Désistaller antivirus 2008 - Page 2

Copie le texte ci-dessous :

File::
C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe

Folder::
C:\Program Files\Fichiers communs\BOONTY Shared
C:\Program Files\Macrogaming

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SweetIM"=-

Driver::
Boonty Games

Ouvre le Bloc-Notes puis colle le texte copié.
(Démarrer\Tous les programmes\Accessoires\Bloc notes.)
Sauvegarde ce fichier sous le nom de CFScript.txt.

Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :

http://sd-1.archive-host.com/membres/up/1366464061/CFScript.gif

Cela va relancer Combofix,

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Après redémarrage, poste le contenu du rapport Combofix.txt accompagné d'un rapport Hijackthis.

S'il n'y a pas de rédémarrage, poste quand même les rapports.

VOILA LE RAPPORT HIJACK
ENCORE MERCI BEAUCOUP

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:37, on 2008-07-09
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\iolo\Common\Lib\ioloDMVSvc.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\CmWatch.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Corel\Corel Snapfire\Corel Photo Downloader.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\iolo\System Mechanic 7\SMSystemAnalyzer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Assistant de connexion WiFi\Wizard\Agent_WiFi.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\PROGRA~1\Wanadoo\Watch.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Microsoft Money\System\urlmap.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: VMN Toolbar - {4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33} - C:\PROGRA~1\VMNTOO~1\VMNTOO~1.DLL
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: VMN Toolbar - {4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33} - C:\PROGRA~1\VMNTOO~1\VMNTOO~1.DLL
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [CmCardRun] C:\WINDOWS\system32\CmWatch.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [MoneyStartUp10.0] "C:\Program Files\Microsoft Money\System\Activation.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Snapfire\Corel Photo Downloader.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [SMSystemAnalyzer] "C:\Program Files\iolo\System Mechanic 7\SMSystemAnalyzer.exe"
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [TVAgent WiFi] C:\Program Files\Assistant de connexion WiFi\Wizard\Agent_WiFi.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &MSN Search - res://C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1105\fr-fr\msntb.dll/search.htm
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iolo DMV Service (ioloDMV) - Unknown owner - C:\Program Files\iolo\Common\Lib\ioloDMVSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe

va dans poste de travail
entre dans le disque C
cherche : combofix.txt le second ....

ComboFix 08-07-08.9 - Propriétaire 2008-07-09 23:22:57.2 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.204 [GMT 2:00]
Endroit: C:\Documents and Settings\Propriétaire\Bureau\combofix.exe
Command switches used :: C:\Documents and Settings\Propriétaire\Bureau\CFScript.txt..txt
* Création d'un nouveau point de restauration

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]

FILE ::
C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\Fichiers communs\BOONTY Shared
C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
C:\Program Files\Macrogaming
C:\Program Files\Macrogaming\SweetIM\conf\adapter.xml
C:\Program Files\Macrogaming\SweetIM\conf\logger.xml
C:\Program Files\Macrogaming\SweetIM\conf\messages.xml
C:\Program Files\Macrogaming\SweetIM\conf\sweetim.xml
C:\Program Files\Macrogaming\SweetIM\conf\sweetimapp.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\adil.h@hotmail.fr\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\adil.h@hotmail.fr\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\akro.13@hotmail.fr\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\akro.13@hotmail.fr\lastuse_Audibles.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\akro.13@hotmail.fr\lastuse_SoundFX.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\akro.13@hotmail.fr\lastuse_SpecialFX.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\akro.13@hotmail.fr\lastuse_Winks.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\akro.13@hotmail.fr\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\angedemonpkpas@hotmail.fr\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\angedemonpkpas@hotmail.fr\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\anna_fhal@hotmail.com\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\anna_fhal@hotmail.com\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\armand.bour@hotmail.fr\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\armand.bour@hotmail.fr\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\babyboy13010@hotmail.fr\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\babyboy13010@hotmail.fr\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\bibise94@hotmail.com\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\bibise94@hotmail.com\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\billy703@hotmail.com\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\billy703@hotmail.com\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\celine_fhal@hotmail.com\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\celine_fhal@hotmail.com\lastuse_SoundFX.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\celine_fhal@hotmail.com\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\celine21mars@hotmail.com\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\celine21mars@hotmail.com\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\double_face13@msn.com\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\double_face13@msn.com\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\etoferock@hotmail.fr\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\etoferock@hotmail.fr\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\etoph01@hotmail.fr\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\etoph01@hotmail.fr\lastuse_SoundFX.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\etoph01@hotmail.fr\lastuse_SpecialFX.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\etoph01@hotmail.fr\lastuse_Winks.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\etoph01@hotmail.fr\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\fmahalma@hotmail.com\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\fmahalma@hotmail.com\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\gabi2205@hotmail.fr\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\gabi2205@hotmail.fr\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\hypnose003@hotmail.fr\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\hypnose003@hotmail.fr\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\jamel-dine@hotmail.fr\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\jamel-dine@hotmail.fr\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\komando-fada@hotmail.fr\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\komando-fada@hotmail.fr\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\komando_13@hotmail.com\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\komando_13@hotmail.com\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\lescelines@hotmail.fr\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\lescelines@hotmail.fr\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\lindab10@hotmail.fr\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\lindab10@hotmail.fr\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\lindab25@hotmail.fr\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\lindab25@hotmail.fr\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\main_user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\mohlies@hotmail.fr\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\mohlies@hotmail.fr\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\mymybilly@hotmail.fr\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\mymybilly@hotmail.fr\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\mynoucha@hotmail.fr\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\mynoucha@hotmail.fr\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\renflo0013@hotmail.com\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\renflo0013@hotmail.com\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\ronald_0@hotmail.fr\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\ronald_0@hotmail.fr\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\samsebavie@hotmail.fr\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\samsebavie@hotmail.fr\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\sebastienbour@msn.com\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\sebastienbour@msn.com\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\shnaider81@hotmail.com\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\shnaider81@hotmail.com\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\simplysimple@hotmail.fr\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\simplysimple@hotmail.fr\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\sss_zeralda_love@hotmail.com\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\sss_zeralda_love@hotmail.com\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\thegunners13@hotmail.fr\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\thegunners13@hotmail.fr\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\titanic@coeur.com\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\titanic@coeur.com\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\titi_120@hotmail.com\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\titi_120@hotmail.com\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\w-116@hotmail.fr\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\w-116@hotmail.fr\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\w-16@hotmail.fr\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\w-16@hotmail.fr\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\yayelle@hotmail.fr\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\yayelle@hotmail.fr\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\zeralda-bilel-zeralda@hotmail.com\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\zeralda-bilel-zeralda@hotmail.com\user_config.xml
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100AA.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100AB.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100AC.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100AE.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100B3.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100B6.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100B7.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100C5.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100C8.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100D1.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100D2.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100D5.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100D8.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100DF.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100E8.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100FA.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100FD.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100FE.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010104.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010105.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010106.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010108.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010109.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001010A.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010121.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010122.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010123.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010124.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010814.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001081A.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001081C.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010840.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010841.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010846.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010847.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010848.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001084A.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001084B.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001084C.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001084D.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010850.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010857.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010859.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001085D.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001085E.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010861.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001088D.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001088F.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010893.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010896.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010897.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001089B.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001089C.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001089D.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000108A7.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000108AA.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000108AB.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000108AD.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000108BE.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000108C2.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0002006C.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0002006D.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0002006E.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00020075.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00020077.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00020079.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0002007A.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0002007D.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000200A9.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000200BF.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000200C0.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000200C1.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000200ED.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0002010E.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00020119.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0002013F.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00020144.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00020185.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0002018E.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000201C7.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00030001.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00030005.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00030007.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00030011.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00030013.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00030019.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0003001B.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0003001D.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00030040.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00030045.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0003005F.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00040015.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0004001C.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0004001E.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0004001F.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00040021.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00040022.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00040024.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00040025.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0004002A.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0004002B.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0004002C.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00040039.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0004003C.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00040047.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0004004A.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0004005A.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0004005F.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00040061.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00040063.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00040067.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0004006B.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0004006E.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00040073.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00040078.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00040083.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000400A3.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000400AC.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000400C3.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000400C4.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00050001.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00050002.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00050004.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00050005.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00060024.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0006006A.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0006007D.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0006007E.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000600A7.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000600DD.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\cache_indx.dat
C:\Program Files\Macrogaming\SweetIM\default.xml
C:\Program Files\Macrogaming\SweetIM\mgAdaptersProxy.dll
C:\Program Files\Macrogaming\SweetIM\mgArchive.dll
C:\Program Files\Macrogaming\SweetIM\mgcommon.dll
C:\Program Files\Macrogaming\SweetIM\mgcommunication.dll
C:\Program Files\Macrogaming\SweetIM\mgconfig.dll
C:\Program Files\Macrogaming\SweetIM\mgFlashPlayer.dll
C:\Program Files\Macrogaming\SweetIM\mghooking.dll
C:\Program Files\Macrogaming\SweetIM\mgIEPlayer.dll
C:\Program Files\Macrogaming\SweetIM\mglogger.dll
C:\Program Files\Macrogaming\SweetIM\mgMsnAuto.dll
C:\Program Files\Macrogaming\SweetIM\mgMsnMessengerAdapter.dll
C:\Program Files\Macrogaming\SweetIM\mgMsnProt.dll
C:\Program Files\Macrogaming\SweetIM\mgSweetIM.dll
C:\Program Files\Macrogaming\SweetIM\mgUpdateSupport.dll
C:\Program Files\Macrogaming\SweetIM\mgxml_wrapper.dll
C:\Program Files\Macrogaming\SweetIM\resources\gdiplus.dll
C:\Program Files\Macrogaming\SweetIM\resources\ImageOle.dll
C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
C:\Program Files\Macrogaming\SweetIM\update\lastversioninfo.xml

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_BOONTY_GAMES
-------\Service_Boonty Games

((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-06-09 to 2008-07-09 ))))))))))))))))))))))))))))))))))))
.

2008-07-09 20:00 . 2008-07-07 17:35 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-07-09 19:59 . 2008-07-09 20:00 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-07-09 19:59 . 2008-07-09 19:59 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-07-09 19:59 . 2008-07-07 17:35 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-07-09 19:50 . 2008-07-09 19:50 <REP> d-------- C:\Program Files\Trend Micro
2008-07-09 10:36 . 2008-07-09 10:36 268 --ah----- C:\sqmdata17.sqm
2008-07-09 10:36 . 2008-07-09 10:36 244 --ah----- C:\sqmnoopt17.sqm
2008-07-08 15:36 . 2008-07-08 15:37 <REP> d-------- C:\WINDOWS\system32\NtmsData
2008-07-03 17:10 . 2008-07-03 17:11 <REP> d-------- C:\Program Files\eMule

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-09 21:30 --------- d-----w C:\Program Files\Wanadoo
2008-07-09 20:39 --------- d-----w C:\Program Files\CFWebAdvancedU
2008-07-07 07:41 5,852 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2008-07-02 10:59 --------- d-----w C:\Program Files\VideoLAN
2008-06-07 16:31 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-03-03 13:04 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
2007-10-17 23:18 278,528 ----a-w C:\Program Files\Fichiers communs\FDEUnInstaller.exe
2007-02-26 01:03 1,140,304 -c--a-w C:\Documents and Settings\All Users\Application Data\pswi_preloaded.exe
2005-08-27 11:30 5,065 ----a-w C:\WINDOWS\inf\SETD.tmp
2007-06-09 09:41 248 --sh--r C:\WINDOWS\system32\31F674FCA2.sys
2007-08-30 21:48 9,104 --sh--r C:\WINDOWS\system32\msivs10.dll
2007-08-30 21:46 9,104 --sh--r C:\WINDOWS\system32\msivsvt.dll
.

((((((((((((((((((((((((((((( snapshot@2008-07-09_22.48.47,87 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-07-09 19:49:44 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-07-09 21:27:46 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2005-10-20 18:02:28 163,328 ----a-w C:\WINDOWS\erdnt\subs\ERDNT.EXE
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-20 01:09 15360]
"MoneyAgent"="C:\Program Files\Microsoft Money\System\Money Express.exe" [2001-07-25 11:00 192568]
"WOOKIT"="C:\PROGRA~1\Wanadoo\Shell.exe" [2004-08-23 15:50 122880]
"TVAgent WiFi"="C:\Program Files\Assistant de connexion WiFi\Wizard\Agent_WiFi.exe" [2005-04-12 17:44 905216]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24 1694208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CmCardRun"="C:\WINDOWS\system32\CmWatch.exe" [2003-09-16 11:50 229376]
"MoneyStartUp10.0"="C:\Program Files\Microsoft Money\System\Activation.exe" [2001-07-25 11:00 245810]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2005-01-12 15:54 241664]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-17 00:11 49152]
"Corel Photo Downloader"="C:\Program Files\Corel\Corel Snapfire\Corel Photo Downloader.exe" [2006-10-31 12:10 478800]
"ISUSPM Startup"="C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2005-02-16 16:15 221184]
"ISUSScheduler"="C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2005-02-16 16:15 81920]
"SMSystemAnalyzer"="C:\Program Files\iolo\System Mechanic 7\SMSystemAnalyzer.exe" [2007-10-03 10:05 819560]
"WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 15:49 20480]
"WOOTASKBARICON"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 17:55 32768]
"ATIModeChange"="Ati2mdxx.exe" [2001-09-04 11:24 28672 C:\WINDOWS\system32\Ati2mdxx.exe]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Wanadoo\\WOOBrowser\\WOOBrowser.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\WINDOWS\\PCHealth\\HelpCtr\\Binaries\\helpctr.exe"=
"C:\\Program Files\\eMule\\eMule.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]
R3 rtl8180;Realtek RTL8180 Wireless LAN (Mini-)PCI NIC NT Driver;C:\WINDOWS\system32\DRIVERS\RTL8180.SYS [2003-12-04 04:10]
R3 SCREAMINGBDRIVER;Screaming Bee Audio;C:\WINDOWS\system32\drivers\ScreamingBAudio.sys [2006-09-27 00:21]
R3 UMSSSTOR;C-Media Storage;C:\WINDOWS\system32\DRIVERS\UMSS.SYS [2003-09-16 08:48]
S1 lusbaudio;Microphone USB Logitech;C:\WINDOWS\system32\drivers\OVSound2.sys [2001-08-17 22:05]
S3 QCAbsee;QuickCam Web Logitech (0801);C:\WINDOWS\system32\DRIVERS\OVCA.sys [2001-08-17 22:05]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2c0b72d8-7346-11dc-bded-000272430670}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL antihost.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2c0b72d9-7346-11dc-bded-000272430670}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL antihost.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2d1d6e2c-7e7d-11dc-be06-d1742e29724a}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL antihost.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{707eac62-7a3b-11dc-be00-cf80e5dbcf51}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL antihost.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{91b8a5be-c76f-11db-bc24-000272430670}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL antihost.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ae3b7915-c800-11db-bc27-000272430670}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL antihost.exe

*Newly Created Service* - PCANDIS5
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-07-09 21:16:00 C:\WINDOWS\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job"

ComboFix 08-07-08.9 - Propriétaire 2008-07-09 23:22:57.2 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.204 [GMT 2:00]
Endroit: C:\Documents and Settings\Propriétaire\Bureau\combofix.exe
Command switches used :: C:\Documents and Settings\Propriétaire\Bureau\CFScript.txt..txt
* Création d'un nouveau point de restauration

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]

FILE ::
C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\Fichiers communs\BOONTY Shared
C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
C:\Program Files\Macrogaming
C:\Program Files\Macrogaming\SweetIM\conf\adapter.xml
C:\Program Files\Macrogaming\SweetIM\conf\logger.xml
C:\Program Files\Macrogaming\SweetIM\conf\messages.xml
C:\Program Files\Macrogaming\SweetIM\conf\sweetim.xml
C:\Program Files\Macrogaming\SweetIM\conf\sweetimapp.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\adil.h@hotmail.fr\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\adil.h@hotmail.fr\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\akro.13@hotmail.fr\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\akro.13@hotmail.fr\lastuse_Audibles.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\akro.13@hotmail.fr\lastuse_SoundFX.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\akro.13@hotmail.fr\lastuse_SpecialFX.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\akro.13@hotmail.fr\lastuse_Winks.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\akro.13@hotmail.fr\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\angedemonpkpas@hotmail.fr\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\angedemonpkpas@hotmail.fr\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\anna_fhal@hotmail.com\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\anna_fhal@hotmail.com\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\armand.bour@hotmail.fr\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\armand.bour@hotmail.fr\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\babyboy13010@hotmail.fr\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\babyboy13010@hotmail.fr\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\bibise94@hotmail.com\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\bibise94@hotmail.com\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\billy703@hotmail.com\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\billy703@hotmail.com\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\celine_fhal@hotmail.com\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\celine_fhal@hotmail.com\lastuse_SoundFX.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\celine_fhal@hotmail.com\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\celine21mars@hotmail.com\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\celine21mars@hotmail.com\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\double_face13@msn.com\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\double_face13@msn.com\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\etoferock@hotmail.fr\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\etoferock@hotmail.fr\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\etoph01@hotmail.fr\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\etoph01@hotmail.fr\lastuse_SoundFX.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\etoph01@hotmail.fr\lastuse_SpecialFX.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\etoph01@hotmail.fr\lastuse_Winks.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\etoph01@hotmail.fr\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\fmahalma@hotmail.com\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\fmahalma@hotmail.com\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\gabi2205@hotmail.fr\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\gabi2205@hotmail.fr\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\hypnose003@hotmail.fr\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\hypnose003@hotmail.fr\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\jamel-dine@hotmail.fr\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\jamel-dine@hotmail.fr\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\komando-fada@hotmail.fr\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\komando-fada@hotmail.fr\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\komando_13@hotmail.com\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\komando_13@hotmail.com\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\lescelines@hotmail.fr\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\lescelines@hotmail.fr\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\lindab10@hotmail.fr\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\lindab10@hotmail.fr\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\lindab25@hotmail.fr\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\lindab25@hotmail.fr\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\main_user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\mohlies@hotmail.fr\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\mohlies@hotmail.fr\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\mymybilly@hotmail.fr\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\mymybilly@hotmail.fr\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\mynoucha@hotmail.fr\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\mynoucha@hotmail.fr\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\renflo0013@hotmail.com\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\renflo0013@hotmail.com\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\ronald_0@hotmail.fr\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\ronald_0@hotmail.fr\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\samsebavie@hotmail.fr\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\samsebavie@hotmail.fr\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\sebastienbour@msn.com\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\sebastienbour@msn.com\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\shnaider81@hotmail.com\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\shnaider81@hotmail.com\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\simplysimple@hotmail.fr\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\simplysimple@hotmail.fr\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\sss_zeralda_love@hotmail.com\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\sss_zeralda_love@hotmail.com\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\thegunners13@hotmail.fr\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\thegunners13@hotmail.fr\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\titanic@coeur.com\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\titanic@coeur.com\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\titi_120@hotmail.com\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\titi_120@hotmail.com\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\w-116@hotmail.fr\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\w-116@hotmail.fr\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\w-16@hotmail.fr\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\w-16@hotmail.fr\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\yayelle@hotmail.fr\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\yayelle@hotmail.fr\user_config.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\zeralda-bilel-zeralda@hotmail.com\emoticons_shortcut.xml
C:\Program Files\Macrogaming\SweetIM\conf\users\zeralda-bilel-zeralda@hotmail.com\user_config.xml
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100AA.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100AB.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100AC.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100AE.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100B3.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100B6.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100B7.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100C5.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100C8.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100D1.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100D2.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100D5.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100D8.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100DF.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100E8.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100FA.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100FD.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100FE.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010104.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010105.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010106.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010108.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010109.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001010A.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010121.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010122.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010123.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010124.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010814.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001081A.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001081C.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010840.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010841.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010846.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010847.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010848.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001084A.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001084B.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001084C.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001084D.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010850.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010857.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010859.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001085D.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001085E.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010861.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001088D.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001088F.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010893.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010896.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010897.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001089B.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001089C.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001089D.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000108A7.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000108AA.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000108AB.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000108AD.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000108BE.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000108C2.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0002006C.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0002006D.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0002006E.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00020075.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00020077.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00020079.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0002007A.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0002007D.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000200A9.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000200BF.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000200C0.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000200C1.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000200ED.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0002010E.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00020119.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0002013F.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00020144.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00020185.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0002018E.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000201C7.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00030001.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00030005.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00030007.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00030011.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00030013.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00030019.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0003001B.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0003001D.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00030040.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00030045.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0003005F.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00040015.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0004001C.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0004001E.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0004001F.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00040021.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00040022.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00040024.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00040025.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0004002A.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0004002B.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0004002C.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00040039.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0004003C.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00040047.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0004004A.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0004005A.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0004005F.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00040061.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00040063.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00040067.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0004006B.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0004006E.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00040073.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00040078.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00040083.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000400A3.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000400AC.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000400C3.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000400C4.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00050001.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00050002.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00050004.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00050005.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00060024.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0006006A.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0006007D.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0006007E.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000600A7.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000600DD.dat
C:\Program Files\Macrogaming\SweetIM\data\contentdb\cache_indx.dat
C:\Program Files\Macrogaming\SweetIM\default.xml
C:\Program Files\Macrogaming\SweetIM\mgAdaptersProxy.dll
C:\Program Files\Macrogaming\SweetIM\mgArchive.dll
C:\Program Files\Macrogaming\SweetIM\mgcommon.dll
C:\Program Files\Macrogaming\SweetIM\mgcommunication.dll
C:\Program Files\Macrogaming\SweetIM\mgconfig.dll
C:\Program Files\Macrogaming\SweetIM\mgFlashPlayer.dll
C:\Program Files\Macrogaming\SweetIM\mghooking.dll
C:\Program Files\Macrogaming\SweetIM\mgIEPlayer.dll
C:\Program Files\Macrogaming\SweetIM\mglogger.dll
C:\Program Files\Macrogaming\SweetIM\mgMsnAuto.dll
C:\Program Files\Macrogaming\SweetIM\mgMsnMessengerAdapter.dll
C:\Program Files\Macrogaming\SweetIM\mgMsnProt.dll
C:\Program Files\Macrogaming\SweetIM\mgSweetIM.dll
C:\Program Files\Macrogaming\SweetIM\mgUpdateSupport.dll
C:\Program Files\Macrogaming\SweetIM\mgxml_wrapper.dll
C:\Program Files\Macrogaming\SweetIM\resources\gdiplus.dll
C:\Program Files\Macrogaming\SweetIM\resources\ImageOle.dll
C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
C:\Program Files\Macrogaming\SweetIM\update\lastversioninfo.xml

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_BOONTY_GAMES
-------\Service_Boonty Games

((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-06-09 to 2008-07-09 ))))))))))))))))))))))))))))))))))))
.

2008-07-09 20:00 . 2008-07-07 17:35 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-07-09 19:59 . 2008-07-09 20:00 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-07-09 19:59 . 2008-07-09 19:59 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-07-09 19:59 . 2008-07-07 17:35 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-07-09 19:50 . 2008-07-09 19:50 <REP> d-------- C:\Program Files\Trend Micro
2008-07-09 10:36 . 2008-07-09 10:36 268 --ah----- C:\sqmdata17.sqm
2008-07-09 10:36 . 2008-07-09 10:36 244 --ah----- C:\sqmnoopt17.sqm
2008-07-08 15:36 . 2008-07-08 15:37 <REP> d-------- C:\WINDOWS\system32\NtmsData
2008-07-03 17:10 . 2008-07-03 17:11 <REP> d-------- C:\Program Files\eMule

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-09 21:30 --------- d-----w C:\Program Files\Wanadoo
2008-07-09 20:39 --------- d-----w C:\Program Files\CFWebAdvancedU
2008-07-07 07:41 5,852 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2008-07-02 10:59 --------- d-----w C:\Program Files\VideoLAN
2008-06-07 16:31 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-03-03 13:04 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
2007-10-17 23:18 278,528 ----a-w C:\Program Files\Fichiers communs\FDEUnInstaller.exe
2007-02-26 01:03 1,140,304 -c--a-w C:\Documents and Settings\All Users\Application Data\pswi_preloaded.exe
2005-08-27 11:30 5,065 ----a-w C:\WINDOWS\inf\SETD.tmp
2007-06-09 09:41 248 --sh--r C:\WINDOWS\system32\31F674FCA2.sys
2007-08-30 21:48 9,104 --sh--r C:\WINDOWS\system32\msivs10.dll
2007-08-30 21:46 9,104 --sh--r C:\WINDOWS\system32\msivsvt.dll
.

((((((((((((((((((((((((((((( snapshot@2008-07-09_22.48.47,87 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-07-09 19:49:44 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-07-09 21:27:46 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2005-10-20 18:02:28 163,328 ----a-w C:\WINDOWS\erdnt\subs\ERDNT.EXE
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-20 01:09 15360]
"MoneyAgent"="C:\Program Files\Microsoft Money\System\Money Express.exe" [2001-07-25 11:00 192568]
"WOOKIT"="C:\PROGRA~1\Wanadoo\Shell.exe" [2004-08-23 15:50 122880]
"TVAgent WiFi"="C:\Program Files\Assistant de connexion WiFi\Wizard\Agent_WiFi.exe" [2005-04-12 17:44 905216]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24 1694208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CmCardRun"="C:\WINDOWS\system32\CmWatch.exe" [2003-09-16 11:50 229376]
"MoneyStartUp10.0"="C:\Program Files\Microsoft Money\System\Activation.exe" [2001-07-25 11:00 245810]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2005-01-12 15:54 241664]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-17 00:11 49152]
"Corel Photo Downloader"="C:\Program Files\Corel\Corel Snapfire\Corel Photo Downloader.exe" [2006-10-31 12:10 478800]
"ISUSPM Startup"="C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2005-02-16 16:15 221184]
"ISUSScheduler"="C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2005-02-16 16:15 81920]
"SMSystemAnalyzer"="C:\Program Files\iolo\System Mechanic 7\SMSystemAnalyzer.exe" [2007-10-03 10:05 819560]
"WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 15:49 20480]
"WOOTASKBARICON"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 17:55 32768]
"ATIModeChange"="Ati2mdxx.exe" [2001-09-04 11:24 28672 C:\WINDOWS\system32\Ati2mdxx.exe]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Wanadoo\\WOOBrowser\\WOOBrowser.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\WINDOWS\\PCHealth\\HelpCtr\\Binaries\\helpctr.exe"=
"C:\\Program Files\\eMule\\eMule.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]
R3 rtl8180;Realtek RTL8180 Wireless LAN (Mini-)PCI NIC NT Driver;C:\WINDOWS\system32\DRIVERS\RTL8180.SYS [2003-12-04 04:10]
R3 SCREAMINGBDRIVER;Screaming Bee Audio;C:\WINDOWS\system32\drivers\ScreamingBAudio.sys [2006-09-27 00:21]
R3 UMSSSTOR;C-Media Storage;C:\WINDOWS\system32\DRIVERS\UMSS.SYS [2003-09-16 08:48]
S1 lusbaudio;Microphone USB Logitech;C:\WINDOWS\system32\drivers\OVSound2.sys [2001-08-17 22:05]
S3 QCAbsee;QuickCam Web Logitech (0801);C:\WINDOWS\system32\DRIVERS\OVCA.sys [2001-08-17 22:05]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2c0b72d8-7346-11dc-bded-000272430670}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL antihost.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2c0b72d9-7346-11dc-bded-000272430670}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL antihost.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2d1d6e2c-7e7d-11dc-be06-d1742e29724a}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL antihost.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{707eac62-7a3b-11dc-be00-cf80e5dbcf51}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL antihost.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{91b8a5be-c76f-11db-bc24-000272430670}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL antihost.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ae3b7915-c800-11db-bc27-000272430670}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL antihost.exe

*Newly Created Service* - PCANDIS5
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-07-09 21:16:00 C:\WINDOWS\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job"

Combofix a trouvé du navipromo on va verifier ça

réouvre hijackthis
fais scan only
coche cette ligne :

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')

et clic sur fix checked

ensuite :

Fais un clic droit sur ce lien : (IL-MAFIOSO)
http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe
Enregistrer la cible (du lien) sous... et enregistre-le sur ton bureau.
Ensuite double clique sur navilog1.exe pour lancer l'installation.
Une fois l'installation terminée, le fix s'exécutera automatiquement.
(Si ce n'est pas le cas, double-clique sur le raccourci Navilog1 présent sur le bureau).

Laisse-toi guider. Au menu principal, choisis 1 et valides.
(ne fais pas le choix 2,3 ou 4 sans notre avis/accord)

Patiente jusqu'au message :
*** Analyse Termine le ..... ***
Appuie sur une touche comme demandé, le blocnote va s'ouvrir.
Copie-colle l'intégralité dans une réponse. Referme le blocnote.
Le rapport est en outre sauvegardé à la racine du disque (fixnavi.txt)

Double cliques sur le raccourci Navilog1 présent sur le bureau et laisse-toi guider.
Au menu principal, choisis 2 et valides.
(ne fais pas le choix 3 ou 4 sans notre avis/accord)

Le fix va t'informer qu'il va alors redémarrer ton PC
Fermes toutes les fenêtres ouvertes et enregistre tes documents personnels ouverts
Appuies sur une touche comme demandé.
(si ton Pc ne redémarre pas automatiquement, fais le toi même)
Au redémarrage de ton PC, choisis ta session habituelle.

Patiente jusqu'au message :
*** Nettoyage Termine le ..... ***
Le bloc-notes va s'ouvrir.
Sauvegarde le rapport de manière à le retrouver
Referme le bloc-notes. Ton bureau va réapparaitre

PS:Si ton bureau ne réapparait pas, fais CTRL+ALT+SUPP pour ouvrir le gestionnaire de tâches.
Puis rends-toi à l'onglet "processus". Clique en haut à gauche sur fichiers et choisis "exécuter"
Tape explorer et valide. Celà te fera apparaitre ton bureau.

Postes le rapport içi.

pour le pc ça va laisse le tranquille pour ce soir on finira demain pas de soucis

bjr t la chiquitine??

Clean Navipromo version 3.6.0 commencé le 2008-07-10 à 12:21:24.64

Outil exécuté depuis C:\Program Files\navilog1
Session actuelle : "Propriétaire"

Mise à jour le 27.06.2008 à 23h00 par IL-MAFIOSO

Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 7.0.5730.11
Système de fichiers : NTFS

Mode suppression automatique
avec prise en charge résultats Catchme et GNS

Nettoyage exécuté au redémarrage de l'ordinateur

*** fsbl1.txt non trouvé ***
(Assurez-vous que Catchme n'avait rien trouvé lors de la recherche)

*** Suppression avec sauvegardes résultats GenericNaviSearch ***

* Suppression dans "C:\WINDOWS\System32" *

* Suppression dans "C:\Documents and Settings\Propriétaire\locals~1\applic~1" *

*** Suppression dossiers dans "C:\WINDOWS" ***

*** Suppression dossiers dans "C:\Program Files" ***

*** Suppression dossiers dans "c:\docume~1\alluse~1\applic~1" ***

*** Suppression dossiers dans "c:\docume~1\alluse~1\menudm~1\progra~1" ***

*** Suppression dossiers dans "C:\Documents and Settings\Propriétaire\applic~1" ***

*** Suppression dossiers dans "C:\Documents and Settings\Propriétaire\locals~1\applic~1" ***

*** Suppression dossiers dans "C:\Documents and Settings\Propriétaire\menudm~1\progra~1" ***

*** Suppression fichiers ***

*** Suppression fichiers temporaires ***

Nettoyage contenu C:\WINDOWS\Temp effectué !
Nettoyage contenu C:\Documents and Settings\Propri‚taire\locals~1\Temp effectué !

*** Traitement Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Suppression avec sauvegardes nouveaux fichiers Instant Access :

2)Recherche, création sauvegardes et suppression Heuristique :

* Dans "C:\WINDOWS\system32" *

* Dans "C:\Documents and Settings\Propriétaire\locals~1\applic~1" *

*** Sauvegarde du Registre vers dossier Safebackup ***

sauvegarde du Registre réalisée avec succès !

*** Nettoyage Registre ***

Nettoyage Registre Ok

*** Certificats ***

Certificat Egroup absent !
Certificat Electronic-Group supprimé !
Certificat OOO-Favorit supprimé !
Certificat Sunny-Day-Design-Ltdt absent !

*** Nettoyage terminé le 2008-07-10 à 12:25:35.20 ***

tout ça pour desinstaller ce spy?

salut

comment va le pc ??

refais un scan hijackthis et post le rapport stp ensuite on termine

ah dsl jai pa vu que vous vous etes connécter
le pc va bocouuuuuuuuuuuuuuuuuuuuu mieu je costate je fai le scan et je vous lenvoi

le seul problém c que je ne saie pas commen fair ce scan la personne qu'etez avec vous hier n'est plus la pouré vous mindiquer svp

ouvre hijackthis

clic sur do a system scan and save a logfile

puis copie colle le rapport du bloc note stp

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:02, on 2008-07-10
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\iolo\Common\Lib\ioloDMVSvc.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\CmWatch.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Corel\Corel Snapfire\Corel Photo Downloader.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\iolo\System Mechanic 7\SMSystemAnalyzer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Program Files\Assistant de connexion WiFi\Wizard\Agent_WiFi.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: VMN Toolbar - {4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33} - C:\PROGRA~1\VMNTOO~1\VMNTOO~1.DLL
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: VMN Toolbar - {4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33} - C:\PROGRA~1\VMNTOO~1\VMNTOO~1.DLL
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [CmCardRun] C:\WINDOWS\system32\CmWatch.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [MoneyStartUp10.0] "C:\Program Files\Microsoft Money\System\Activation.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Snapfire\Corel Photo Downloader.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [SMSystemAnalyzer] "C:\Program Files\iolo\System Mechanic 7\SMSystemAnalyzer.exe"
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [TVAgent WiFi] C:\Program Files\Assistant de connexion WiFi\Wizard\Agent_WiFi.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &MSN Search - res://C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1105\fr-fr\msntb.dll/search.htm
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iolo DMV Service (ioloDMV) - Unknown owner - C:\Program Files\iolo\Common\Lib\ioloDMVSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe

ok c est clean , on termine :

-> Télécharge Ccleaner (n'installe pas la barre d'outil Yahoo):

https://www.01net.com/telecharger/windows/Utilitaire/nettoyeurs_et_installeurs/fiches/32599.html

-> L´installer.

-> Une fois installé et lancé :

Dans la colonne de gauche, click sur :

->"registre" :

Coches toutes les cases sous"l´integrité du registre", puis click en bas sur "chercher des erreurs" une fois terminé, clic sur "reparer les erreurs", tu auras un message pour sauvegarder ta base de registre, tu click "oui" puis tu recommence jusqu'à ce qu'il ne trouve plus rien.

ps : les sauvegardes que tu auras faites, pourront etre supprimées ulterieurement si tout va bien.

->"nettoyeur"

quitte ton navigateur avant de le lancer, dans les propriétés du nettoyeur de l´onglet "windows" et "applications"décoche la derniere case (Avancé si elle est cochée) puis click sur "lancer le nettoyage" qunand il aura terminé le scan click en bas a droite sur "lancer le nettoyage" et accepte par oui.

-> Tutoriel en image :

https://www.vulgarisation-informatique.com/nettoyer-windows-ccleaner.php

ensuite :

Télecharge et instal AVG anti spyware:

http://www.commentcamarche.net/telecharger/telecharger 218 avg anti spyware

instal le et met le a jours

ensuite lance le scan et supprime

puis poste le rapport sur le forum stp

ensuite :

regarde ceci concernant avast :

antivir vs avast :

-> http://forum.malekal.com/ftopic3528.php

alors je te conseille de le desinstaller et d´installer antivir a la place

Telecharge et instales l'antivirus Antivir Personal Edition Classic :

->https://www.01net.com/telecharger/windows/Securite/antivirus-antitrojan/fiches/13198.html

tuto : http://www.swl1f.net/viewtopic.php?f=14&t=59

Pour désinstaller Avast telecharge cet outil

https://www.avast.com/fr-fr/uninstall-utility

ensuite tu n as pas de parefeu :

pare-feu gratuits

télécharger la version gratuite de Zone alarm
https://www.pcastuces.com/logitheque/zonealarm.htm
TUTO
http://securite-facile.ovh.org/zonealarm.php
http://forum.telecharger.01net.com/forum/

ou

télécharger la version gratuite de Kerio
Kerio (parefeu)
https://www.clubic.com/telecharger-fiche11071-sunbelt-personal-firewall-ex-kerio.html
TUTO
https://kerio.probb.fr/
SITE de Kerio
https://kerio.probb.fr/

ou

ComodoFirewallPro 2.4 téléchargement
http://www.personalfirewall.comodo.com/
Tuto pour la 2.4
https://infomars.fr/forum/index.php?s=908072e48ff7cf0359366440cb26c93f&showtopic=389
Tuto pour la 2.4
http://www.nordicnature.net/tutorials/comodo/cf24wiz.htm
Attention la 3.0 est en anglais uniquement et est plus difficile a paramétrer
Tuto pour la 3.0
https://infomars.fr/forum/index.php?showtopic=1225

ou

OnlineArmor :
téléchargement:https://www.commentcamarche.net/telecharger/ 34055356 online armor personal firewall

tutoriels:https://forum.pcastuces.com/sujet.asp?f=25&s=35606
:https://www.malekal.com/tutorial-online-armor-free/

A lire :

https://www.commentcamarche.net/contents/992-firewall-pare-feu

ensuite pour finir :

* pour supprimer les outils/fix utilisés :

Télécharge ToolsCleaner sur ton bureau.
-->
http://www.commentcamarche.net/telecharger/telecharger 34055291 toolscleaner

# Clique sur Recherche et laisse le scan agir ...
# Clique sur Suppression pour finaliser.
# Tu peux, si tu le souhaites, te servir des Options facultatives.
# Clique sur Quitter pour obtenir le rapport.
# Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).

et :

Clic sur "démarrer", cliques droit sur "poste de travail", "propriétés", onglet "restauration du système"

¤ coche la case "désactiver la Restauration du systéme sur tous les lecteurs", puis clic sur "appliquer"
¤ décoche la case et clic sur "appliquer" puis "ok".

Maintenant, que l'ont à effacés les point infectés, nous allons créer un point propre:

Clic sur "démarrer", "tous les programmes", "accessoires", "outils système", "restauration du système", choisis "créer un point de restauration" nommes le " ccm" par exemple, cliques sur "créer" puis "ok".
Voilà, maintenant le point de restauration est créé. Si un jour tu décides tu pourras revenir en arrière à la date créée.

Tuto : http://service1.symantec.com/

-->- Recherche:

C:\Qoobox: trouvé !
C:\Documents and Settings\All Users\Bureau\Navilog1.lnk: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1\Navilog1.lnk: trouvé !
C:\Documents and Settings\Propriétaire\Bureau\HijackThis.lnk: trouvé !
C:\Documents and Settings\Propriétaire\Bureau\ComboFix.exe: trouvé !
C:\Documents and Settings\Propriétaire\Bureau\HJTInstall.exe: trouvé !
C:\Documents and Settings\Propriétaire\Recent\HijackThis.lnk: trouvé !
C:\Program Files\Navilog1: trouvé !
C:\Program Files\Navilog1\Navilog1.bat: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !

---------------------------------
-->- Suppression:

C:\Documents and Settings\All Users\Bureau\Navilog1.lnk: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1\Navilog1.lnk: supprimé !
C:\Documents and Settings\Propriétaire\Bureau\HijackThis.lnk: supprimé !
C:\Documents and Settings\Propriétaire\Bureau\ComboFix.exe: supprimé !
C:\Documents and Settings\Propriétaire\Bureau\HJTInstall.exe: supprimé !
C:\Documents and Settings\Propriétaire\Recent\HijackThis.lnk: supprimé !
C:\Program Files\Navilog1\Navilog1.bat: supprimé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
C:\Qoobox: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1: supprimé !
C:\Program Files\Navilog1: supprimé !
C:\Program Files\Trend Micro\HijackThis: supprimé !

dsl du retard jai eu uelque empéchemen voila le dernier raport
et dsl de metre trempé dans le raport d'avan lol

voila j'ai fini l'ordi ce comporte parfétemen bien et cela grasse a vous je vous en remercie de cette gentillesse et cette aide gratuite que vous aporté au gents, c tres noble.
merci pour tous
a la prochaine infectation lol.