Antivir xp 2008

salut ;voila le rapport du malwarebytes's!!

_______________________________________________________________
Malwarebytes' Anti-Malware 1.24
Version de la base de données: 1032
Windows 5.1.2600 Service Pack 2

15:03:10 08/08/2008
mbam-log-8-8-2008 (15-03-10).txt

Type de recherche: Examen rapide
Eléments examinés: 45199
Temps écoulé: 7 minute(s), 17 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 10
Valeur(s) du Registre infectée(s): 6
Elément(s) de données du Registre infecté

(s): 1
Dossier(s) infecté(s): 13
Fichier(s) infecté(s): 13

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Window

s\CurrentVersion\Ext\PreApproved\{90b5a95a-

afd5-4d11-b9bd-a69d53d22226} (Adware.Hotbar)

-> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Window

s\CurrentVersion\Ext\PreApproved\{8109fd3d-

d891-4f80-8339-50a4913ace6f} (Adware.Zango)

-> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{9afb8248-617f-460d

-9366-d71cdeda3179} (Adware.MyWebSearch) ->

Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Window

s\CurrentVersion\Uninstall\rhc3b4j0e73j

(Rogue.Multiple) -> Quarantined and deleted

successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\rhc3b4j0e73j

(Rogue.Multiple) -> Quarantined and deleted

successfully.
HKEY_CURRENT_USER\SOFTWARE\MediaHoldings

(Adware.PlayMP3Z) -> Quarantined and deleted

successfully.
HKEY_CURRENT_USER\SOFTWARE\Mirar

(Adware.Mirar) -> Quarantined and deleted

successfully.
HKEY_CURRENT_USER\SOFTWARE\PlayMP3

(Adware.PlayMP3Z) -> Quarantined and deleted

successfully.
HKEY_CURRENT_USER\SOFTWARE\FBrowsingAdvisor

(Trojan.FBrowsingAdvisor) -> Quarantined and

deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Softwa

re Notifier (Rogue.Multiple) -> Quarantined

and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Interne

t Explorer\New Windows\Allow\host-domain-

lookup.com (Malware.Trace) -> Quarantined

and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Interne

t Explorer\New Windows\Allow\mysearchnow.com

(Malware.Trace) -> Quarantined and deleted

successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Interne

t Explorer\New Windows\Allow\www.host-

domain-lookup.com (Malware.Trace) ->

Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Interne

t Explorer\New

Windows\Allow\www.mysearchnow.com

(Malware.Trace) -> Quarantined and deleted

successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Window

s\CurrentVersion\Run\smrhc3b4j0e73j

(Trojan.FakeAlert) -> Quarantined and

deleted successfully.
HKEY_CURRENT_USER\Control

Panel\Desktop\scrnsave.exe

(Hijack.Wallpaper) -> Quarantined and

deleted successfully.

Elément(s) de données du Registre infecté

(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows

\CurrentVersion\Policies\System\NoDispScrSav

Page (Hijack.DisplayProperties) -> Bad: (1)

Good: (0) -> Quarantined and deleted

successfully.

Dossier(s) infecté(s):
C:\Program Files\FBrowserAdvisor

(Trojan.FBrowsingAdvisor) -> Quarantined and

deleted successfully.
C:\Program Files\rhc3b4j0e73j

(Rogue.Multiple) -> Quarantined and deleted

successfully.
C:\Documents and Settings\SARL

CYBERCAFE\Application Data\rhc3b4j0e73j

(Rogue.Multiple) -> Quarantined and deleted

successfully.
C:\Documents and Settings\SARL

CYBERCAFE\Application

Data\rhc3b4j0e73j\Quarantine

(Rogue.Multiple) -> Quarantined and deleted

successfully.
C:\Documents and Settings\SARL

CYBERCAFE\Application

Data\rhc3b4j0e73j\Quarantine\Autorun

(Rogue.Multiple) -> Quarantined and deleted

successfully.
C:\Documents and Settings\SARL

CYBERCAFE\Application

Data\rhc3b4j0e73j\Quarantine\Autorun\HKCU

(Rogue.Multiple) -> Quarantined and deleted

successfully.
C:\Documents and Settings\SARL

CYBERCAFE\Application

Data\rhc3b4j0e73j\Quarantine\Autorun\HKCU\Ru

nOnce (Rogue.Multiple) -> Quarantined and

deleted successfully.
C:\Documents and Settings\SARL

CYBERCAFE\Application

Data\rhc3b4j0e73j\Quarantine\Autorun\HKLM

(Rogue.Multiple) -> Quarantined and deleted

successfully.
C:\Documents and Settings\SARL

CYBERCAFE\Application

Data\rhc3b4j0e73j\Quarantine\Autorun\HKLM\Ru

nOnce (Rogue.Multiple) -> Quarantined and

deleted successfully.
C:\Documents and Settings\SARL

CYBERCAFE\Application

Data\rhc3b4j0e73j\Quarantine\Autorun\StartMe

nuAllUsers (Rogue.Multiple) -> Quarantined

and deleted successfully.
C:\Documents and Settings\SARL

CYBERCAFE\Application

Data\rhc3b4j0e73j\Quarantine\Autorun\StartMe

nuCurrentUser (Rogue.Multiple) ->

Quarantined and deleted successfully.
C:\Documents and Settings\SARL

CYBERCAFE\Application

Data\rhc3b4j0e73j\Quarantine\BrowserObjects

(Rogue.Multiple) -> Quarantined and deleted

successfully.
C:\Documents and Settings\SARL

CYBERCAFE\Application

Data\rhc3b4j0e73j\Quarantine\Packages

(Rogue.Multiple) -> Quarantined and deleted

successfully.

Fichier(s) infecté(s):
C:\Program Files\Mozilla

Firefox\regxpcom.exe

(Trojan.FBrowsingAdvisor) -> Quarantined and

deleted successfully.
C:\Program Files\rhc3b4j0e73j\database.dat

(Rogue.Multiple) -> Quarantined and deleted

successfully.
C:\Program Files\rhc3b4j0e73j\license.txt

(Rogue.Multiple) -> Quarantined and deleted

successfully.
C:\Program Files\rhc3b4j0e73j\MFC71.dll

(Rogue.Multiple) -> Quarantined and deleted

successfully.
C:\Program Files\rhc3b4j0e73j\MFC71ENU.DLL

(Rogue.Multiple) -> Quarantined and deleted

successfully.
C:\Program Files\rhc3b4j0e73j\msvcp71.dll

(Rogue.Multiple) -> Quarantined and deleted

successfully.
C:\Program Files\rhc3b4j0e73j\msvcr71.dll

(Rogue.Multiple) -> Quarantined and deleted

successfully.
C:\Program

Files\rhc3b4j0e73j\rhc3b4j0e73j.exe.local

(Rogue.Multiple) -> Quarantined and deleted

successfully.
C:\Program Files\rhc3b4j0e73j\Uninstall.exe

(Rogue.Multiple) -> Quarantined and deleted

successfully.
C:\WINDOWS\Fonts\acrsecB.fon (Trojan.Agent)

-> Quarantined and deleted successfully.
C:\WINDOWS\Fonts\acrsecI.fon (Trojan.Agent)

-> Quarantined and deleted successfully.
C:\WINDOWS\system32\blphc7b4j0e73j.scr

(Trojan.FakeAlert) -> Quarantined and

deleted successfully.
C:\Documents and Settings\SARL

CYBERCAFE\Application

Data\Microsoft\Internet Explorer\Quick

Launch\Antivirus XP 2008.lnk

(Rogue.Antivirus2008) -> Quarantined and

deleted successfully.


et tu peut me dire que-ce que je doit faire !merci pour ton aide

ok ça marche !!je te tien au courent a+

c'est bon j'ai éffacé et voila le rapport de hijack !
----------------------------------
Logfile of HijackThis v1.99.1
Scan saved at 15:15:31, on 08/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\system32\svchost.exe
C:\windows\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\windows\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
c:\program files\a-squared free\a2service.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
c:\Apps\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\WINDOWS\runservice.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\windows\system32\svchost.exe
c:\Apps\Powercinema\Kernel\TV\CLSched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\windows\V0250Mon.exe
C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\windows\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\windows\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\SARL CYBERCAFE\Bureau\Nettoyage\hijakthis\oijfxd.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [C:\windows\system32\V0250Cvw.dll] C:\windows\system32\RegSvr32.exe /s C:\windows\system32\V0250Cvw.dll
O4 - HKLM\..\Run: [V0250Mon.exe] C:\windows\V0250Mon.exe
O4 - HKLM\..\Run: [AVFX Engine] C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [Creative Live! Cam Manager] "C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe"
O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\HOMERunner.exe"
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: PacificPoker4 - {94EDF7B4-4272-4af3-8F8B-4E2F68E225B7} - C:\PROGRA~1\PACIFI~1\pacificpoker.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O17 - HKLM\System\CCS\Services\Tcpip\..\{EA141E74-F52C-43E7-9A49-2078DBD6F759}: NameServer = 192.168.1.1
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: WgaLogon - C:\windows\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - c:\program files\a-squared free\a2service.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\Apps\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\Apps\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

ok ça marche pour le moment j'ai pas de souci en dirai le xp2008 est parti !est ce que jai besoin de faire cette manip!merci

voila le raport du comb!ton pensse quoi ?


ComboFix 08-08-08.04 - SARL CYBERCAFE 2008-08-08 21:01:12.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.380 [GMT 2:00]
Endroit: C:\Documents and Settings\SARL CYBERCAFE\Bureau\ComboFix.exe
* Création d'un nouveau point de restauration

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.
[i] ADS - svchost.exe: deleted 68 bytes in 1 streams. [/i]
[i] ADS - ntoskrnl.exe: deleted 68 bytes in 1 streams. [/i]

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\SARL CYBERCAFE\Application Data\inst.exe
C:\windows\system32\drivers\Xprotector.sys

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_XPROTECTOR
-------\Service_XPROTECTOR


((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-07-08 to 2008-08-08 ))))))))))))))))))))))))))))))))))))
.

2008-08-08 14:45 . 2008-08-08 14:45 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-08 14:45 . 2008-08-08 14:45 <REP> d-------- C:\Documents and Settings\SARL CYBERCAFE\Application Data\Malwarebytes
2008-08-08 14:45 . 2008-08-08 14:45 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-08 14:45 . 2008-07-30 20:07 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-08 14:45 . 2008-07-30 20:07 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-08-07 13:35 . 2008-08-07 13:35 <REP> d-------- C:\Program Files\SUPERAntiSpyware
2008-08-07 13:35 . 2008-08-07 13:35 <REP> d-------- C:\Documents and Settings\SARL CYBERCAFE\Application Data\SUPERAntiSpyware.com
2008-08-07 13:35 . 2008-08-07 13:35 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-08-07 12:07 . 2008-08-07 12:07 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Grisoft
2008-08-07 12:04 . 2006-07-31 12:00 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage r‚seau
2008-08-07 12:04 . 2006-07-31 12:00 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
2008-08-07 12:04 . 2006-07-31 12:00 <REP> d---s---- C:\Documents and Settings\Administrateur\UserData
2008-08-07 12:04 . 2006-07-31 12:00 <REP> d--h----- C:\Documents and Settings\Administrateur\ModŠles
2008-08-07 12:04 . 2008-08-07 13:19 <REP> dr------- C:\Documents and Settings\Administrateur\Mes documents
2008-08-07 12:04 . 2006-07-31 12:00 <REP> dr------- C:\Documents and Settings\Administrateur\Menu D‚marrer
2008-08-07 12:04 . 2006-07-31 12:00 <REP> dr------- C:\Documents and Settings\Administrateur\Favoris
2008-08-07 12:04 . 2008-08-07 12:06 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
2008-08-07 12:04 . 2006-07-31 12:00 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\You've Got Pictures Screensaver
2008-08-07 12:04 . 2006-07-31 12:00 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Symantec
2008-08-07 12:04 . 2006-08-04 17:30 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\AOL
2008-08-07 12:04 . 2008-08-07 13:18 <REP> d-------- C:\Documents and Settings\Administrateur
2008-08-07 11:54 . 2008-08-07 11:54 <REP> d-------- C:\Documents and Settings\SARL CYBERCAFE\Application Data\Grisoft
2008-08-07 11:54 . 2008-08-07 11:54 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-08-07 11:54 . 2007-05-30 14:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-08-07 11:41 . 2008-08-07 11:41 <REP> d-------- C:\Program Files\Trend Micro
2008-08-07 11:27 . 2008-08-07 11:27 <REP> d-------- C:\Documents and Settings\SARL CYBERCAFE\Application Data\Uniblue
2008-08-03 20:38 . 2008-08-03 20:38 <REP> d-------- C:\Documents and Settings\SARL CYBERCAFE\Application Data\CoSoSys
2008-07-16 10:15 . 2008-07-16 10:15 <REP> d-------- C:\Documents and Settings\All Users\Application Data\TomTom
2008-07-15 19:19 . 2008-07-15 19:19 <REP> d-------- C:\Documents and Settings\SARL CYBERCAFE\Application Data\InstallShield
2008-07-15 19:03 . 2008-07-15 19:03 <REP> d-------- C:\Documents and Settings\SARL CYBERCAFE\Application Data\TomTom
2008-07-15 18:14 . 2008-07-16 21:13 <REP> d-------- C:\Program Files\TomTom HOME
2008-07-11 21:08 . 2008-08-07 11:36 <REP> d-------- C:\Program Files\Arovax AntiSpyware
2008-07-11 21:08 . 2008-07-11 21:08 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Arovax
2008-07-08 11:38 . 2008-07-08 11:38 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Creative
2008-07-08 11:09 . 2003-06-12 23:25 7,062 --a------ C:\WINDOWS\system32\audiopid.vxd
2008-07-08 11:06 . 2008-07-08 11:06 <REP> d-------- C:\Program Files\SightSpeed

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-08 19:07 --------- d-----w C:\Documents and Settings\SARL CYBERCAFE\Application Data\Azureus
2008-08-08 15:41 --------- d-----w C:\Documents and Settings\SARL CYBERCAFE\Application Data\OpenOffice.org2
2008-08-07 12:58 --------- d-----w C:\Program Files\MySpace
2008-08-07 11:35 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-08-07 09:37 --------- d-----w C:\Program Files\RogueRemover FREE
2008-08-07 09:24 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-08-07 09:24 --------- d-----w C:\Program Files\LimeWire
2008-08-07 09:14 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-08-07 09:08 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-07-30 19:12 --------- d-----w C:\Documents and Settings\SARL CYBERCAFE\Application Data\Skype
2008-07-30 18:13 --------- d-----w C:\Documents and Settings\SARL CYBERCAFE\Application Data\skypePM
2008-07-25 09:20 --------- d-----w C:\Program Files\Audible
2008-07-22 14:55 --------- d-----w C:\Program Files\Azureus
2008-07-15 16:14 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-15 12:01 --------- d-----w C:\Program Files\Circle Developement
2008-07-08 09:38 --------- d-----w C:\Documents and Settings\SARL CYBERCAFE\Application Data\Creative
2008-07-08 09:34 --------- d-----w C:\Program Files\Creative
2008-07-08 08:54 --------- d-----w C:\Program Files\Fichiers communs\Logitech
2008-07-05 14:22 --------- d-----w C:\Program Files\Fichiers communs\NSV
2008-07-05 14:12 --------- d-----w C:\Program Files\SopCast
2008-07-03 19:35 --------- d-----w C:\Documents and Settings\SARL CYBERCAFE\Application Data\LimeWire
2008-07-02 19:39 --------- d-----w C:\Program Files\Google
2008-06-24 16:07 --------- d-----w C:\Documents and Settings\SARL CYBERCAFE\Application Data\TaoUSign
2008-06-23 13:09 --------- d-----w C:\Documents and Settings\All Users\Application Data\Trymedia
2008-06-21 19:05 --------- d-----w C:\Program Files\eMule
2008-06-20 17:41 247,808 ----a-w C:\windows\system32\mswsock.dll
2008-06-20 17:41 247,808 ----a-w C:\windows\system32\dllcache\mswsock.dll
2008-06-20 17:41 148,992 ----a-w C:\windows\system32\dllcache\dnsapi.dll
2008-06-20 10:45 360,320 ----a-w C:\windows\system32\drivers\tcpip.sys
2008-06-20 10:45 360,320 ----a-w C:\windows\system32\dllcache\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\windows\system32\drivers\afd.sys
2008-06-20 10:44 138,368 ----a-w C:\windows\system32\dllcache\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\windows\system32\drivers\tcpip6.sys
2008-06-20 09:52 225,920 ----a-w C:\windows\system32\dllcache\tcpip6.sys
2008-06-17 15:40 --------- d-----w C:\Documents and Settings\SARL CYBERCAFE\Application Data\Icone
2008-06-14 17:59 272,768 ----a-w C:\windows\system32\drivers\bthport.sys
2008-06-14 17:59 272,768 ----a-w C:\windows\system32\dllcache\bthport.sys
2008-06-11 19:02 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-06-11 09:22 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-06-11 09:20 --------- d-----w C:\Documents and Settings\SARL CYBERCAFE\Application Data\AdobeUM
2008-06-09 13:19 --------- d-----w C:\Program Files\Bonjour
2008-06-09 13:08 --------- d-----w C:\Program Files\Fichiers communs\Macrovision Shared
2008-05-20 12:51 47,360 ----a-w C:\Documents and Settings\SARL CYBERCAFE\Application Data\pcouffin.sys
2008-05-20 08:47 49,152 ----a-r C:\windows\system32\inetwh32.dll
2008-05-20 08:47 1,044,480 ----a-r C:\windows\system32\roboex32.dll
2008-05-11 13:16 57,344 ----a-w C:\windows\system32\lyc_language.dll
2008-05-08 12:28 202,752 ----a-w C:\windows\system32\dllcache\rmcast.sys
2008-03-26 11:25 8 ----a-w C:\Documents and Settings\SARL CYBERCAFE\Application Data\usb.dat.bin
2008-01-13 16:03 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
2007-06-07 18:44 92,064 ----a-w C:\Documents and Settings\SARL CYBERCAFE\mqdmmdm.sys
2007-06-07 18:44 9,232 ----a-w C:\Documents and Settings\SARL CYBERCAFE\mqdmmdfl.sys
2007-06-07 18:44 79,328 ----a-w C:\Documents and Settings\SARL CYBERCAFE\mqdmserd.sys
2007-06-07 18:44 66,656 ----a-w C:\Documents and Settings\SARL CYBERCAFE\mqdmbus.sys
2007-06-07 18:44 6,208 ----a-w C:\Documents and Settings\SARL CYBERCAFE\mqdmcmnt.sys
2007-06-07 18:44 5,936 ----a-w C:\Documents and Settings\SARL CYBERCAFE\mqdmwhnt.sys
2007-06-07 18:44 4,048 ----a-w C:\Documents and Settings\SARL CYBERCAFE\mqdmcr.sys
2007-06-07 18:44 25,600 ----a-w C:\Documents and Settings\SARL CYBERCAFE\usbsermptxp.sys
2007-06-07 18:44 22,768 ----a-w C:\Documents and Settings\SARL CYBERCAFE\usbsermpt.sys
2006-12-22 11:15 284 ----a-w C:\Documents and Settings\SARL CYBERCAFE\Application Data\ViewerApp.dat
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\windows\system32\ctfmon.exe" [2004-08-05 14:00 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-25 18:55 68856]
"AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-07-02 12:29 220544]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 17:43 4670704]
"Creative Live! Cam Manager"="C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe" [2006-05-31 16:00 143360]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-05-28 10:33 1506544]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-17 19:53 266497]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2004-01-01 09:28 180269]
"UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe" [2008-03-01 07:10 15872]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24 286720]
"C:\windows\system32\V0250Cvw.dll"="C:\windows\system32\V0250Cvw.dll" [2006-06-18 19:01 282624]
"V0250Mon.exe"="C:\windows\V0250Mon.exe" [2006-06-07 19:00 32768]
"AVFX Engine"="C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe" [2006-10-09 13:49 20480]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 11:25 6731312]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 14:00 15360]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSimpleStartMenu"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 10:13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"BlueSoleil Hid Service"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Apps\\Powercinema\\PowerCinema.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"C:\\Program Files\\uTorrent\\utorrent.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\Program Files\\Azureus\\Azureus.exe"=
"C:\\Program Files\\SopCast\\SopCast.exe"=
"C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\SightSpeed\\SightSpeed.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8205:TCP"= 8205:TCP:BitComet 8205 TCP
"8205:UDP"= 8205:UDP:BitComet 8205 UDP

R2 LicCtrlService;LicCtrl Service;C:\WINDOWS\runservice.exe [2007-07-11 16:29]
R3 usbstor;Pilote de stockage de masse USB;C:\windows\system32\DRIVERS\USBSTOR.SYS [2004-08-05 14:00]
R3 V0250Dev;Live! Cam Notebook Pro;C:\windows\system32\DRIVERS\V0250Dev.sys [2006-06-27 05:25]
R3 V0250Vfx;V0250Vfx;C:\windows\system32\DRIVERS\V0250Vfx.sys [2006-03-24 10:24]
S3 ids00026;ids00026;C:\Documents and Settings\All Users\Application Data\Kaspersky Anti-Virus Personal\5.0\bases\ids00026.sys []
S3 ids00118;ids00118;C:\Documents and Settings\All Users\Application Data\Kaspersky Anti-Virus Personal\5.0\bases\ids00118.sys []
S3 ids0014f;ids0014f;C:\Documents and Settings\All Users\Application Data\Kaspersky Anti-Virus Personal\5.0\bases\ids0014f.sys []
S3 ids0015d;ids0015d;C:\Documents and Settings\All Users\Application Data\Kaspersky Anti-Virus Personal\5.0\bases\ids0015d.sys []
S3 ids00180;ids00180;C:\Documents and Settings\All Users\Application Data\Kaspersky Anti-Virus Personal\5.0\bases\ids00180.sys []
S3 ids0018a;ids0018a;C:\Documents and Settings\All Users\Application Data\Kaspersky Anti-Virus Personal\5.0\bases\ids0018a.sys []
S3 pohci13F;pohci13F;C:\DOCUME~1\SARLCY~1\LOCALS~1\Temp\pohci13F.sys []
S3 usbscan;Pilote de scanneur USB;C:\windows\system32\DRIVERS\usbscan.sys [2004-08-03 23:58]
S4 Boonty Games;Boonty Games;C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\O]
\Shell\AutoRun\command - O:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{490af835-f025-11dc-958d-0040ca929ab8}]
\Shell\AutoRun\command - J:\ReadMe.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{49bbbb86-1f66-11dc-9371-0040ca929ab8}]
\Shell\AutoRun\command - I:\LaunchU3.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4d6513d0-9c0d-11dc-94c0-101111111111}]
\Shell\AutoRun\command - N:\setupSNK.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6fd8b736-c9d1-11dc-9505-101111111111}]
\Shell\AutoRun\command - CarryItEasy.exe /AUTORUN
\Shell\configure\command - CarryItEasy.exe
\Shell\install\command - CarryItEasy.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{721ab021-1db2-11dd-9603-001583c62bcc}]
\Shell\AutoRun\command - J:\Launch.exe /run

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{74eb2eb6-84a5-11dc-949c-101111111111}]
\Shell\AutoRun\command - O:\LaunchU3.exe -a
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'

2008-08-08 C:\windows\Tasks\A543127290E886FA.job
- c:\docume~1\sarlcy~1\applic~1\browse~1\ProcForBlue.exe []

2008-05-05 C:\windows\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57]
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - (no file)
HKCU-Run-TomTomHOME.exe - C:\Program Files\TomTom HOME 2\HOMERunner.exe
HKCU-Run-Uniblue RegistryBooster 2 - C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe


.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\SARL CYBERCAFE\Application Data\Mozilla\Firefox\Profiles\5k4ko7wk.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1529850&SearchSource=3&q=
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.fr
FF -: plugin - C:\Documents and Settings\SARL CYBERCAFE\Application Data\Mozilla\Firefox\Profiles\5k4ko7wk.default\extensions\LogMeInClient@logmein.com\plugins\npRACtrl.dll
FF -: plugin - C:\Program Files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npmozax.dll
FF -: plugin - C:\Program Files\Yahoo!\Common\npyaxmpb.dll
FF -: plugin - C:\Program Files\Yahoo!\Shared\npYState.dll


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-08 21:09:08
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
"C:\\windows\\system32\\V0250Cvw.dll"="C:\\windows\\system32\\RegSvr32.exe /s C:\\windows\\system32\\V0250Cvw.dll"
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Apps\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\Program Files\Yahoo!\Messenger\Ymsgr_tray.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\Apps\Powercinema\Kernel\TV\CLSched.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-08-08 21:22:08 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-08 19:21:02

Pre-Run: 98,140,438,528 octets libres
Post-Run: 97,798,045,696 octets libres

257 --- E O F --- 2008-08-03 12:05:38

ok, voilla le rapport que pensse tu ?!normalement j'ai pas de souci!!

Logfile of HijackThis v1.99.1
Scan saved at 20:56:49, on 09/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\system32\svchost.exe
C:\windows\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\windows\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
c:\program files\a-squared free\a2service.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
c:\Apps\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\WINDOWS\runservice.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\windows\system32\svchost.exe
c:\Apps\Powercinema\Kernel\TV\CLSched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\windows\V0250Mon.exe
C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\windows\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Azureus\Azureus.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\Apps\RecordNow\RecordNow.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Documents and Settings\SARL CYBERCAFE\Bureau\Nettoyage\hijakthis\oijfxd.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [C:\windows\system32\V0250Cvw.dll] C:\windows\system32\RegSvr32.exe /s C:\windows\system32\V0250Cvw.dll
O4 - HKLM\..\Run: [V0250Mon.exe] C:\windows\V0250Mon.exe
O4 - HKLM\..\Run: [AVFX Engine] C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [Creative Live! Cam Manager] "C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe"
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: PacificPoker4 - {94EDF7B4-4272-4af3-8F8B-4E2F68E225B7} - C:\PROGRA~1\PACIFI~1\pacificpoker.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O17 - HKLM\System\CCS\Services\Tcpip\..\{EA141E74-F52C-43E7-9A49-2078DBD6F759}: NameServer = 192.168.1.1
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: WgaLogon - C:\windows\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - c:\program files\a-squared free\a2service.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\Apps\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\Apps\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe