un message du genre: windows a areter veuliier redemare.....
                au demmarage g eu un message d'erreur:
                BCCode : 1000008e BCP1 : C0000005 BCP2 : 8060BD63 BCP3 : A7026C44
                BCP4 : 00000000 OSVer : 5_1_2600 SP : 2_0 Product : 768_1

                ke doije faire

                merci davance
                0
                1. jlpjlp Contributeur sécurité
                  redemarre l'ordi pour voir

                  Remets aussi un rapport Hijackthis

                  et combofix
                  Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

                  _______________

                  Fais un clic droit sur ce lien : (IL-MAFIOSO)
                  http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe
                  Enregistrer la cible (du lien) sous... et enregistre-le sur ton bureau.
                  Ensuite double clique sur navilog1.exe pour lancer l'installation.
                  Une fois l'installation terminée, le fix s'exécutera automatiquement.
                  (Si ce n'est pas le cas, double-clique sur le raccourci Navilog1 présent sur le bureau).

                  Laisse-toi guider. Au menu principal, choisis 1 et valides.
                  (ne fais pas le choix 2,3 ou 4 sans notre avis/accord)

                  Patiente jusqu'au message :
                  *** Analyse Termine le ..... ***
                  Appuie sur une touche comme demandé, le blocnote va s'ouvrir.
                  Copie-colle l'intégralité dans une réponse. Referme le blocnote.
                  Le rapport est en outre sauvegardé à la racine du disque (fixnavi.txt)
                  0
                  1. knobi
                    Logfile of Trend Micro HijackThis v2.0.2
                    Scan saved at 14:38:00, on 17/05/2008
                    Platform: Windows XP SP2 (WinNT 5.01.2600)
                    MSIE: Internet Explorer v7.00 (7.00.6000.16640)
                    Boot mode: Normal

                    Running processes:
                    C:\WINDOWS\System32\smss.exe
                    C:\WINDOWS\system32\winlogon.exe
                    C:\WINDOWS\system32\services.exe
                    C:\WINDOWS\system32\lsass.exe
                    C:\WINDOWS\system32\Ati2evxx.exe
                    C:\WINDOWS\system32\svchost.exe
                    C:\Program Files\Windows Defender\MsMpEng.exe
                    C:\WINDOWS\System32\svchost.exe
                    C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
                    C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
                    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                    C:\Program Files\Alwil Software\Avast4\ashServ.exe
                    C:\WINDOWS\system32\spoolsv.exe
                    C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                    c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
                    C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
                    C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
                    C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
                    C:\WINDOWS\system32\PSIService.exe
                    C:\WINDOWS\system32\svchost.exe
                    c:\APPS\Powercinema\Kernel\TV\CLSched.exe
                    C:\WINDOWS\system32\Ati2evxx.exe
                    C:\WINDOWS\System32\svchost.exe
                    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
                    C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
                    C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
                    C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
                    C:\WINDOWS\system32\hphmon05.exe
                    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
                    C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
                    C:\WINDOWS\SOUNDMAN.EXE
                    C:\WINDOWS\ALCWZRD.EXE
                    C:\Program Files\Windows Defender\MSASCui.exe
                    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                    C:\Program Files\Search Settings\SearchSettings.exe
                    C:\WINDOWS\system32\ctfmon.exe
                    C:\Apps\EZHome\EZStatus.exe
                    C:\Program Files\Fichiers communs\DataViz\DvzIncMsgr.exe
                    C:\WINDOWS\system32\HPZipm12.exe
                    C:\WINDOWS\explorer.exe
                    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

                    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
                    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
                    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.apple.com/itunes/
                    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                    R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll
                    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
                    O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
                    O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - c:\apps\skype\phone\IEPlugin\SKYPEI~1.DLL
                    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                    O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                    O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll
                    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                    O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
                    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
                    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
                    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
                    O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAudPropShortcut.exe
                    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
                    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
                    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
                    O4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
                    O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
                    O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
                    O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe
                    O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
                    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
                    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
                    O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
                    O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
                    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                    O4 - HKLM\..\Run: [My Web Search Bar Search Scope Monitor] "C:\PROGRA~1\MYWEBS~1\bar\2.bin\m3SrchMn.exe" /m=0
                    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                    O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\Search Settings\SearchSettings.exe
                    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                    O4 - HKCU\..\Run: [EzStatus] C:\Apps\EZHome\EZStatus.exe
                    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                    O4 - Global Startup: DataViz Inc Messenger.lnk = C:\Program Files\Fichiers communs\DataViz\DvzIncMsgr.exe
                    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
                    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                    O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\apps\skype\phone\IEPlugin\SKYPEI~1.DLL
                    O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
                    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
                    O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\MATHILDE\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk (file missing)
                    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                    O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
                    O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
                    O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
                    O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
                    O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
                    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
                    O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
                    O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
                    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
                    O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
                    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
                    O16 - DPF: {A1F2F2CE-06AF-483C-9F12-D3BAA72477D6} (BatchDownloader Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/DigWXMSN.cab
                    O16 - DPF: {A73BAEFA-EE65-494D-BEDB-DD3E5A34FA98} (Image Uploader) - http://www.extrafilm.fr/ImageUploader4.cab
                    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab
                    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
                    O17 - HKLM\System\CCS\Services\Tcpip\..\{46875C85-3A6B-43B4-923F-ABA01E9F2193}: NameServer = 192.168.1.1,192.168.1.2
                    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
                    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
                    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
                    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                    O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
                    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
                    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
                    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
                    O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
                    O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
                    O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
                    O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
                    O23 - Service: MysqlInventime - Unknown owner - c:\mysql\bin\mysqld-nt.exe
                    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
                    O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
                    0
                    1. jlpjlp Contributeur sécurité
                      = Lance navilog1
                      = Cette fois-ci choisi l'option 2
                      = Navilog va faire le nettoyage.. patient jusqu'à ce qui soit marqué *** Nettoyage Termine le ..... ***
                      = Un rapport va être génrer sur ton C:\ qui sera en option 2
                      Note: le bureau disparaît

                      = colle le contenu du rapport de navilog (qui est en option2)

                      PS:Si ton bureau ne réapparait pas, fais CTRL+ALT+SUPP pour ouvrir le gestionnaire de tâches.
                      Puis rends-toi à l'onglet "processus". Clique en haut à gauche sur fichiers et choisis "exécuter"
                      Tape explorer et valide. Celà te fera apparaitre ton bureau.

                      _____________

                      Télécharge BTFix de Bibi26
                      http://cluster1.easy-hebergement.net/
                      Dézippe l'archive sur ton Bureau.
                      Ouvre le dossier BTFix.
                      Double clique sur BTFix.exe.
                      Clique sur Rechercher.
                      Un rapport va apparaître, copie/colle-le dans ta prochaine réponse.

                      puis pour desinfecté ce qui est trouvé

                      btfix :

                      Redémarre en mode sans echec. Attention, tu n'as pas accès à internet dans ce mode, note bien ce que tu as à faire.
                      Démarre l'ordinateur.
                      Une fois le chargement du BIOS terminé, il y a un écran noir. Appuye sur la touche F8 jusqu'à l'affichage du menu des options avancées de Windows.
                      En utilisant les touches du curseur, sélectionne Mode sans échec et appuye sur Entrée.

                      Ouvre BTFix.
                      Clique sur Nettoyer.
                      Un rapport va apparaître.

                      Redémarre normalement
                      _______________
                      tu fais mal ceci avec combofix,
                      regarde ici

                      pour fusionner:

                      http://img.photobucket.com/albums/v666/sUBs/CFScript.gif

                      _______________

                      telecharge combofix:

                      http://download.bleepingcomputer.com/sUBs/ComboFix.exe
                      Sauvegarde le sur ton bureau et pas ailleurs !

                      Ferme tout tes navigateurs (donc copie ou imprime les instructions avant)

                      Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :

                      File::
                      C:\Program Files\Search Settings
                      C:\Program Files\Search Settings\kb127\SearchSettings.dll
                      C:\Program Files\Search Settings\SearchSettings.exe
                      C:\PROGRA~1\MYWEBS~1\bar\2.bin\m3SrchMn.exe
                      C:\Documents and Settings\DOM\Application Data\Search Settings
                      C:\Documents and Settings\ben\Application Data\Search Settings
                      C:\Program Files\Search Settings

                      Registry::
                      [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}]
                      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                      "My Web Search Bar Search Scope Monitor"=-
                      "SearchSettings"=-

                      Enregistre ce fichier sous le nom CFscript (attention aux minuscles et majuscules)

                      Fait un glisser/déposer de ce fichier CFscrïpt sur le fichier ComboFix.exe

                      Clique sur le fichier CFScript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFScript vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.

                      Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

                      Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

                      Ne touche à rien tant que le scan n'est pas terminé.

                      Une fois le scan achevé, un rapport va s'afficher: poste son contenu.

                      Remets aussi un rapport Hijackthis

                      Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt
                      0
                      1. knobi Auteur
                        Clean Navipromo version 3.5.7 commencé le 21/05/2008 à 10:07:23,00

                        Outil exécuté depuis C:\Program Files\navilog1
                        Session actuelle : "ben"

                        Mise à jour le 11.05.2008 à 18h00 par IL-MAFIOSO

                        Microsoft Windows XP [version 5.1.2600]
                        Internet Explorer : 7.0.5730.13
                        Système de fichiers : NTFS

                        Mode suppression automatique
                        avec prise en charge résultats Catchme et GNS

                        Nettoyage exécuté au redémarrage de l'ordinateur

                        *** fsbl1.txt non trouvé ***
                        (Assurez-vous que Catchme n'avait rien trouvé lors de la recherche)

                        *** Suppression avec sauvegardes résultats GenericNaviSearch ***

                        * Suppression dans "C:\WINDOWS\System32" *

                        * Suppression dans "C:\Documents and Settings\ben\locals~1\applic~1" *

                        * Suppression dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" *

                        * Suppression dans "C:\DOCUME~1\DOM\locals~1\applic~1" *

                        * Suppression dans "C:\DOCUME~1\DOMINI~1\locals~1\applic~1" *

                        * Suppression dans "C:\DOCUME~1\FAMILLE\locals~1\applic~1" *

                        * Suppression dans "C:\DOCUME~1\INVIT~1\locals~1\applic~1" *

                        *** Suppression dossiers dans "C:\WINDOWS" ***

                        *** Suppression dossiers dans "C:\Program Files" ***

                        *** Suppression dossiers dans "c:\docume~1\alluse~1\applic~1" ***

                        *** Suppression dossiers dans "c:\docume~1\alluse~1\menudÉ~1\progra~1" ***

                        *** Suppression dossiers dans "C:\Documents and Settings\ben\applic~1" ***

                        *** Suppression dossiers dans "C:\DOCUME~1\ADMINI~1\applic~1" ***

                        *** Suppression dossiers dans "C:\DOCUME~1\DOM\applic~1" ***

                        *** Suppression dossiers dans "C:\DOCUME~1\DOMINI~1\applic~1" ***

                        *** Suppression dossiers dans "C:\DOCUME~1\FAMILLE\applic~1" ***

                        *** Suppression dossiers dans "C:\DOCUME~1\INVIT~1\applic~1" ***

                        *** Suppression dossiers dans "C:\DOCUME~1\PROPRI~1\applic~1" ***

                        *** Suppression dossiers dans "C:\Documents and Settings\ben\locals~1\applic~1" ***

                        *** Suppression dossiers dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" ***

                        *** Suppression dossiers dans "C:\DOCUME~1\DOM\locals~1\applic~1" ***

                        *** Suppression dossiers dans "C:\DOCUME~1\DOMINI~1\locals~1\applic~1" ***

                        *** Suppression dossiers dans "C:\DOCUME~1\FAMILLE\locals~1\applic~1" ***

                        *** Suppression dossiers dans "C:\DOCUME~1\INVIT~1\locals~1\applic~1" ***

                        *** Suppression dossiers dans "C:\Documents and Settings\ben\menudm~1\progra~1" ***

                        *** Suppression dossiers dans "C:\DOCUME~1\ADMINI~1\menudm~1\progra~1" ***

                        *** Suppression dossiers dans "C:\DOCUME~1\DOM\menudm~1\progra~1" ***

                        *** Suppression dossiers dans "C:\DOCUME~1\DOMINI~1\menudm~1\progra~1" ***

                        *** Suppression dossiers dans "C:\DOCUME~1\FAMILLE\menudm~1\progra~1" ***

                        *** Suppression dossiers dans "C:\DOCUME~1\INVIT~1\menudm~1\progra~1" ***

                        *** Suppression fichiers ***

                        *** Suppression fichiers temporaires ***

                        Nettoyage contenu C:\WINDOWS\Temp effectué !
                        Nettoyage contenu C:\Documents and Settings\ben\locals~1\Temp effectué !

                        *** Traitement Recherche complémentaire ***
                        (Recherche fichiers spécifiques)

                        1)Suppression avec sauvegardes nouveaux fichiers Instant Access :

                        2)Recherche, création sauvegardes et suppression Heuristique :

                        * Dans "C:\WINDOWS\system32" *

                        * Dans "C:\Documents and Settings\ben\locals~1\applic~1" *

                        * Dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" *

                        * Dans "C:\DOCUME~1\DOM\locals~1\applic~1" *

                        * Dans "C:\DOCUME~1\DOMINI~1\locals~1\applic~1" *

                        * Dans "C:\DOCUME~1\FAMILLE\locals~1\applic~1" *

                        * Dans "C:\DOCUME~1\INVIT~1\locals~1\applic~1" *

                        *** Sauvegarde du Registre vers dossier Safebackup ***

                        sauvegarde du Registre réalisée avec succès !

                        *** Nettoyage Registre ***

                        Nettoyage Registre Ok

                        *** Certificats ***

                        Certificat Egroup absent !
                        Certificat Electronic-Group supprimé !
                        Certificat OOO-Favorit supprimé !
                        Certificat Sunny-Day-Design-Ltdt absent !

                        *** Nettoyage terminé le 21/05/2008 à 10:12:09,34 ***

                        ComboFix 08-05-20.5 - ben 2008-05-21 11:52:56.5 - NTFSx86
                        Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.1458 [GMT 2:00]
                        Endroit: C:\Documents and Settings\ben\Bureau\ComboFix.exe
                        Command switches used :: C:\Documents and Settings\ben\Bureau\CFscript.doc
                        * Création d'un nouveau point de restauration
                        .

                        ((((((((((((((((((((((((((((( Fichiers créés 2008-04-21 to 2008-05-21 ))))))))))))))))))))))))))))))))))))
                        .

                        2008-05-17 15:07 . 2008-05-17 15:07 <REP> d-------- C:\Program Files\xp-AntiSpy
                        2008-05-17 14:30 . 2008-05-21 10:12 <REP> d-------- C:\Program Files\Navilog1
                        2008-05-17 11:02 . 2008-05-17 11:02 <REP> d-------- C:\Program Files\DVD Shrink
                        2008-05-16 18:58 . 2008-05-16 18:58 <REP> d-------- C:\Combo-Fix2
                        2008-05-16 14:32 . 2008-05-16 14:32 130,960 --a------ C:\Documents and Settings\ben\Application Data\GDIPFONTCACHEV1.DAT
                        2008-05-13 09:27 . 2008-05-13 09:27 <REP> d-------- C:\Documents and Settings\DOM\Application Data\Search Settings
                        2008-05-07 16:03 . 2008-05-07 16:03 <REP> d-------- C:\Documents and Settings\ben\Application Data\Search Settings
                        2008-05-07 14:00 . 2008-05-07 14:00 <REP> d-------- C:\Program Files\Search Settings
                        2008-05-07 13:59 . 2008-05-07 20:47 <REP> d-------- C:\Program Files\Free Audio Pack
                        2008-05-07 13:49 . 2008-05-09 16:32 <REP> d-------- C:\Documents and Settings\ben\Application Data\LimeWire
                        2008-05-07 10:00 . 2008-05-07 10:04 <REP> d-------- C:\Program Files\MediaCoder
                        2008-05-06 17:50 . 2008-05-17 12:29 <REP> d-------- C:\Program Files\Lopxp
                        2008-05-06 16:41 . 2008-05-06 16:41 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
                        2008-05-06 16:41 . 2008-05-06 16:41 <REP> d-------- C:\Documents and Settings\ben\Application Data\Malwarebytes
                        2008-05-06 16:41 . 2008-05-06 16:41 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
                        2008-05-06 16:41 . 2008-05-05 20:46 27,048 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
                        2008-05-06 16:41 . 2008-05-05 20:46 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
                        2008-05-06 16:14 . 2008-05-06 16:21 <REP> d-------- C:\Combo-Fix
                        2008-05-05 19:48 . 2008-05-05 19:48 <REP> d-------- C:\Program Files\Trend Micro
                        2008-05-04 21:57 . 2008-05-04 21:57 <REP> d-------- C:\Program Files\Alwil Software
                        2008-05-04 21:43 . 2008-05-04 21:44 <REP> d-------- C:\Program Files\Windows Defender

                        .
                        (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                        .
                        2008-05-21 09:55 --------- d-----w C:\Documents and Settings\ben\Application Data\uTorrent
                        2008-05-17 09:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\DVD Shrink
                        2008-05-10 09:49 --------- d-----w C:\Program Files\LimeWire
                        2008-04-20 15:24 --------- d-----w C:\Documents and Settings\All Users\Application Data\TVU Networks
                        2008-04-20 09:05 --------- d-----w C:\Program Files\MSN Games
                        2008-04-20 09:02 --------- d-----w C:\Program Files\EA GAMES
                        2008-04-17 16:04 --------- d-----w C:\Program Files\Windows Live
                        2008-04-16 14:27 --------- d-----w C:\Program Files\Visual Labels
                        2008-04-16 09:55 --------- d-----w C:\Program Files\Microsoft SQL Server Compact Edition
                        2008-04-16 09:48 --------- dcsh--w C:\Program Files\Fichiers communs\WindowsLiveInstaller
                        2008-04-16 09:43 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
                        2008-04-15 23:04 --------- d-----w C:\Documents and Settings\ben\Application Data\Skype
                        2008-04-15 05:58 --------- d-----w C:\Program Files\Gabest
                        2008-04-15 05:58 --------- d-----w C:\Program Files\AviSynth 2.5
                        2008-04-15 05:48 --------- d-----w C:\Program Files\WinAVI MP4 Converter
                        2008-04-15 05:44 --------- d-----w C:\Program Files\Aglare Mp4 to AVI Converter
                        2008-04-14 15:27 --------- d-----w C:\Program Files\CAM Development
                        2008-04-14 15:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\CAM Development
                        2008-04-14 07:33 --------- d-----w C:\Program Files\iTunes
                        2008-04-13 19:24 --------- d-----w C:\Program Files\iPod
                        2008-04-13 19:23 --------- d-----w C:\Program Files\QuickTime
                        2008-04-13 18:23 --------- d-----w C:\Program Files\MSN Messenger
                        2008-04-13 12:08 --------- d-----w C:\Documents and Settings\ben\Application Data\DivX
                        2008-04-13 09:23 --------- d-----w C:\Documents and Settings\ben\Application Data\Apple Computer
                        2008-04-13 09:12 --------- d-----w C:\Program Files\coverXP
                        2008-04-13 08:21 --------- d-----w C:\Documents and Settings\DOM\Application Data\uTorrent
                        2008-04-13 07:53 --------- d-----w C:\Documents and Settings\ben\Application Data\Talkback
                        2008-04-13 07:52 --------- d-----w C:\Documents and Settings\ben\Application Data\CyberLink
                        2008-04-13 07:46 --------- d-----w C:\Program Files\DivX
                        2008-04-12 21:05 --------- d-----w C:\Documents and Settings\ben\Application Data\TVU Networks
                        2008-04-12 20:58 --------- d-----w C:\Documents and Settings\ben\Application Data\Sonic
                        2008-04-12 20:58 --------- d-----w C:\Documents and Settings\ben\Application Data\Leadertech
                        2008-04-12 17:15 --------- d-----w C:\Documents and Settings\ben\Application Data\HotSync
                        2008-04-12 08:39 --------- d-----w C:\Documents and Settings\DOM\Application Data\LimeWire
                        2008-04-10 20:25 --------- d-----w C:\Program Files\Cucusoft
                        2008-04-06 08:23 --------- d-----w C:\Program Files\Microsoft Money 2005
                        2008-04-06 08:12 --------- d-----w C:\Program Files\Messenger Plus! Live
                        2008-03-30 06:12 --------- d-----w C:\Program Files\Java
                        2008-03-27 17:51 --------- d-----w C:\Program Files\Windows Live Safety Center
                        2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
                        2008-03-25 04:51 621,344 ------w C:\WINDOWS\system32\dllcache\mswstr10.dll
                        2008-03-25 04:51 194,144 ----a-w C:\WINDOWS\system32\msjint40.dll
                        2008-03-25 04:51 194,144 ------w C:\WINDOWS\system32\dllcache\msjint40.dll
                        2008-03-20 08:09 1,845,376 ----a-w C:\WINDOWS\system32\win32k.sys
                        2008-03-20 08:09 1,845,376 ------w C:\WINDOWS\system32\dllcache\win32k.sys
                        2008-03-01 16:28 3,591,680 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
                        2008-02-29 08:57 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe
                        2008-02-29 08:56 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe
                        2008-02-22 10:00 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
                        2007-05-30 12:08 480,848 ----a-w C:\Documents and Settings\All Users\Application Data\pswi_preloaded.exe
                        2007-04-05 08:38 836 ----a-w C:\Documents and Settings\DOM\Application Data\ViewerApp.dat
                        2006-05-19 06:57 31 ----a-w C:\Documents and Settings\DOMINIQUE\getfile.dat
                        2006-04-09 21:31 31 ----a-w C:\Documents and Settings\FAMILLE\getfile.dat
                        2006-04-03 13:52 100,816 ----a-w C:\Documents and Settings\DOMINIQUE\Application Data\GDIPFONTCACHEV1.DAT
                        2007-11-07 13:39 168 --sh--r C:\WINDOWS\system32\93B7F23EBD.sys
                        2007-11-07 13:39 3,766 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
                        .

                        ((((((((((((((((((((((((((((( snapshot_2008-05-16_19.04.27,45 )))))))))))))))))))))))))))))))))))))))))
                        .
                        - 2008-05-16 11:11:24 2,048 --s-a-w C:\WINDOWS\bootstat.dat
                        + 2008-05-21 08:10:33 2,048 --s-a-w C:\WINDOWS\bootstat.dat
                        + 2008-05-21 08:11:08 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_68c.dat
                        .
                        ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
                        .
                        .
                        REGEDIT4
                        *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

                        [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}]
                        2008-04-16 17:56 1107296 --a------ C:\Program Files\Search Settings\kb127\SearchSettings.dll

                        [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                        "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 14:00 15360]
                        "EzStatus"="C:\Apps\EZHome\EZStatus.exe" [2004-12-20 21:03 94208]

                        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                        "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-05 14:00 208952]
                        "PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-05 14:00 455168]
                        "PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-05 14:00 455168]
                        "Raccourci vers la page des propriétés de High Definition Audio"="HDAudPropShortcut.exe" [2004-03-17 15:10 61952 C:\WINDOWS\system32\Hdaudpropshortcut.exe]
                        "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
                        "ccApp"="C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe" [2004-09-07 15:25 58488]
                        "HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe" [2003-05-07 21:56 188416]
                        "HPHUPD05"="C:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" [2003-05-23 05:03 49152]
                        "HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-04-08 12:45 212992]
                        "HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [2002-12-17 11:40 49152]
                        "HPHmon05"="C:\WINDOWS\system32\hphmon05.exe" [2003-05-23 04:56 483328]
                        "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-30 21:05 344064]
                        "TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2006-11-17 12:41 180269]
                        "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 20:51 39792]
                        "SoundMan"="SOUNDMAN.EXE" [2005-06-21 15:09 90112 C:\WINDOWS\SOUNDMAN.EXE]
                        "AlcWzrd"="ALCWZRD.EXE" [2005-06-29 13:26 2806272 C:\WINDOWS\ALCWZRD.EXE]
                        "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20 866584]
                        "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-03-29 19:37 79224]
                        "My Web Search Bar Search Scope Monitor"="C:\PROGRA~1\MYWEBS~1\bar\2.bin\m3SrchMn.exe" [ ]
                        "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-03-28 23:37 413696]
                        "SearchSettings"="C:\Program Files\Search Settings\SearchSettings.exe" [2008-04-16 17:56 985440]

                        [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                        "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 14:00 15360]
                        "EzStatus"="C:\Apps\EZHome\EZStatus.exe" [2004-12-20 21:03 94208]

                        C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
                        DataViz Inc Messenger.lnk - C:\Program Files\Fichiers communs\DataViz\DvzIncMsgr.exe [2006-11-17 12:25:12 28672]

                        [HKEY_LOCAL_MACHINE\software\microsoft\security center]
                        "AntiVirusDisableNotify"=dword:00000001
                        "AntiVirusOverride"=dword:00000001

                        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                        "%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\logo_ubi.exe"=
                        "%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\pandora.exe"=
                        "%windir%\\system32\\sessmgr.exe"=
                        "C:\\APPS\\Inventime\\my.exe"=
                        "C:\\APPS\\skype\\phone\\Skype.exe"=
                        "C:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
                        "C:\\APPS\\Powercinema\\PowerCinema.exe"=
                        "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"=
                        "C:\\WINDOWS\\system32\\rtcshare.exe"=
                        "C:\\Program Files\\Kodak\\Printer Dock\\Kodak Wireless Printer Computer Setup Assistant.exe"=
                        "C:\\Program Files\\uTorrent\\utorrent.exe"=
                        "C:\\Program Files\\palmOne\\Hotsync.exe"=
                        "C:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
                        "C:\\Program Files\\Messenger\\msmsgs.exe"=
                        "C:\\Program Files\\iTunes\\iTunes.exe"=
                        "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
                        "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
                        "C:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\Kodak Software Updater.exe"=
                        "%windir%\\Network Diagnostic\\xpnetdiag.exe"=

                        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
                        "6112:UDP"= 6112:UDP:azur1
                        "6112:TCP"= 6112:TCP:azur1

                        R0 sonypvl3;sonypvl3;C:\WINDOWS\system32\drivers\sonypvl3.sys [2004-09-22 12:55]
                        R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 19:31]
                        R1 sonypvf3;sonypvf3;C:\WINDOWS\system32\drivers\sonypvf3.sys [2004-11-15 14:55]
                        R1 sonypvt3;sonypvt3;C:\WINDOWS\system32\drivers\sonypvt3.sys [2004-12-06 15:26]
                        R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]
                        R3 3xHybrid;3xHybrid service;C:\WINDOWS\system32\DRIVERS\3xHybrid.sys [2004-11-08 18:59]
                        R3 camvid20;Philips ToUcam Camera; Video;C:\WINDOWS\system32\DRIVERS\camdrv21.sys []
                        R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]
                        S1 sonypvd3;Sony DVD Handycam;C:\WINDOWS\system32\DRIVERS\sonypvd3.sys [2004-12-07 16:00]
                        S3 Boonty Games;Boonty Games;"C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe" [2006-02-05 19:47]
                        S3 USB_RNDIS_51;Broadcom USB Remote NDIS Device Driver;C:\WINDOWS\system32\DRIVERS\usb8023.sys [2004-08-05 14:00]
                        S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
                        S3 ZD1211U(Wireless);IEEE 802.11g USB Adapter Driver(Wireless);C:\WINDOWS\system32\DRIVERS\zd1211u.sys []

                        .
                        Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
                        "2008-05-08 09:32:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
                        - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
                        "2008-02-03 11:07:00 C:\WINDOWS\Tasks\HP DArC Task #Hewlett-Packard#7600#MY3852322CK2.job"
                        - C:\Program Files\HP\hpcoretech\comp\hpdarc.exe$/#Hewlett-Packard#7600#MY3852322CK2
                        "2008-05-20 18:06:00 C:\WINDOWS\Tasks\HP Usg Daily.job"
                        - C:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\pexpress\hphped05.exe
                        "2008-05-21 08:14:03 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
                        - C:\Program Files\Windows Defender\MpCmdRun.exe
                        "2005-06-17 11:18:38 C:\WINDOWS\Tasks\Rappel d'enregistrement 1.job"
                        - C:\WINDOWS\system32\OOBE\oobebaln.exe
                        "2008-05-21 09:10:00 C:\WINDOWS\Tasks\Symantec NetDetect.job"
                        - C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE
                        "2008-05-21 09:19:00 C:\WINDOWS\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job"
                        - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
                        .
                        **************************************************************************

                        catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                        Rootkit scan 2008-05-21 11:56:01
                        Windows 5.1.2600 Service Pack 2 NTFS

                        Balayage processus cachés ...

                        Balayage caché autostart entries ...

                        Balayage des fichiers cachés ...

                        Scan terminé avec succès
                        Les fichiers cachés: 0

                        **************************************************************************

                        [HKEY_LOCAL_MACHINE\system\ControlSet003\Services\MysqlInventime]
                        "ImagePath"="c:\mysql\bin\mysqld-nt MysqlInventime"
                        .
                        Temps d'accomplissement: 2008-05-21 11:56:47
                        ComboFix-quarantined-files.txt 2008-05-21 09:56:43
                        ComboFix2.txt 2008-05-17 12:36:54
                        ComboFix3.txt 2008-05-16 17:04:41
                        ComboFix4.txt 2008-05-06 14:21:25

                        Pre-Run: 104,557,846,528 octets libres
                        Post-Run: 104,581,632,000 octets libres

                        208 --- E O F --- 2008-05-21 06:40:49

                        Logfile of Trend Micro HijackThis v2.0.2
                        Scan saved at 11:58:17, on 21/05/2008
                        Platform: Windows XP SP2 (WinNT 5.01.2600)
                        MSIE: Internet Explorer v7.00 (7.00.6000.16640)
                        Boot mode: Normal

                        Running processes:
                        C:\WINDOWS\System32\smss.exe
                        C:\WINDOWS\system32\winlogon.exe
                        C:\WINDOWS\system32\services.exe
                        C:\WINDOWS\system32\lsass.exe
                        C:\WINDOWS\system32\Ati2evxx.exe
                        C:\WINDOWS\system32\svchost.exe
                        C:\Program Files\Windows Defender\MsMpEng.exe
                        C:\WINDOWS\System32\svchost.exe
                        C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
                        C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
                        C:\WINDOWS\system32\Ati2evxx.exe
                        C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                        C:\Program Files\Alwil Software\Avast4\ashServ.exe
                        C:\WINDOWS\system32\spoolsv.exe
                        C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                        c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
                        C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
                        C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
                        C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
                        C:\WINDOWS\system32\PSIService.exe
                        C:\WINDOWS\system32\svchost.exe
                        c:\APPS\Powercinema\Kernel\TV\CLSched.exe
                        C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
                        C:\WINDOWS\System32\svchost.exe
                        C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
                        C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
                        C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
                        C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
                        C:\WINDOWS\system32\hphmon05.exe
                        C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
                        C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
                        C:\WINDOWS\SOUNDMAN.EXE
                        C:\WINDOWS\ALCWZRD.EXE
                        C:\Program Files\Windows Defender\MSASCui.exe
                        C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                        C:\Program Files\Search Settings\SearchSettings.exe
                        C:\WINDOWS\system32\ctfmon.exe
                        C:\Apps\EZHome\EZStatus.exe
                        C:\Program Files\Fichiers communs\DataViz\DvzIncMsgr.exe
                        C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
                        C:\WINDOWS\system32\HPZipm12.exe
                        C:\WINDOWS\explorer.exe
                        C:\Program Files\internet explorer\iexplore.exe
                        C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

                        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
                        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                        R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
                        R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.apple.com/itunes/
                        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                        R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll
                        O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
                        O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
                        O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - c:\apps\skype\phone\IEPlugin\SKYPEI~1.DLL
                        O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                        O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                        O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                        O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll
                        O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                        O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
                        O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
                        O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
                        O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
                        O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAudPropShortcut.exe
                        O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
                        O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
                        O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
                        O4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
                        O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
                        O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
                        O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe
                        O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
                        O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                        O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
                        O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
                        O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
                        O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
                        O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                        O4 - HKLM\..\Run: [My Web Search Bar Search Scope Monitor] "C:\PROGRA~1\MYWEBS~1\bar\2.bin\m3SrchMn.exe" /m=0
                        O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                        O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\Search Settings\SearchSettings.exe
                        O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                        O4 - HKCU\..\Run: [EzStatus] C:\Apps\EZHome\EZStatus.exe
                        O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                        O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                        O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                        O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                        O4 - Global Startup: DataViz Inc Messenger.lnk = C:\Program Files\Fichiers communs\DataViz\DvzIncMsgr.exe
                        O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
                        O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                        O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                        O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\apps\skype\phone\IEPlugin\SKYPEI~1.DLL
                        O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
                        O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
                        O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\MATHILDE\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk (file missing)
                        O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                        O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                        O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                        O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
                        O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
                        O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
                        O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
                        O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
                        O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
                        O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
                        O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
                        O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
                        O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
                        O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
                        O16 - DPF: {A1F2F2CE-06AF-483C-9F12-D3BAA72477D6} (BatchDownloader Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/DigWXMSN.cab
                        O16 - DPF: {A73BAEFA-EE65-494D-BEDB-DD3E5A34FA98} (Image Uploader) - http://www.extrafilm.fr/ImageUploader4.cab
                        O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab
                        O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
                        O17 - HKLM\System\CCS\Services\Tcpip\..\{46875C85-3A6B-43B4-923F-ABA01E9F2193}: NameServer = 192.168.1.1,192.168.1.2
                        O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
                        O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                        O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                        O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
                        O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
                        O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                        O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                        O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                        O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
                        O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
                        O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
                        O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
                        O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
                        O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
                        O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
                        O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
                        O23 - Service: MysqlInventime - Unknown owner - c:\mysql\bin\mysqld-nt.exe
                        O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
                        O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
                        0
                        1. jlpjlp Contributeur sécurité
                          ok pour btfix qui est indispo depuis hier

                          mais tu a mal fais la suite qui va remplacer btfix

                          recommence

                          _____________

                          pour fusionner:regarde ce lien

                          http://img.photobucket.com/albums/v666/sUBs/CFScript.gif

                          _______________

                          telecharge combofix:

                          http://download.bleepingcomputer.com/sUBs/ComboFix.exe
                          Sauvegarde le sur ton bureau et pas ailleurs !

                          Ferme tout tes navigateurs (donc copie ou imprime les instructions avant)

                          Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :

                          File::
                          C:\Program Files\Search Settings
                          C:\Program Files\Search Settings\kb127\SearchSettings.dll
                          C:\Program Files\Search Settings\SearchSettings.exe
                          C:\PROGRA~1\MYWEBS~1\bar\2.bin\m3SrchMn.exe
                          C:\Documents and Settings\DOM\Application Data\Search Settings
                          C:\Documents and Settings\ben\Application Data\Search Settings
                          C:\Program Files\Search Settings

                          Registry::
                          [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}]
                          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                          "My Web Search Bar Search Scope Monitor"=-
                          "SearchSettings"=-

                          Enregistre ce fichier sous le nom CFscript (attention aux minuscles et majuscules)

                          Fait un glisser/déposer de ce fichier CFscrïpt sur le fichier ComboFix.exe

                          Clique sur le fichier CFScript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFScript vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.

                          Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

                          Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

                          Ne touche à rien tant que le scan n'est pas terminé.

                          Une fois le scan achevé, un rapport va s'afficher: poste son contenu.

                          Remets aussi un rapport Hijackthis

                          Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt
                          0

                          Discussions similaires

                          Softonic,est-ce un virus ?
                          techmel1

                          6 réponses
                          Chrome://newtab
                          Nova

                          14 réponses
                          Désinstaller Softonic
                          Diguimette

                          5 réponses
                          Supprimer New Tab
                          tysaozon

                          8 réponses
                          Virus dans filezilla
                          balnelius10

                          9 réponses