Problème avec un virus

imn12 -  
Bonjour,
Voilà, j'aie un problème avec un certain virus TR/Dldr.FraudLoa.NC . Vue qu'un sujet de ce type à déjà été posté sur le forum, voici le rapport :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 02:35:26, on 01/01/2002
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\Ctfdll32.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\Mixer.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsoemon.exe
C:\Program Files\rhc7bej0e3dr\rhc7bej0e3dr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\GUARDGUI.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\GUARDGUI.EXE
C:\Program Files\Mozilla Firefox\firefox.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\2.bin\MWSSRCAS.DLL
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\system32\msanton.exe
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\2.bin\MWSSRCAS.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\2.bin\MWSBAR.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FLASHGET\jccatch.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll
O4 - HKLM\..\Run: [ctfdll32] C:\WINDOWS\System32\Ctfdll32.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [clkhost] C:\WINDOWS\dcxxygx.exe
O4 - HKLM\..\Run: [startdrv] C:\WINDOWS\Temp\startdrv.exe
O4 - HKLM\..\Run: [dumprep] C:\WINDOWS\system32\spoolc.exe
O4 - HKLM\..\Run: [Microsoft all] C:\WINDOWS\mmall.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Glock Suite 1.1] C:\WINDOWS\system32\glock32.exe
O4 - HKLM\..\Run: [MyWebSearch Plugin] rundll32 C:\PROGRA~1\MYWEBS~1\bar\2.bin\M3PLUGIN.DLL,UPF
O4 - HKLM\..\Run: [My Web Search Bar] rundll32 C:\PROGRA~1\MYWEBS~1\bar\2.bin\MWSBAR.DLL,S
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsoemon.exe
O4 - HKLM\..\Run: [bend logo clock film] C:\Documents and Settings\All Users\Application Data\Frag great bend logo\copy logo.exe
O4 - HKLM\..\Run: [lphc3bej0e3dr] C:\WINDOWS\system32\lphc3bej0e3dr.exe
O4 - HKLM\..\Run: [SMrhc7bej0e3dr] C:\Program Files\rhc7bej0e3dr\rhc7bej0e3dr.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsoemon.exe
O4 - HKCU\..\Run: [BoreTrans] C:\DOCUME~1\IIMAN3~1.000\APPLIC~1\TYPELI~1\Logshow.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9d.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9d.exe (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZJfox000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\mona8547\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk (file missing)
O14 - IERESET.INF: START_PAGE_URL=https://www.google.fr/?gws_rd=ssl
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\skuns.dat
O20 - Winlogon Notify: bzzmotg - C:\WINDOWS\SYSTEM32\bzzmotg.dll
O20 - Winlogon Notify: WinCtrl32 - C:\WINDOWS\SYSTEM32\WinCtrl32.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ICF - Unknown owner - C:\WINDOWS\system32\icf.exe (file missing)
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
O23 - Service: My Web Search Service (MyWebSearchService) - MyWebSearch.com - C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwssvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 7896 bytes

Merci d'avance de vos réponses que j'espère nombreuses =) !
Configuration: Windows XP
Firefox 2.0.0.14

23 réponses

  1.  ep44 Contributeur
    Bonjour et bienvenue sur CCM

    Ton PC est lourdement infecté !

    ne t'inquiète pas je vais te guider pour la désinfection

    Télécharge combofix.exe (par sUBs) et sauvegarde le sur ton bureau.
    http://download.bleepingcomputer.com/sUBs/ComboFix.exe
    * Déconnecte toi d'internet et ferme toutes tes applications.
    * Désactive tes protections (antivirus, parefeu,antispyware) provisoirement et seulement le temps de l'utilisation de ComboFix,
    * Double-clic sur combofix.exe, il est possible que ton parefeu te demande si tu acceptes ou non l'accès de nircmd.cfexe à la zone sûre: accepte.
    * /!\ Ne touche à rien tant que le scan n'est pas terminé.Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne /!\
    * Attends que Combofix ait terminé, un rapport sera créé.
    * réactive ton parefeu, ton antivirus, la garde de ton antispyware
    * copie/colle le rapport, le rapport se trouve dans : C:\Combofix.txt
    * Réactive tes protections en temps réel, Antivirus, Antispywares, avant de te reconnecter à internet.

    @+
    0
    1. Hadrienen
      Whaou de toute beauté :/

      BIen, un petit boulot dans tout ça...

      EDIT: je te laisse t'en occuper.
      0
      1. imn12 Auteur
        Merci pour ton explication détaillé, mais voilà la fênetre qui m'apparait dès que j'essaie de lancer Combofix.exe :

        https://www.imagup.com

        Merci d'avance pour ta réponse .
        0
        1. ep44 Contributeur
          oui

          quand tu le télécharge tu as du essayé de le renommer par combofix 2
          as tu déjà télécharger ce logiciel ?

          fait ceci
          clicque sur demarrer > executer > dans la boite de dialogue taper > combofix /u
          ( en respectant l´espace ) et valider par ok.

          ensuite essye de le retélécharger sans rien changer
          0
          2. imn12 Auteur
            Merci encore une fois de ton aide . J'aie désinstaller le logiciel puis je l'ai réinstaller .
            Voici le rapport :

            ComboFix 08-08-16.01 - iiMAN3 2008-08-17 15:04:59.1 - [color=red][b]FAT32[/b][/color]x86
            Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.60 [GMT 0:00]
            Endroit: C:\Documents and Settings\iiMAN3.INTERNET.000\Bureau\ComboFix.exe
            * Création d'un nouveau point de restauration

            [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
            .

            (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
            .

            C:\DEL.bat
            C:\Documents and Settings\Administrateur\Application Data\Microsoft\SystemCertificates\My
            C:\Documents and Settings\Administrateur\Cookies\administrateur@promobenef[2].txt
            C:\Documents and Settings\Administrateur\Cookies\administrateur@seriestreaming[2].txt
            C:\Documents and Settings\All Users\Bureau\Antivirus XP 2008.lnk
            C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008
            C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008\Antivirus XP 2008.lnk
            C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008\How to Register Antivirus XP 2008.lnk
            C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008\License Agreement.lnk
            C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008\Register Antivirus XP 2008.lnk
            C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008\Uninstall.lnk
            C:\Documents and Settings\Brahim\Application Data\rhc7bej0e3dr
            C:\Documents and Settings\Brahim\Cookies\brahim@a[2].txt
            C:\Documents and Settings\Brahim\Cookies\brahim@bluestreak[1].txt
            C:\Documents and Settings\Brahim\Cookies\brahim@edt02[1].txt
            C:\Documents and Settings\Brahim\Cookies\brahim@mywebsearch[2].txt
            C:\Documents and Settings\Brahim\Cookies\brahim@www.clubteenpix[1].txt
            C:\Documents and Settings\Brahim\Cookies\brahim@www.pixmania[1].txt
            C:\Documents and Settings\Brahim\Cookies\brahim@www.toutpourlamicro[1].txt
            C:\Documents and Settings\iiMAN3.INTERNET.000\Application Data\FunWebProducts
            C:\Documents and Settings\iiMAN3.INTERNET.000\Application Data\FunWebProducts\Data\iiMAN3\avatar.dat
            C:\Documents and Settings\iiMAN3.INTERNET.000\Application Data\rhc7bej0e3dr
            C:\Documents and Settings\iiMAN3.INTERNET\Application Data\Microsoft\SystemCertificates\My
            C:\Documents and Settings\iiMAN3.INTERNET\Cookies\iiman3@promobenef[2].txt
            C:\Documents and Settings\iiMAN3\Application Data\Microsoft\SystemCertificates\My
            C:\Documents and Settings\iiMAN3\Cookies\iiman3@promobenef[2].txt
            C:\Documents and Settings\iiMAN3\Cookies\iiman3@www.toutpourlamicro[2].txt
            C:\Documents and Settings\Invité\Application Data\Microsoft\SystemCertificates\My
            C:\Documents and Settings\Invité\Cookies\invité@ad.yieldmanager[1].txt
            C:\Documents and Settings\Invité\Cookies\invité@edt02[2].txt
            C:\Documents and Settings\Invité\Cookies\invité@promobenef[1].txt
            C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My
            C:\Documents and Settings\mona81096\Application Data\Microsoft\SystemCertificates\My
            C:\Documents and Settings\mona81096\Cookies\mona81096@promobenef[2].txt
            C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My
            C:\Program Files\FunWebProducts
            C:\Program Files\FunWebProducts\Shared\Cache\AvatarSmallBtn.html
            C:\Program Files\FunWebProducts\Shared\Cache\CursorManiaBtn.html
            C:\Program Files\FunWebProducts\Shared\Cache\FunBuddyIconBtn.html
            C:\Program Files\FunWebProducts\Shared\Cache\MailStampBtn.htmlx
            C:\Program Files\FunWebProducts\Shared\Cache\MyFunCardsIMBtn.html
            C:\Program Files\FunWebProducts\Shared\Cache\MyStationeryBtn.htmlx
            C:\Program Files\FunWebProducts\Shared\Cache\SmileyCentralBtn.html
            C:\Program Files\internet explorer\msimg32.dll
            C:\Program Files\MyWebSearch
            C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
            C:\Program Files\MyWebSearch\bar\1.bin\MWSOESTB.DLL
            C:\Program Files\MyWebSearch\bar\2.bin\F3BKGERR.JPG
            C:\Program Files\MyWebSearch\bar\2.bin\F3CJPEG.DLL
            C:\Program Files\MyWebSearch\bar\2.bin\F3DTACTL.DLL
            C:\Program Files\MyWebSearch\bar\2.bin\F3HISTSW.DLL
            C:\Program Files\MyWebSearch\bar\2.bin\F3HTMLMU.DLL
            C:\Program Files\MyWebSearch\bar\2.bin\F3HTTPCT.DLL
            C:\Program Files\MyWebSearch\bar\2.bin\F3IMSTUB.DLL
            C:\Program Files\MyWebSearch\bar\2.bin\F3POPSWT.DLL
            C:\Program Files\MyWebSearch\bar\2.bin\F3PSSAVR.SCR
            C:\Program Files\MyWebSearch\bar\2.bin\F3REPROX.DLL
            C:\Program Files\MyWebSearch\bar\2.bin\F3RESTUB.DLL
            C:\Program Files\MyWebSearch\bar\2.bin\F3SCHMON.EXE
            C:\Program Files\MyWebSearch\bar\2.bin\F3SCRCTR.DLL
            C:\Program Files\MyWebSearch\bar\2.bin\F3SPACER.WMV
            C:\Program Files\MyWebSearch\bar\2.bin\F3WALLPP.DAT
            C:\Program Files\MyWebSearch\bar\2.bin\F3WPHOOK.DLL
            C:\Program Files\MyWebSearch\bar\2.bin\FWPBUDDY.PNG
            C:\Program Files\MyWebSearch\bar\2.bin\M3FFXTBR.JAR
            C:\Program Files\MyWebSearch\bar\2.bin\M3FFXTBR.MANIFEST
            C:\Program Files\MyWebSearch\bar\2.bin\M3HIGHIN.EXE
            C:\Program Files\MyWebSearch\bar\2.bin\M3HTML.DLL
            C:\Program Files\MyWebSearch\bar\2.bin\M3IDLE.DLL
            C:\Program Files\MyWebSearch\bar\2.bin\M3IMPIPE.EXE
            C:\Program Files\MyWebSearch\bar\2.bin\M3MEDINT.EXE
            C:\Program Files\MyWebSearch\bar\2.bin\M3MSG.DLL
            C:\Program Files\MyWebSearch\bar\2.bin\M3NTSTBR.JAR
            C:\Program Files\MyWebSearch\bar\2.bin\M3NTSTBR.MANIFEST
            C:\Program Files\MyWebSearch\bar\2.bin\M3OUTLCN.DLL
            C:\Program Files\MyWebSearch\bar\2.bin\M3PLUGIN.DLL
            C:\Program Files\MyWebSearch\bar\2.bin\M3SKIN.DLL
            C:\Program Files\MyWebSearch\bar\2.bin\M3SKPLAY.EXE
            C:\Program Files\MyWebSearch\bar\2.bin\M3SLSRCH.EXE
            C:\Program Files\MyWebSearch\bar\2.bin\M3SRCHMN.EXE
            C:\Program Files\MyWebSearch\bar\2.bin\MWSBAR.DLL
            C:\Program Files\MyWebSearch\bar\2.bin\MWSOEMON.EXE
            C:\Program Files\MyWebSearch\bar\2.bin\MWSOEPLG.DLL
            C:\Program Files\MyWebSearch\bar\2.bin\MWSOESTB.DLL
            C:\Program Files\MyWebSearch\bar\2.bin\MWSSVC.EXE
            C:\Program Files\MyWebSearch\bar\2.bin\NPMYWEBS.DLL
            C:\Program Files\MyWebSearch\bar\Avatar\COMMON.F3S
            C:\Program Files\MyWebSearch\bar\Avatar\COMMON\avatar.htm
            C:\Program Files\MyWebSearch\bar\Avatar\COMMON\bgfadel.gif
            C:\Program Files\MyWebSearch\bar\Avatar\COMMON\bgfader.gif
            C:\Program Files\MyWebSearch\bar\Avatar\COMMON\common-x.css
            C:\Program Files\MyWebSearch\bar\Avatar\COMMON\common.css
            C:\Program Files\MyWebSearch\bar\Avatar\COMMON\cornerbl.gif
            C:\Program Files\MyWebSearch\bar\Avatar\COMMON\cornerbr.gif
            C:\Program Files\MyWebSearch\bar\Avatar\COMMON\ext_def.gif
            C:\Program Files\MyWebSearch\bar\Avatar\COMMON\ext_roll.gif
            C:\Program Files\MyWebSearch\bar\Avatar\COMMON\include.js
            C:\Program Files\MyWebSearch\bar\Avatar\COMMON\index.htm
            C:\Program Files\MyWebSearch\bar\Avatar\COMMON\loader.htm
            C:\Program Files\MyWebSearch\bar\Avatar\COMMON\loading.gif
            C:\Program Files\MyWebSearch\bar\Avatar\COMMON\logo.gif
            C:\Program Files\MyWebSearch\bar\Avatar\COMMON\max_def.gif
            C:\Program Files\MyWebSearch\bar\Avatar\COMMON\max_roll.gif
            C:\Program Files\MyWebSearch\bar\Avatar\COMMON\min_def.gif
            C:\Program Files\MyWebSearch\bar\Avatar\COMMON\min_roll.gif
            C:\Program Files\MyWebSearch\bar\Avatar\COMMON\noflash.htm
            C:\Program Files\MyWebSearch\bar\Avatar\COMMON\res_def.gif
            C:\Program Files\MyWebSearch\bar\Avatar\COMMON\res_roll.gif
            C:\Program Files\MyWebSearch\bar\Avatar\COMMON\spacer.gif
            C:\Program Files\MyWebSearch\bar\Avatar\COMMON\spacer.swf
            C:\Program Files\MyWebSearch\bar\Avatar\COMMON\topgrad.gif
            C:\Program Files\MyWebSearch\bar\Avatar\COMMON\window.ico
            C:\Program Files\MyWebSearch\bar\Cache\00033F9A
            C:\Program Files\MyWebSearch\bar\Cache\0005D430
            C:\Program Files\MyWebSearch\bar\Cache\0005DBB1
            C:\Program Files\MyWebSearch\bar\Cache\0008C220
            C:\Program Files\MyWebSearch\bar\Cache\0028E898
            C:\Program Files\MyWebSearch\bar\Cache\0037C78A
            C:\Program Files\MyWebSearch\bar\Cache\004C6782
            C:\Program Files\MyWebSearch\bar\Cache\004C7136.bin
            C:\Program Files\MyWebSearch\bar\Cache\004C74D0.bin
            C:\Program Files\MyWebSearch\bar\Cache\004C7760.bin
            C:\Program Files\MyWebSearch\bar\Cache\004C7D6B.bin
            C:\Program Files\MyWebSearch\bar\Cache\004C9B73.bin
            C:\Program Files\MyWebSearch\bar\Cache\00B1A6D2.bin
            C:\Program Files\MyWebSearch\bar\Cache\00B1A9A0.bin
            C:\Program Files\MyWebSearch\bar\Cache\00B1AE25.bin
            C:\Program Files\MyWebSearch\bar\Cache\00B1B384.bin
            C:\Program Files\MyWebSearch\bar\Cache\00B1B549.bin
            C:\Program Files\MyWebSearch\bar\Cache\00B9BF64.bin
            C:\Program Files\MyWebSearch\bar\Cache\00B9C1E4.bin
            C:\Program Files\MyWebSearch\bar\Cache\00B9C3AA.bin
            C:\Program Files\MyWebSearch\bar\Cache\files.ini
            C:\Program Files\MyWebSearch\bar\Game\CHECKERS.F3S
            C:\Program Files\MyWebSearch\bar\Game\CHESS.F3S
            C:\Program Files\MyWebSearch\bar\Game\REVERSI.F3S
            C:\Program Files\MyWebSearch\bar\History\search3
            C:\Program Files\MyWebSearch\bar\icons\CM.ICO
            C:\Program Files\MyWebSearch\bar\icons\MFC.ICO
            C:\Program Files\MyWebSearch\bar\icons\PSS.ICO
            C:\Program Files\MyWebSearch\bar\icons\SMILEY.ICO
            C:\Program Files\MyWebSearch\bar\icons\WB.ICO
            C:\Program Files\MyWebSearch\bar\icons\ZWINKY.ICO
            C:\Program Files\MyWebSearch\bar\Message\COMMON.F3S
            C:\Program Files\MyWebSearch\bar\Notifier\COMMON.F3S
            C:\Program Files\MyWebSearch\bar\Notifier\DOG.F3S
            C:\Program Files\MyWebSearch\bar\Notifier\FISH.F3S
            C:\Program Files\MyWebSearch\bar\Notifier\KUNGFU.F3S
            C:\Program Files\MyWebSearch\bar\Notifier\LIFEGARD.F3S
            C:\Program Files\MyWebSearch\bar\Notifier\MAID.F3S
            C:\Program Files\MyWebSearch\bar\Notifier\MAILBOX.F3S
            C:\Program Files\MyWebSearch\bar\Notifier\OPERA.F3S
            C:\Program Files\MyWebSearch\bar\Notifier\ROBOT.F3S
            C:\Program Files\MyWebSearch\bar\Notifier\SEDUCT.F3S
            C:\Program Files\MyWebSearch\bar\Notifier\SURFER.F3S
            C:\Program Files\MyWebSearch\bar\Settings\prevcfg2.htm
            C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat
            C:\Program Files\MyWebSearch\SrchAstt\2.bin\MWSSRCAS.DLL
            C:\Program Files\rhc7bej0e3dr
            C:\WINDOWS\doll104.exe
            C:\WINDOWS\doll119.exe
            C:\WINDOWS\doll120.exe
            C:\WINDOWS\doll123.exe
            C:\WINDOWS\doll126.exe
            C:\WINDOWS\doll128.exe
            C:\WINDOWS\doll132.exe
            C:\WINDOWS\doll137.exe
            C:\WINDOWS\doll138.exe
            C:\WINDOWS\doll143.exe
            C:\WINDOWS\doll144.exe
            C:\WINDOWS\doll148.exe
            C:\WINDOWS\doll151.exe
            C:\WINDOWS\doll152.exe
            C:\WINDOWS\doll154.exe
            C:\WINDOWS\doll155.exe
            C:\WINDOWS\doll157.exe
            C:\WINDOWS\doll159.exe
            C:\WINDOWS\doll161.exe
            C:\WINDOWS\doll166.exe
            C:\WINDOWS\doll167.exe
            C:\WINDOWS\doll176.exe
            C:\WINDOWS\doll181.exe
            C:\WINDOWS\doll185.exe
            C:\WINDOWS\doll191.exe
            C:\WINDOWS\doll194.exe
            C:\WINDOWS\doll196.exe
            C:\WINDOWS\doll197.exe
            C:\WINDOWS\drabste.exe
            C:\WINDOWS\draste.exe
            C:\WINDOWS\glok+3ca-59fa.sys
            C:\WINDOWS\glok+serv.config
            C:\WINDOWS\ksacre.exe
            C:\WINDOWS\system32\0_exception.nls
            C:\WINDOWS\system32\1.tmp
            C:\WINDOWS\system32\blphc3bej0e3dr.scr
            C:\WINDOWS\system32\drivers\ctl_w32.sys
            c:\windows\system32\Drivers\Jnq72.sys
            C:\WINDOWS\system32\f3PSSavr.scr
            C:\WINDOWS\system32\koos.exe
            C:\WINDOWS\system32\kprof
            C:\WINDOWS\system32\lphc3bej0e3dr.exe
            C:\WINDOWS\system32\phc3bej0e3dr.bmp
            C:\WINDOWS\system32\poof
            C:\WINDOWS\system32\pphc3bej0e3dr.exe
            C:\WINDOWS\system32\WinCtrl32.dll
            C:\WINDOWS\system32\WinData.cab
            C:\WINDOWS\system32\WinNt32.dll
            C:\WINDOWS\system32\WLCtrl32.dll
            C:\WINDOWS\system32\WinNt32.dll . . . . Echec de suppression

            .
            ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
            .

            -------\Legacy_CTL_W32
            -------\Legacy_ICF
            -------\Legacy_JNQ72
            -------\Legacy_MYWEBSEARCHSERVICE
            -------\Legacy_NTIO256
            -------\Legacy_POOF
            -------\Legacy_RUNTIME
            -------\Legacy_SMTPDRV
            -------\Legacy_TCPSR
            -------\Legacy_XLAVBA8
            -------\Service_ICF
            -------\Service_Jnq72
            -------\Service_kprof
            -------\Service_MyWebSearchService
            -------\Service_ntio256
            -------\Service_poof
            -------\Service_runtime
            -------\Service_tcpsr
            -------\Service_xlavba8

            ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-07-17 to 2008-08-17 ))))))))))))))))))))))))))))))))))))
            .

            2008-08-17 15:20 . 2008-08-17 15:25 12,800 --------- C:\WINDOWS\system32\WinNt32.dll
            2008-08-14 14:16 . 2008-08-14 14:16 <REP> d--hs---- C:\FOUND.098
            2008-08-13 15:47 . 2008-08-13 15:47 <REP> d--hs---- C:\FOUND.097
            2008-08-13 10:00 . 2008-08-13 10:00 <REP> d--hs---- C:\FOUND.096
            2008-07-21 20:29 . 2008-07-21 20:29 <REP> d--hs---- C:\FOUND.093
            2008-07-19 17:49 . 2008-07-19 17:49 <REP> d--hs---- C:\FOUND.092

            .
            (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
            .
            2008-06-30 14:40 --------- d-----w C:\Program Files\Bitmanagement Software
            2008-06-25 16:55 979 ----a-w C:\WINDOWS\system32\drivers\fwdrv.err
            2008-06-24 13:45 192,512 ----a-w C:\Documents and Settings\iiMAN3.INTERNET.000\cbOCR.dll
            2008-06-21 15:53 --------- d-----w C:\Program Files\typelitemeal
            2008-06-20 15:22 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
            2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
            2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
            2008-05-15 11:48 192,512 ----a-w C:\Documents and Settings\Brahim\cbOCR.dll
            2008-04-19 11:24 2,402,832 ----a-w C:\Program Files\WLinstaller.exe1.exe
            2008-04-10 18:50 192,512 ----a-w C:\Documents and Settings\iiMAN3.INTERNET\cbOCR.dll
            2008-04-07 18:42 192,512 ----a-w C:\Documents and Settings\iiMAN3\cbOCR.dll
            2008-04-06 18:04 6,116,304 ----a-w C:\Program Files\Firefox Setup 2.0.0.13.exe
            2005-02-19 10:20 490 ----a-r C:\Program Files\mIRC32.lnk
            2002-01-05 05:11 2,293,848 ----a-w C:\Program Files\FLV PlayerFCSetup.exe
            2002-01-05 05:09 4,265,560 ----a-w C:\Program Files\FLV PlayerRCATSetup.exe
            2002-01-05 04:49 411,248 ----a-w C:\Program Files\FLV PlayerRCSetup.exe
            2007-03-09 08:12 27,648 --sha-w C:\WINDOWS\system32\AVSredirect.dll
            2005-05-15 17:27 65,536 --sh--r C:\WINDOWS\system32\Ctfdll32.exe
            .

            ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
            .
            .
            REGEDIT4
            *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

            [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
            "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 16:09 15360]
            "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]

            [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
            "ctfdll32"="C:\WINDOWS\System32\Ctfdll32.exe" [2005-05-15 17:27 65536]
            "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
            "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-18 22:35 266497]
            "Glock Suite 1.1"="C:\WINDOWS\system32\glock32.exe" [2004-08-19 16:09 13312]
            "bend logo clock film"="C:\Documents and Settings\All Users\Application Data\Frag great bend logo\copy logo.exe" [2002-01-01 00:04 648192]
            "C-Media Mixer"="Mixer.exe" [2002-07-12 16:33 1581056 C:\WINDOWS\mixer.exe]

            [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
            "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 16:09 15360]

            [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
            "FlashPlayerUpdate"="C:\WINDOWS\system32\Macromed\Flash\FlashUtil9d.exe" [2007-06-11 20:04 190696]

            [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
            "NoDispBackgroundPage"= 1 (0x1)
            "NoDispScrSavPage"= 1 (0x1)

            [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
            "UIHost"=hex(2):6c,6f,67,6f,6e,75,69,32,2e,65,78,65,00

            [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\bzzmotg]
            2008-05-30 15:26 21504 C:\WINDOWS\system32\bzzmotg.dll

            [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
            "msacm.iac2"= C:\PROGRA~1\REPLAY~1\iac25_32.ax

            [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Bfi47.sys]
            @="Driver"

            [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\bgK61.sys]
            @="Driver"

            [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Cgi82.sys]
            @="Driver"

            [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Dgj03.sys]
            @="Driver"

            [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Ehk60.sys]
            @="Driver"

            [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\flP60.sys]
            @="Driver"

            [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\glP60.sys]
            @="Driver"

            [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Jmp14.sys]
            @="Driver"

            [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Jnq72.sys]
            @="Driver"

            [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\joS50.sys]
            @="Driver"

            [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lqu71.sys]
            @="Driver"

            [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Nqt03.sys]
            @="Driver"

            [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\nsV47.sys]
            @="Driver"

            [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\otW72.sys]
            @="Driver"

            [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ouY71.sys]
            @="Driver"

            [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Svy61.sys]
            @="Driver"

            [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Twa36.sys]
            @="Driver"

            [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Uyc24.sys]
            @="Driver"

            [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Uyc68.sys]
            @="Driver"

            [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Xcf03.sys]
            @="Driver"

            [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Ydg24.sys]
            @="Driver"

            [HKEY_LOCAL_MACHINE\software\microsoft\security center]
            "UpdatesDisableNotify"=dword:00000001
            "FirewallOverride"=dword:00000001
            "AntiVirusOverride"=dword:00000001
            "AntiVirusDisableNotify"=dword:00000001

            [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
            "EnableFirewall"= 0 (0x0)
            "DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

            [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
            "%windir%\\system32\\sessmgr.exe"=
            "C:\\Program Files\\Yahoo!\\Messenger\\YPager.exe"=
            "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
            "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
            "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

            R0 Twa36;Twa36;C:\WINDOWS\system32\Drivers\Twa36.sys []
            R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys [2005-12-15 18:13]
            R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys [2005-12-15 18:01]
            S0 Bfi47;Bfi47;C:\WINDOWS\system32\Drivers\Bfi47.sys []
            S0 bgK61;bgK61;C:\WINDOWS\system32\Drivers\bgK61.sys []
            S0 Cgi82;Cgi82;C:\WINDOWS\system32\Drivers\Cgi82.sys []
            S0 Dgj03;Dgj03;C:\WINDOWS\system32\Drivers\Dgj03.sys []
            S0 Ehk60;Ehk60;C:\WINDOWS\system32\Drivers\Ehk60.sys []
            S0 flP60;flP60;C:\WINDOWS\system32\Drivers\flP60.sys []
            S0 glP60;glP60;C:\WINDOWS\system32\Drivers\glP60.sys []
            S0 Jmp14;Jmp14;C:\WINDOWS\system32\Drivers\Jmp14.sys []
            S0 joS50;joS50;C:\WINDOWS\system32\Drivers\joS50.sys []
            S0 Lqu71;Lqu71;C:\WINDOWS\system32\Drivers\Lqu71.sys []
            S0 Nqt03;Nqt03;C:\WINDOWS\system32\Drivers\Nqt03.sys []
            S0 nsV47;nsV47;C:\WINDOWS\system32\Drivers\nsV47.sys []
            S0 otW72;otW72;C:\WINDOWS\system32\Drivers\otW72.sys []
            S0 ouY71;ouY71;C:\WINDOWS\system32\Drivers\ouY71.sys []
            S0 Svy61;Svy61;C:\WINDOWS\system32\Drivers\Svy61.sys []
            S0 Uyc24;Uyc24;C:\WINDOWS\system32\Drivers\Uyc24.sys []
            S0 Uyc68;Uyc68;C:\WINDOWS\system32\Drivers\Uyc68.sys []
            S0 Xcf03;Xcf03;C:\WINDOWS\system32\Drivers\Xcf03.sys []
            S0 Ydg24;Ydg24;C:\WINDOWS\system32\Drivers\Ydg24.sys []
            S3 noskrnl.sys;noskrnl.sys;C:\WINDOWS\system32\noskrnl.sys []
            S3 USB2_04;USB2_04 driver;C:\WINDOWS\system32\drivers\nkv2.sys []
            .
            Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'

            2008-08-17 C:\WINDOWS\Tasks\B853381C9188DEB8.job
            - c:\docume~1\iiman3~1.000\applic~1\typeli~1\Web more loud.exe []
            .
            - - - - ORPHANS REMOVED - - - -

            HKCU-Run-BoreTrans - C:\DOCUME~1\IIMAN3~1.000\APPLIC~1\TYPELI~1\Logshow.exe
            HKLM-Run-MyWebSearch Plugin - C:\PROGRA~1\MYWEBS~1\bar\2.bin\M3PLUGIN.DLL
            HKLM-Run-lphc3bej0e3dr - C:\WINDOWS\system32\lphc3bej0e3dr.exe
            HKLM-Run-SMrhc7bej0e3dr - C:\Program Files\rhc7bej0e3dr\rhc7bej0e3dr.exe
            HKLM-Run-Restart - (no file)

            .
            ------- Supplementary Scan -------
            .
            FireFox -: Profile - C:\Documents and Settings\iiMAN3.INTERNET.000\Application Data\Mozilla\Firefox\Profiles\gntr6tnp.default\
            FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=

            **************************************************************************

            catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
            Rootkit scan 2008-08-17 15:27:42
            Windows 5.1.2600 Service Pack 2 FAT NTAPI

            Balayage processus cach‚s ...

            Balayage cach‚ autostart entries ...

            Balayage des fichiers cach‚s ...

            Scan termin‚ avec succŠs
            Les fichiers cach‚s: 0

            **************************************************************************
            .
            0
            1. ep44 Contributeur
              très bien ;)

              reposte un nouveau rapport HijackThis et je te prépare la suite :)

              @+
              0
              1. imn12 Auteur
                Voici mon rapport =)) :

                Logfile of Trend Micro HijackThis v2.0.2
                Scan saved at 16:22, on 2008-08-17
                Platform: Windows XP SP2 (WinNT 5.01.2600)
                MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
                Boot mode: Normal

                Running processes:
                C:\WINDOWS\System32\smss.exe
                C:\WINDOWS\system32\winlogon.exe
                C:\WINDOWS\system32\services.exe
                C:\WINDOWS\system32\lsass.exe
                C:\WINDOWS\system32\svchost.exe
                C:\WINDOWS\System32\svchost.exe
                C:\WINDOWS\system32\spoolsv.exe
                C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
                C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
                C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
                C:\WINDOWS\system32\svchost.exe
                C:\WINDOWS\system32\lsass.exe
                C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
                C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
                C:\WINDOWS\system32\WgaTray.exe
                C:\WINDOWS\System32\Ctfdll32.exe
                C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
                C:\WINDOWS\Mixer.exe
                C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
                C:\WINDOWS\system32\ctfmon.exe
                C:\Program Files\Windows Live\Messenger\msnmsgr.exe
                C:\WINDOWS\system32\wuauclt.exe
                C:\Program Files\Avira\AntiVir PersonalEdition Classic\GUARDGUI.EXE
                C:\WINDOWS\explorer.exe
                C:\ComboFix\pv.cfexe
                C:\Program Files\Avira\AntiVir PersonalEdition Classic\GUARDGUI.EXE
                C:\Program Files\Mozilla Firefox\firefox.exe
                C:\WINDOWS\system32\lsass.exe
                C:\WINDOWS\system32\lsass.exe
                C:\Program Files\Avira\AntiVir PersonalEdition Classic\GUARDGUI.EXE
                C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE
                C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

                R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
                O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FLASHGET\jccatch.dll
                O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll
                O4 - HKLM\..\Run: [ctfdll32] C:\WINDOWS\System32\Ctfdll32.exe
                O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
                O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
                O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
                O4 - HKLM\..\Run: [Glock Suite 1.1] C:\WINDOWS\system32\glock32.exe
                O4 - HKLM\..\Run: [MyWebSearch Plugin] rundll32 C:\PROGRA~1\MYWEBS~1\bar\2.bin\M3PLUGIN.DLL,UPF
                O4 - HKLM\..\Run: [bend logo clock film] C:\Documents and Settings\All Users\Application Data\Frag great bend logo\copy logo.exe
                O4 - HKLM\..\Run: [lphc3bej0e3dr] C:\WINDOWS\system32\lphc3bej0e3dr.exe
                O4 - HKLM\..\Run: [SMrhc7bej0e3dr] C:\Program Files\rhc7bej0e3dr\rhc7bej0e3dr.exe
                O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
                O4 - HKCU\..\Run: [BoreTrans] C:\DOCUME~1\IIMAN3~1.000\APPLIC~1\TYPELI~1\Logshow.exe
                O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9d.exe (User 'SYSTEM')
                O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9d.exe (User 'Default user')
                O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZJfox000
                O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
                O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
                O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
                O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
                O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\mona8547\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk (file missing)
                O14 - IERESET.INF: START_PAGE_URL=https://www.google.fr/?gws_rd=ssl
                O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
                O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
                O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
                O20 - Winlogon Notify: bzzmotg - C:\WINDOWS\SYSTEM32\bzzmotg.dll
                O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
                O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
                O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
                O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
                0
                1. ep44 Contributeur
                  je te prépare une procédure
                  vu le boulot je te donne réponse tout à l'heure ;)

                  @+
                  0
                  1. ep44 Contributeur
                    re :)

                    sélectionne le code ci-dessous 

                    Registry::
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"MyWebSearch Plugin"=-
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"bend logo clock film"=-
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"lphc3bej0e3dr"=-
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SMrhc7bej0e3dr"=-
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"BoreTrans"=-
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Bfi47.sys]  
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\bgK61.sys]  
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Cgi82.sys]  
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Dgj03.sys]  
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Ehk60.sys]  
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\flP60.sys]  
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\glP60.sys]  
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Jmp14.sys]   
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Jnq72.sys]    
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\joS50.sys]  
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lqu71.sys]  
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Nqt03.sys]  
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\nsV47.sys]  
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\otW72.sys]  
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ouY71.sys]  
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Svy61.sys]   
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Twa36.sys]   
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Uyc24.sys]    
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Uyc68.sys]    
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Xcf03.sys]    
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Ydg24.sys]  

 
Driver::
Bfi47 
bgK61
Cgi82
Dgj03
Ehk60 
flP60
glP60
Jmp14
joS50
Lqu71
Nqt03
nsV47
otW72
ouY71
Svy61
Uyc24
Uyc68
Xcf03
Ydg24
noskrnl.sys
USB2_04


File::
C:\WINDOWS\SYSTEM32\bzzmotg.dll  
C:\WINDOWS\system32\lphc3bej0e3dr.exe       
C:\WINDOWS\system32\WinNt32.dll       
C:\WINDOWS\system32\Ctfdll32.exe  
C:\Documents and Settings\iiMAN3\cbOCR.dll  
C:\Documents and Settings\iiMAN3.INTERNET\cbOCR.dll  
C:\Documents and Settings\Brahim\cbOCR.dll  
C:\Documents and Settings\iiMAN3.INTERNET.000\cbOCR.dll  
C:\WINDOWS\system32\Drivers\Bfi47.sys 
C:\WINDOWS\system32\Drivers\bgK61.sys   
C:\WINDOWS\system32\Drivers\Cgi82.sys   
C:\WINDOWS\system32\Drivers\Dgj03.sys  
C:\WINDOWS\system32\Drivers\Ehk60.sys  
C:\WINDOWS\system32\Drivers\flP60.sys   
C:\WINDOWS\system32\Drivers\glP60.sys 
C:\WINDOWS\system32\Drivers\Jmp14.sys   
C:\WINDOWS\system32\Drivers\joS50.sys   
C:\WINDOWS\system32\Drivers\Lqu71.sys   
C:\WINDOWS\system32\Drivers\Nqt03.sys  
C:\WINDOWS\system32\Drivers\nsV47.sys   
C:\WINDOWS\system32\Drivers\otW72.sys  
C:\WINDOWS\system32\Drivers\ouY71.sys  
C:\WINDOWS\system32\Drivers\Svy61.sys  
C:\WINDOWS\system32\Drivers\Uyc24.sys  
C:\WINDOWS\system32\Drivers\Uyc68.sys   
C:\WINDOWS\system32\Drivers\Xcf03.sys   
C:\WINDOWS\system32\Drivers\Ydg24.sys 
C:\WINDOWS\system32\noskrnl.sys   
C:\WINDOWS\system32\drivers\nkv2.sys 

  
Folder::
C:\Program Files\rhc7bej0e3dr
C:\Documents and Settings\All Users\Application Data\Frag great bend logo
C:\DOCUME~1\IIMAN3~1.000\APPLIC~1\TYPELI~1
C:\Program Files\mywebsearch
C:\Program Files\typelitemeal


                    * Copie le texte sélectionné (CTRL+C).
                    * Ouvre le bloc-notes (programme>Accessoires >bloc-notes).
                    * Veille à ce que Retour à la ligne ne soit pas coché dans Format.
                    * Colle le texte copié dans ce bloc-notes (CTRL+V).
                    * Sauvegarde ce fichier sous le nom de CFScript.txt
                    * Fais un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme ceci
                    http://apu.mabul.org/up/apu/2008/08/12/img-191202xzrpd.gif
                    * Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises : c'est normal!
                    Ne touche à rien tant que le scan n'est pas terminé.
                    * Une fois le scan achevé, un rapport va s'afficher : Poste son contenu.
                    * Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

                    Note: Le code ci-dessus a été intentionnellement rédigé pour CET utilisateur.
                    si vous n'êtes pas CET utilisateur, NE PAS appliquer ces directives : elles pourraient endommager votre système.

                    @+
                    0
                    1. imn12 Auteur
                      Voici le rapport :
                      ComboFix 08-08-16.01 - iiMAN3 2008-08-17 20:11:37.2 - [color=red][b]FAT32[/b][/color]x86
                      Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.50 [GMT 0:00]
                      Endroit: C:\Documents and Settings\iiMAN3.INTERNET.000\Bureau\ComboFix.exe
                      Command switches used :: C:\Documents and Settings\iiMAN3.INTERNET.000\Bureau\CFScript.txt
                      * Création d'un nouveau point de restauration

                      [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]

                      FILE ::
                      C:\Documents and Settings\Brahim\cbOCR.dll
                      C:\Documents and Settings\iiMAN3.INTERNET.000\cbOCR.dll
                      C:\Documents and Settings\iiMAN3.INTERNET\cbOCR.dll
                      C:\Documents and Settings\iiMAN3\cbOCR.dll
                      C:\WINDOWS\SYSTEM32\bzzmotg.dll
                      C:\WINDOWS\system32\Ctfdll32.exe
                      C:\WINDOWS\system32\Drivers\Bfi47.sys
                      C:\WINDOWS\system32\Drivers\bgK61.sys
                      C:\WINDOWS\system32\Drivers\Cgi82.sys
                      C:\WINDOWS\system32\Drivers\Dgj03.sys
                      C:\WINDOWS\system32\Drivers\Ehk60.sys
                      C:\WINDOWS\system32\Drivers\flP60.sys
                      C:\WINDOWS\system32\Drivers\glP60.sys
                      C:\WINDOWS\system32\Drivers\Jmp14.sys
                      C:\WINDOWS\system32\Drivers\joS50.sys
                      C:\WINDOWS\system32\Drivers\Lqu71.sys
                      C:\WINDOWS\system32\drivers\nkv2.sys
                      C:\WINDOWS\system32\Drivers\Nqt03.sys
                      C:\WINDOWS\system32\Drivers\nsV47.sys
                      C:\WINDOWS\system32\Drivers\otW72.sys
                      C:\WINDOWS\system32\Drivers\ouY71.sys
                      C:\WINDOWS\system32\Drivers\Svy61.sys
                      C:\WINDOWS\system32\Drivers\Uyc24.sys
                      C:\WINDOWS\system32\Drivers\Uyc68.sys
                      C:\WINDOWS\system32\Drivers\Xcf03.sys
                      C:\WINDOWS\system32\Drivers\Ydg24.sys
                      C:\WINDOWS\system32\lphc3bej0e3dr.exe
                      C:\WINDOWS\system32\noskrnl.sys
                      C:\WINDOWS\system32\WinNt32.dll
                      .

                      (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
                      .

                      C:\DOCUME~1\IIMAN3~1.000\APPLIC~1\TYPELI~1
                      C:\DOCUME~1\IIMAN3~1.000\APPLIC~1\TYPELI~1\[u]0[/u]
                      C:\DOCUME~1\IIMAN3~1.000\APPLIC~1\TYPELI~1\ckzpaknq.exe
                      C:\DOCUME~1\IIMAN3~1.000\APPLIC~1\TYPELI~1\hoyrynol.exe
                      C:\DOCUME~1\IIMAN3~1.000\APPLIC~1\TYPELI~1\plwpbazf.exe
                      C:\DOCUME~1\IIMAN3~1.000\APPLIC~1\TYPELI~1\SectOkayModeSixth.exe
                      C:\Documents and Settings\All Users\Application Data\Frag great bend logo
                      C:\Documents and Settings\All Users\Application Data\Frag great bend logo\copy logo.exe
                      C:\Documents and Settings\Brahim\Application Data\Microsoft\SystemCertificates\My
                      C:\Documents and Settings\Brahim\cbOCR.dll
                      C:\Documents and Settings\Brahim\Cookies\brahim@a[2].txt
                      C:\Documents and Settings\iiMAN3.INTERNET.000\cbOCR.dll
                      C:\Documents and Settings\iiMAN3.INTERNET\cbOCR.dll
                      C:\Documents and Settings\iiMAN3\cbOCR.dll
                      C:\Program Files\typelitemeal
                      C:\WINDOWS\SYSTEM32\bzzmotg.dll
                      C:\WINDOWS\system32\Ctfdll32.exe
                      .
                      ---- Previous Run -------
                      .
                      C:\DEL.bat
                      C:\Documents and Settings\Administrateur\Application Data\Microsoft\SystemCertificates\My
                      C:\Documents and Settings\Administrateur\Cookies\administrateur@promobenef[2].txt
                      C:\Documents and Settings\Administrateur\Cookies\administrateur@seriestreaming[2].txt
                      C:\Documents and Settings\All Users\Bureau\Antivirus XP 2008.lnk
                      C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008
                      C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008\Antivirus XP 2008.lnk
                      C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008\How to Register Antivirus XP 2008.lnk
                      C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008\License Agreement.lnk
                      C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008\Register Antivirus XP 2008.lnk
                      C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008\Uninstall.lnk
                      C:\Documents and Settings\Brahim\Application Data\rhc7bej0e3dr
                      C:\Documents and Settings\Brahim\Cookies\brahim@a[2].txt
                      C:\Documents and Settings\Brahim\Cookies\brahim@bluestreak[1].txt
                      C:\Documents and Settings\Brahim\Cookies\brahim@edt02[1].txt
                      C:\Documents and Settings\Brahim\Cookies\brahim@mywebsearch[2].txt
                      C:\Documents and Settings\Brahim\Cookies\brahim@www.clubteenpix[1].txt
                      C:\Documents and Settings\Brahim\Cookies\brahim@www.pixmania[1].txt
                      C:\Documents and Settings\Brahim\Cookies\brahim@www.toutpourlamicro[1].txt
                      C:\Documents and Settings\iiMAN3.INTERNET.000\Application Data\FunWebProducts
                      C:\Documents and Settings\iiMAN3.INTERNET.000\Application Data\FunWebProducts\Data\iiMAN3\avatar.dat
                      C:\Documents and Settings\iiMAN3.INTERNET.000\Application Data\rhc7bej0e3dr
                      C:\Documents and Settings\iiMAN3.INTERNET\Application Data\Microsoft\SystemCertificates\My
                      C:\Documents and Settings\iiMAN3.INTERNET\Cookies\iiman3@promobenef[2].txt
                      C:\Documents and Settings\iiMAN3\Application Data\Microsoft\SystemCertificates\My
                      C:\Documents and Settings\iiMAN3\Cookies\iiman3@promobenef[2].txt
                      C:\Documents and Settings\iiMAN3\Cookies\iiman3@www.toutpourlamicro[2].txt
                      C:\Documents and Settings\Invité\Application Data\Microsoft\SystemCertificates\My
                      C:\Documents and Settings\Invité\Cookies\invité@ad.yieldmanager[1].txt
                      C:\Documents and Settings\Invité\Cookies\invité@edt02[2].txt
                      C:\Documents and Settings\Invité\Cookies\invité@promobenef[1].txt
                      C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My
                      C:\Documents and Settings\mona81096\Application Data\Microsoft\SystemCertificates\My
                      C:\Documents and Settings\mona81096\Cookies\mona81096@promobenef[2].txt
                      C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My
                      C:\Program Files\FunWebProducts
                      C:\Program Files\FunWebProducts\Shared\Cache\AvatarSmallBtn.html
                      C:\Program Files\FunWebProducts\Shared\Cache\CursorManiaBtn.html
                      C:\Program Files\FunWebProducts\Shared\Cache\FunBuddyIconBtn.html
                      C:\Program Files\FunWebProducts\Shared\Cache\MailStampBtn.htmlx
                      C:\Program Files\FunWebProducts\Shared\Cache\MyFunCardsIMBtn.html
                      C:\Program Files\FunWebProducts\Shared\Cache\MyStationeryBtn.htmlx
                      C:\Program Files\FunWebProducts\Shared\Cache\SmileyCentralBtn.html
                      C:\Program Files\internet explorer\msimg32.dll
                      C:\Program Files\MyWebSearch
                      C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
                      C:\Program Files\MyWebSearch\bar\1.bin\MWSOESTB.DLL
                      C:\Program Files\MyWebSearch\bar\2.bin\F3BKGERR.JPG
                      C:\Program Files\MyWebSearch\bar\2.bin\F3CJPEG.DLL
                      C:\Program Files\MyWebSearch\bar\2.bin\F3DTACTL.DLL
                      C:\Program Files\MyWebSearch\bar\2.bin\F3HISTSW.DLL
                      C:\Program Files\MyWebSearch\bar\2.bin\F3HTMLMU.DLL
                      C:\Program Files\MyWebSearch\bar\2.bin\F3HTTPCT.DLL
                      C:\Program Files\MyWebSearch\bar\2.bin\F3IMSTUB.DLL
                      C:\Program Files\MyWebSearch\bar\2.bin\F3POPSWT.DLL
                      C:\Program Files\MyWebSearch\bar\2.bin\F3PSSAVR.SCR
                      C:\Program Files\MyWebSearch\bar\2.bin\F3REPROX.DLL
                      C:\Program Files\MyWebSearch\bar\2.bin\F3RESTUB.DLL
                      C:\Program Files\MyWebSearch\bar\2.bin\F3SCHMON.EXE
                      C:\Program Files\MyWebSearch\bar\2.bin\F3SCRCTR.DLL
                      C:\Program Files\MyWebSearch\bar\2.bin\F3SPACER.WMV
                      C:\Program Files\MyWebSearch\bar\2.bin\F3WALLPP.DAT
                      C:\Program Files\MyWebSearch\bar\2.bin\F3WPHOOK.DLL
                      C:\Program Files\MyWebSearch\bar\2.bin\FWPBUDDY.PNG
                      C:\Program Files\MyWebSearch\bar\2.bin\M3FFXTBR.JAR
                      C:\Program Files\MyWebSearch\bar\2.bin\M3FFXTBR.MANIFEST
                      C:\Program Files\MyWebSearch\bar\2.bin\M3HIGHIN.EXE
                      C:\Program Files\MyWebSearch\bar\2.bin\M3HTML.DLL
                      C:\Program Files\MyWebSearch\bar\2.bin\M3IDLE.DLL
                      C:\Program Files\MyWebSearch\bar\2.bin\M3IMPIPE.EXE
                      C:\Program Files\MyWebSearch\bar\2.bin\M3MEDINT.EXE
                      C:\Program Files\MyWebSearch\bar\2.bin\M3MSG.DLL
                      C:\Program Files\MyWebSearch\bar\2.bin\M3NTSTBR.JAR
                      C:\Program Files\MyWebSearch\bar\2.bin\M3NTSTBR.MANIFEST
                      C:\Program Files\MyWebSearch\bar\2.bin\M3OUTLCN.DLL
                      C:\Program Files\MyWebSearch\bar\2.bin\M3PLUGIN.DLL
                      C:\Program Files\MyWebSearch\bar\2.bin\M3SKIN.DLL
                      C:\Program Files\MyWebSearch\bar\2.bin\M3SKPLAY.EXE
                      C:\Program Files\MyWebSearch\bar\2.bin\M3SLSRCH.EXE
                      C:\Program Files\MyWebSearch\bar\2.bin\M3SRCHMN.EXE
                      C:\Program Files\MyWebSearch\bar\2.bin\MWSBAR.DLL
                      C:\Program Files\MyWebSearch\bar\2.bin\MWSOEMON.EXE
                      C:\Program Files\MyWebSearch\bar\2.bin\MWSOEPLG.DLL
                      C:\Program Files\MyWebSearch\bar\2.bin\MWSOESTB.DLL
                      C:\Program Files\MyWebSearch\bar\2.bin\MWSSVC.EXE
                      C:\Program Files\MyWebSearch\bar\2.bin\NPMYWEBS.DLL
                      C:\Program Files\MyWebSearch\bar\Avatar\COMMON.F3S
                      C:\Program Files\MyWebSearch\bar\Avatar\COMMON\avatar.htm
                      C:\Program Files\MyWebSearch\bar\Avatar\COMMON\bgfadel.gif
                      C:\Program Files\MyWebSearch\bar\Avatar\COMMON\bgfader.gif
                      C:\Program Files\MyWebSearch\bar\Avatar\COMMON\common-x.css
                      C:\Program Files\MyWebSearch\bar\Avatar\COMMON\common.css
                      C:\Program Files\MyWebSearch\bar\Avatar\COMMON\cornerbl.gif
                      C:\Program Files\MyWebSearch\bar\Avatar\COMMON\cornerbr.gif
                      C:\Program Files\MyWebSearch\bar\Avatar\COMMON\ext_def.gif
                      C:\Program Files\MyWebSearch\bar\Avatar\COMMON\ext_roll.gif
                      C:\Program Files\MyWebSearch\bar\Avatar\COMMON\include.js
                      C:\Program Files\MyWebSearch\bar\Avatar\COMMON\index.htm
                      C:\Program Files\MyWebSearch\bar\Avatar\COMMON\loader.htm
                      C:\Program Files\MyWebSearch\bar\Avatar\COMMON\loading.gif
                      C:\Program Files\MyWebSearch\bar\Avatar\COMMON\logo.gif
                      C:\Program Files\MyWebSearch\bar\Avatar\COMMON\max_def.gif
                      C:\Program Files\MyWebSearch\bar\Avatar\COMMON\max_roll.gif
                      C:\Program Files\MyWebSearch\bar\Avatar\COMMON\min_def.gif
                      C:\Program Files\MyWebSearch\bar\Avatar\COMMON\min_roll.gif
                      C:\Program Files\MyWebSearch\bar\Avatar\COMMON\noflash.htm
                      C:\Program Files\MyWebSearch\bar\Avatar\COMMON\res_def.gif
                      C:\Program Files\MyWebSearch\bar\Avatar\COMMON\res_roll.gif
                      C:\Program Files\MyWebSearch\bar\Avatar\COMMON\spacer.gif
                      C:\Program Files\MyWebSearch\bar\Avatar\COMMON\spacer.swf
                      C:\Program Files\MyWebSearch\bar\Avatar\COMMON\topgrad.gif
                      C:\Program Files\MyWebSearch\bar\Avatar\COMMON\window.ico
                      C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]0033F9A
                      C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]005D430
                      C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]005DBB1
                      C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]008C220
                      C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]028E898
                      C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]037C78A
                      C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]04C6782
                      C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]04C7136.bin
                      C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]04C74D0.bin
                      C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]04C7760.bin
                      C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]04C7D6B.bin
                      C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]04C9B73.bin
                      C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]0B1A6D2.bin
                      C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]0B1A9A0.bin
                      C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]0B1AE25.bin
                      C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]0B1B384.bin
                      C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]0B1B549.bin
                      C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]0B9BF64.bin
                      C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]0B9C1E4.bin
                      C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]0B9C3AA.bin
                      C:\Program Files\MyWebSearch\bar\Cache\files.ini
                      C:\Program Files\MyWebSearch\bar\Game\CHECKERS.F3S
                      C:\Program Files\MyWebSearch\bar\Game\CHESS.F3S
                      C:\Program Files\MyWebSearch\bar\Game\REVERSI.F3S
                      C:\Program Files\MyWebSearch\bar\History\search3
                      C:\Program Files\MyWebSearch\bar\icons\CM.ICO
                      C:\Program Files\MyWebSearch\bar\icons\MFC.ICO
                      C:\Program Files\MyWebSearch\bar\icons\PSS.ICO
                      C:\Program Files\MyWebSearch\bar\icons\SMILEY.ICO
                      C:\Program Files\MyWebSearch\bar\icons\WB.ICO
                      C:\Program Files\MyWebSearch\bar\icons\ZWINKY.ICO
                      C:\Program Files\MyWebSearch\bar\Message\COMMON.F3S
                      C:\Program Files\MyWebSearch\bar\Notifier\COMMON.F3S
                      C:\Program Files\MyWebSearch\bar\Notifier\DOG.F3S
                      C:\Program Files\MyWebSearch\bar\Notifier\FISH.F3S
                      C:\Program Files\MyWebSearch\bar\Notifier\KUNGFU.F3S
                      C:\Program Files\MyWebSearch\bar\Notifier\LIFEGARD.F3S
                      C:\Program Files\MyWebSearch\bar\Notifier\MAID.F3S
                      C:\Program Files\MyWebSearch\bar\Notifier\MAILBOX.F3S
                      C:\Program Files\MyWebSearch\bar\Notifier\OPERA.F3S
                      C:\Program Files\MyWebSearch\bar\Notifier\ROBOT.F3S
                      C:\Program Files\MyWebSearch\bar\Notifier\SEDUCT.F3S
                      C:\Program Files\MyWebSearch\bar\Notifier\SURFER.F3S
                      C:\Program Files\MyWebSearch\bar\Settings\prevcfg2.htm
                      C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat
                      C:\Program Files\MyWebSearch\SrchAstt\2.bin\MWSSRCAS.DLL
                      C:\Program Files\rhc7bej0e3dr
                      C:\WINDOWS\doll104.exe
                      C:\WINDOWS\doll119.exe
                      C:\WINDOWS\doll120.exe
                      C:\WINDOWS\doll123.exe
                      C:\WINDOWS\doll126.exe
                      C:\WINDOWS\doll128.exe
                      C:\WINDOWS\doll132.exe
                      C:\WINDOWS\doll137.exe
                      C:\WINDOWS\doll138.exe
                      C:\WINDOWS\doll143.exe
                      C:\WINDOWS\doll144.exe
                      C:\WINDOWS\doll148.exe
                      C:\WINDOWS\doll151.exe
                      C:\WINDOWS\doll152.exe
                      C:\WINDOWS\doll154.exe
                      C:\WINDOWS\doll155.exe
                      C:\WINDOWS\doll157.exe
                      C:\WINDOWS\doll159.exe
                      C:\WINDOWS\doll161.exe
                      C:\WINDOWS\doll166.exe
                      C:\WINDOWS\doll167.exe
                      C:\WINDOWS\doll176.exe
                      C:\WINDOWS\doll181.exe
                      C:\WINDOWS\doll185.exe
                      C:\WINDOWS\doll191.exe
                      C:\WINDOWS\doll194.exe
                      C:\WINDOWS\doll196.exe
                      C:\WINDOWS\doll197.exe
                      C:\WINDOWS\drabste.exe
                      C:\WINDOWS\draste.exe
                      C:\WINDOWS\glok+3ca-59fa.sys
                      C:\WINDOWS\glok+serv.config
                      C:\WINDOWS\ksacre.exe
                      C:\WINDOWS\system32\[u]0[/u]_exception.nls
                      C:\WINDOWS\system32\1.tmp
                      C:\WINDOWS\system32\blphc3bej0e3dr.scr
                      C:\WINDOWS\system32\drivers\ctl_w32.sys
                      c:\windows\system32\Drivers\Jnq72.sys
                      C:\WINDOWS\system32\f3PSSavr.scr
                      C:\WINDOWS\system32\koos.exe
                      C:\WINDOWS\system32\kprof
                      C:\WINDOWS\system32\lphc3bej0e3dr.exe
                      C:\WINDOWS\system32\phc3bej0e3dr.bmp
                      C:\WINDOWS\system32\poof
                      C:\WINDOWS\system32\pphc3bej0e3dr.exe
                      C:\WINDOWS\system32\WinCtrl32.dll
                      C:\WINDOWS\system32\WinData.cab
                      C:\WINDOWS\system32\WinNt32.dll
                      C:\WINDOWS\system32\WLCtrl32.dll
                      C:\WINDOWS\system32\WinNt32.dll . . . . Echec de suppression

                      .
                      ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
                      .

                      -------\Legacy_CTL_W32
                      -------\Legacy_ICF
                      -------\Legacy_JNQ72
                      -------\Legacy_MYWEBSEARCHSERVICE
                      -------\Legacy_NTIO256
                      -------\Legacy_POOF
                      -------\Legacy_RUNTIME
                      -------\Legacy_SMTPDRV
                      -------\Legacy_TCPSR
                      -------\Legacy_XLAVBA8
                      -------\Service_ICF
                      -------\Service_Jnq72
                      -------\Service_kprof
                      -------\Service_MyWebSearchService
                      -------\Service_ntio256
                      -------\Service_poof
                      -------\Service_runtime
                      -------\Service_tcpsr
                      -------\Service_xlavba8
                      -------\Legacy_LQU71
                      -------\Legacy_USB2_04
                      -------\Legacy_UYC24
                      -------\Service_Bfi47
                      -------\Service_bgK61
                      -------\Service_Cgi82
                      -------\Service_ctl_w32
                      -------\Service_Dgj03
                      -------\Service_Ehk60
                      -------\Service_flP60
                      -------\Service_glP60
                      -------\Service_Jmp14
                      -------\Service_joS50
                      -------\Service_Lqu71
                      -------\Service_noskrnl.sys
                      -------\Service_Nqt03
                      -------\Service_nsV47
                      -------\Service_otW72
                      -------\Service_ouY71
                      -------\Service_Svy61
                      -------\Service_USB2_04
                      -------\Service_Uyc24
                      -------\Service_Uyc68
                      -------\Service_Xcf03
                      -------\Service_Ydg24

                      ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-07-17 to 2008-08-17 ))))))))))))))))))))))))))))))))))))
                      .

                      2008-08-14 14:16 . 2008-08-14 14:16 <REP> d--hs---- C:\FOUND.098
                      2008-08-13 15:47 . 2008-08-13 15:47 <REP> d--hs---- C:\FOUND.097
                      2008-08-13 10:00 . 2008-08-13 10:00 <REP> d--hs---- C:\FOUND.096
                      2008-07-21 20:29 . 2008-07-21 20:29 <REP> d--hs---- C:\FOUND.093
                      2008-07-19 17:49 . 2008-07-19 17:49 <REP> d--hs---- C:\FOUND.092

                      .
                      (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                      .
                      2008-07-07 20:31 253,952 ----a-w C:\WINDOWS\system32\es.dll
                      2008-07-07 20:31 253,952 ----a-w C:\WINDOWS\system32\dllcache\es.dll
                      2008-06-30 14:40 --------- d-----w C:\Program Files\Bitmanagement Software
                      2008-06-29 13:15 192,512 ----a-w C:\WINDOWS\system32\cbOCR.dll
                      2008-06-25 16:55 979 ----a-w C:\WINDOWS\system32\drivers\fwdrv.err
                      2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
                      2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\dllcache\mscms.dll
                      2008-06-23 15:39 152,064 ----a-w C:\WINDOWS\system32\dllcache\cdfview.dll
                      2008-06-23 15:39 1,024,000 ----a-w C:\WINDOWS\system32\dllcache\browseui.dll
                      2008-06-23 09:49 18,432 ----a-w C:\WINDOWS\system32\dllcache\iedw.exe
                      2008-06-20 23:11 148,992 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
                      2008-06-20 17:41 247,808 ----a-w C:\WINDOWS\system32\mswsock.dll
                      2008-06-20 17:41 247,808 ----a-w C:\WINDOWS\system32\dllcache\mswsock.dll
                      2008-06-20 15:22 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
                      2008-06-20 15:22 225,920 ----a-w C:\WINDOWS\system32\dllcache\tcpip6.sys
                      2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
                      2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\dllcache\tcpip.sys
                      2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
                      2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\dllcache\afd.sys
                      2008-06-14 17:59 272,768 ------w C:\WINDOWS\system32\dllcache\bthport.sys
                      2008-04-19 11:24 2,402,832 ----a-w C:\Program Files\WLinstaller.exe1.exe
                      2008-04-06 18:04 6,116,304 ----a-w C:\Program Files\Firefox Setup 2.0.0.13.exe
                      2005-02-19 10:20 490 ----a-r C:\Program Files\mIRC32.lnk
                      2002-01-05 05:11 2,293,848 ----a-w C:\Program Files\FLV PlayerFCSetup.exe
                      2002-01-05 05:09 4,265,560 ----a-w C:\Program Files\FLV PlayerRCATSetup.exe
                      2002-01-05 04:49 411,248 ----a-w C:\Program Files\FLV PlayerRCSetup.exe
                      .

                      ------- Sigcheck -------

                      2004-08-19 16:10 14336 2979b03d5382a602623c0535b16ab9c0 C:\WINDOWS\system32\svchost.exe
                      2004-08-19 16:10 14336 2979b03d5382a602623c0535b16ab9c0 C:\WINDOWS\system32\dllcache\svchost.exe

                      2007-03-08 15:37 578560 753354f594809a9b96f73999b435a533 C:\WINDOWS\system32\user32.dll
                      2007-03-08 15:37 578560 753354f594809a9b96f73999b435a533 C:\WINDOWS\system32\dllcache\user32.dll
                      2005-03-02 18:20 578048 c34920eb988ce98910bd6b0417f334eb C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\user32.dll
                      2007-03-08 15:50 579072 4d88aaf39adabfe45958ea1384e2c4ff C:\WINDOWS\$hf_mig$\KB925902\SP2QFE\user32.dll
                      2004-08-19 16:09 578048 61c8c283ad063bb697ae61a155c64a5a C:\WINDOWS\$NtUninstallKB890859$\user32.dll
                      2005-03-02 18:10 578048 0df75fb73f705b011630159a43d7c354 C:\WINDOWS\$NtUninstallKB925902$\user32.dll

                      2004-08-19 16:09 82944 eed74b969b2ca1acc558ff60fb420e28 C:\WINDOWS\system32\ws2_32.dll
                      2004-08-19 16:09 82944 eed74b969b2ca1acc558ff60fb420e28 C:\WINDOWS\system32\dllcache\ws2_32.dll

                      2008-06-23 15:40 663552 95d92788889b847309c63e2ec287d1c0 C:\WINDOWS\system32\wininet.dll
                      2008-06-23 15:40 663552 95d92788889b847309c63e2ec287d1c0 C:\WINDOWS\system32\dllcache\wininet.dll
                      2007-08-22 12:57 669696 4f6a45b54d26708e2c2bf2c43d83edea C:\WINDOWS\$hf_mig$\KB939653\SP2QFE\wininet.dll
                      2007-10-11 05:59 670208 0465cde31add22f6233ffb4fe4af01cf C:\WINDOWS\$hf_mig$\KB942615\SP2QFE\wininet.dll
                      2007-12-07 00:47 670208 c057d734b1951393fd07e2607513d4d9 C:\WINDOWS\$hf_mig$\KB944533\SP2QFE\wininet.dll
                      2008-02-16 09:32 670208 dcb8a9f102663d962be60cde38a6c1d7 C:\WINDOWS\$hf_mig$\KB947864\SP2QFE\wininet.dll
                      2008-04-21 06:57 670720 f2f343d7ed0223645ba773b840eb4993 C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\wininet.dll
                      2008-04-21 06:43 670208 7af7d7d178f2863e7e7c880b55c88b76 C:\WINDOWS\$hf_mig$\KB950759\SP3GDR\wininet.dll
                      2008-04-21 06:30 670720 82b3264706b9921c67b196319fda51de C:\WINDOWS\$hf_mig$\KB950759\SP3QFE\wininet.dll
                      2008-06-23 16:15 671232 8ca18fd7cccabff7e84702bc1bbf5dcb C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\wininet.dll
                      2008-06-23 15:10 670208 d2177655bc338a07b99913f6a4bed52d C:\WINDOWS\$hf_mig$\KB953838\SP3GDR\wininet.dll
                      2008-06-23 14:56 670720 4e00327da458beffea8f4b222f466b20 C:\WINDOWS\$hf_mig$\KB953838\SP3QFE\wininet.dll
                      2008-06-23 15:40 663552 95d92788889b847309c63e2ec287d1c0 C:\WINDOWS\SoftwareDistribution\Download\[u]0[/u]8226861086a18779ae960326e29c1a3\sp2gdr\wininet.dll
                      2008-06-23 16:15 671232 8ca18fd7cccabff7e84702bc1bbf5dcb C:\WINDOWS\SoftwareDistribution\Download\[u]0[/u]8226861086a18779ae960326e29c1a3\sp2qfe\wininet.dll
                      2008-06-23 15:10 670208 d2177655bc338a07b99913f6a4bed52d C:\WINDOWS\SoftwareDistribution\Download\[u]0[/u]8226861086a18779ae960326e29c1a3\sp3gdr\wininet.dll
                      2008-06-23 14:56 670720 4e00327da458beffea8f4b222f466b20 C:\WINDOWS\SoftwareDistribution\Download\[u]0[/u]8226861086a18779ae960326e29c1a3\sp3qfe\wininet.dll
                      2004-08-19 16:09 660480 4e958b97efc3d801f49283d1820f48b7 C:\WINDOWS\$NtUninstallKB939653$\wininet.dll
                      2007-10-11 06:13 663552 d2fd027e5d3af96dee6c5cc225079df0 C:\WINDOWS\$NtUninstallKB944533$\wininet.dll
                      2007-12-07 01:07 663552 c5a40de381481d288addee45fc67f652 C:\WINDOWS\$NtUninstallKB947864$\wininet.dll
                      2008-02-16 09:02 663552 c9218cd3cd93586ffe9ae789282cae63 C:\WINDOWS\$NtUninstallKB950759$\wininet.dll
                      2007-08-22 13:13 663040 18048557aa56de4b1955fdf7a21f9b24 C:\WINDOWS\$NtUninstallKB942615$\wininet.dll
                      2008-04-21 07:02 663552 355a69cc05045428ce6b9e6bfbd4b74b C:\WINDOWS\$NtUninstallKB953838$\wininet.dll

                      2008-06-20 10:45 360320 2a5554fc5b1e04e131230e3ce035c3f9 C:\WINDOWS\system32\drivers\tcpip.sys
                      2008-06-20 10:45 360320 2a5554fc5b1e04e131230e3ce035c3f9 C:\WINDOWS\system32\dllcache\tcpip.sys
                      2006-04-20 12:18 360576 b2220c618b42a2212a59d91ebd6fc4b4 C:\WINDOWS\$hf_mig$\KB917953\SP2QFE\tcpip.sys
                      2007-10-30 16:53 360832 64798ecfa43d78c7178375fcdd16d8c8 C:\WINDOWS\$hf_mig$\KB941644\SP2QFE\tcpip.sys
                      2008-06-20 10:44 360960 744e57c99232201ae98c49168b918f48 C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\tcpip.sys
                      2008-06-20 11:51 361600 9aefa14bd6b182d61e3119fa5f436d3d C:\WINDOWS\$hf_mig$\KB951748\SP3GDR\tcpip.sys
                      2008-06-20 11:59 361600 ad978a1b783b5719720cff204b666c8e C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\tcpip.sys
                      2004-08-03 23:14 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\$NtUninstallKB917953$\tcpip.sys
                      2006-04-20 11:51 359808 1dbf125862891817f374f407626967f4 C:\WINDOWS\$NtUninstallKB941644$\tcpip.sys
                      2007-10-30 17:20 360064 90caff4b094573449a0872a0f919b178 C:\WINDOWS\$NtUninstallKB951748$\tcpip.sys

                      2004-08-19 16:10 506368 123eea158f74d0f67a51dcdf065d1091 C:\WINDOWS\system32\winlogon.exe
                      2004-08-19 16:10 506368 123eea158f74d0f67a51dcdf065d1091 C:\WINDOWS\system32\dllcache\winlogon.exe

                      2004-08-03 23:14 182912 558635d3af1c7546d26067d5d9b6959e C:\WINDOWS\system32\drivers\ndis.sys
                      2004-08-03 23:14 182912 558635d3af1c7546d26067d5d9b6959e C:\WINDOWS\system32\dllcache\ndis.sys

                      2007-02-28 16:02 2059648 a1d5231403329478ae4fe2778c55c77f C:\WINDOWS\system32\ntkrnlpa.exe
                      2007-02-28 16:02 2059648 a1d5231403329478ae4fe2778c55c77f C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
                      2007-02-28 16:02 2059648 a1d5231403329478ae4fe2778c55c77f C:\WINDOWS\Driver Cache\i386\ntkrnlpa.exe
                      2005-03-02 18:13 2059008 5311776074b6c13f983dc75baeac9c0c C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\ntkrnlpa.exe
                      2007-02-28 16:08 2061440 7a56a64eb50399613587e90292dd2aab C:\WINDOWS\$hf_mig$\KB931784\SP2QFE\ntkrnlpa.exe
                      2004-08-19 16:20 2058880 f252fae094c54572ece38a039f2103c4 C:\WINDOWS\$NtUninstallKB931784$\ntkrnlpa.exe

                      2007-02-28 16:02 2182400 7d6d19aac51a4325f6039f083c22303c C:\WINDOWS\system32\ntoskrnl.exe
                      2007-02-28 16:02 2182400 7d6d19aac51a4325f6039f083c22303c C:\WINDOWS\system32\dllcache\ntoskrnl.exe
                      2007-02-28 16:02 2182400 7d6d19aac51a4325f6039f083c22303c C:\WINDOWS\Driver Cache\i386\ntoskrnl.exe
                      2005-03-02 18:13 2181632 3e2a0a4a0c0b19fc113618a9562a3b2a C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe
                      2007-02-28 16:08 2184192 8e244108562e0e452eb68dff64cb08a9 C:\WINDOWS\$hf_mig$\KB931784\SP2QFE\ntoskrnl.exe
                      2004-08-19 16:04 2183040 7d38ce4398e6aa6339b4644feadcc0d8 C:\WINDOWS\$NtUninstallKB931784$\ntoskrnl.exe

                      2007-06-13 13:22 1037312 d0288319660edcfed07c7e74c4ea38a5 C:\WINDOWS\explorer.exe
                      2007-06-13 13:22 1037312 d0288319660edcfed07c7e74c4ea38a5 C:\WINDOWS\system32\dllcache\explorer.exe
                      2007-06-13 13:10 1037312 b795475444d6d57a572c14b9e1a29839 C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
                      2004-08-22 22:35 1036288 998f3f568f6074a35ab08cd3395a9dc2 C:\WINDOWS\$NtUninstallKB938828$\explorer.exe

                      2004-08-19 16:10 108544 63dcde1a0d86eeb8924d6738ff616ead C:\WINDOWS\system32\services.exe
                      2004-08-19 16:10 108544 63dcde1a0d86eeb8924d6738ff616ead C:\WINDOWS\system32\dllcache\services.exe

                      2004-08-19 16:09 13312 259af82a0932eea4f316f92db94707b6 C:\WINDOWS\system32\lsass.exe
                      2004-08-19 16:09 13312 259af82a0932eea4f316f92db94707b6 C:\WINDOWS\system32\dllcache\lsass.exe

                      2004-08-19 16:09 15360 64e41e8fee655b03e3f19ded21ba5118 C:\WINDOWS\system32\ctfmon.exe
                      2004-08-19 16:09 15360 64e41e8fee655b03e3f19ded21ba5118 C:\WINDOWS\system32\dllcache\ctfmon.exe

                      2005-06-10 23:53 57856 da81ec57acd4cdc3d4c51cf3d409af9f C:\WINDOWS\system32\spoolsv.exe
                      2005-06-10 23:53 57856 da81ec57acd4cdc3d4c51cf3d409af9f C:\WINDOWS\system32\dllcache\spoolsv.exe
                      2005-06-11 00:17 57856 ad3d9d191aea7b5445fe1d82ffbb4788 C:\WINDOWS\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
                      2004-08-19 16:10 57856 df9fc62ad51cb082b0ae371919a232cb C:\WINDOWS\$NtUninstallKB896423$\spoolsv.exe

                      2007-07-30 19:19 53080 f3e9065eb617a7e3a832a7976bfa021b C:\WINDOWS\system32\wuauclt.exe
                      2007-07-30 19:19 53080 f3e9065eb617a7e3a832a7976bfa021b C:\WINDOWS\system32\dllcache\wuauclt.exe

                      2004-08-19 16:10 25088 84717891f0734c611721f56c60b5fbc3 C:\WINDOWS\system32\userinit.exe
                      2004-08-19 16:10 25088 84717891f0734c611721f56c60b5fbc3 C:\WINDOWS\system32\dllcache\userinit.exe
                      .
                      -- Snapshot reset to current date --
                      .
                      ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
                      .
                      .
                      REGEDIT4
                      *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

                      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                      "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 16:09 15360]
                      "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]

                      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                      "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
                      "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-18 22:35 266497]
                      "Glock Suite 1.1"="C:\WINDOWS\system32\glock32.exe" [2004-08-19 16:09 13312]
                      "Restart"="" [BU]
                      "C-Media Mixer"="Mixer.exe" [2002-07-12 16:33 1581056 C:\WINDOWS\mixer.exe]

                      [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                      "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 16:09 15360]

                      [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
                      "FlashPlayerUpdate"="C:\WINDOWS\system32\Macromed\Flash\FlashUtil9d.exe" [2007-06-11 20:04 190696]

                      [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
                      "NoDispBackgroundPage"= 1 (0x1)
                      "NoDispScrSavPage"= 1 (0x1)

                      [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
                      "UIHost"=hex(2):6c,6f,67,6f,6e,75,69,32,2e,65,78,65,00

                      [HKEY_LOCAL_MACHINE\software\microsoft\security center]
                      "UpdatesDisableNotify"=dword:00000001
                      "FirewallOverride"=dword:00000001
                      "AntiVirusOverride"=dword:00000001
                      "AntiVirusDisableNotify"=dword:00000001

                      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
                      "EnableFirewall"= 0 (0x0)
                      "DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

                      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                      "%windir%\\system32\\sessmgr.exe"=
                      "C:\\Program Files\\Yahoo!\\Messenger\\YPager.exe"=
                      "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
                      "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
                      "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

                      R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys [2005-12-15 18:13]
                      R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys [2005-12-15 18:01]
                      S0 Twa36;Twa36;C:\WINDOWS\system32\Drivers\Twa36.sys []
                      .
                      Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'

                      2008-08-17 C:\WINDOWS\Tasks\B853381C9188DEB8.job
                      - c:\docume~1\iiman3~1.000\applic~1\typeli~1\Web more loud.exe []
                      .
                      - - - - ORPHANS REMOVED - - - -

                      HKLM-Run-ctfdll32 - C:\WINDOWS\System32\Ctfdll32.exe
                      Notify-bzzmotg - bzzmotg.dll
                      MSConfigStartUp-MyWebSearch Plugin - C:\PROGRA~1\MYWEBS~1\bar\2.bin\M3PLUGIN.DLL

                      **************************************************************************

                      catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                      Rootkit scan 2008-08-17 20:48:29
                      Windows 5.1.2600 Service Pack 2 FAT NTAPI

                      Balayage processus cach‚s ...

                      Balayage cach‚ autostart entries ...

                      Balayage des fichiers cach‚s ...

                      Scan termin‚ avec succŠs
                      Les fichiers cach‚s: 0

                      **************************************************************************

                      [HKEY_LOCAL_MACHINE\system\ControlSet002\Services\Bfi47]
                      "ImagePath"="System32\Drivers\Bfi47.sys"

                      [HKEY_LOCAL_MACHINE\system\ControlSet002\Services\bgK61]
                      "ImagePath"="System32\Drivers\bgK61.sys"
                      0
                      1. imn12 Auteur
                        Voici le rapport :
                        ComboFix 08-08-16.01 - iiMAN3 2008-08-17 20:11:37.2 - [color=red][b]FAT32[/b][/color]x86
                        Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.50 [GMT 0:00]
                        Endroit: C:\Documents and Settings\iiMAN3.INTERNET.000\Bureau\ComboFix.exe
                        Command switches used :: C:\Documents and Settings\iiMAN3.INTERNET.000\Bureau\CFScript.txt
                        * Création d'un nouveau point de restauration

                        [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]

                        FILE ::
                        C:\Documents and Settings\Brahim\cbOCR.dll
                        C:\Documents and Settings\iiMAN3.INTERNET.000\cbOCR.dll
                        C:\Documents and Settings\iiMAN3.INTERNET\cbOCR.dll
                        C:\Documents and Settings\iiMAN3\cbOCR.dll
                        C:\WINDOWS\SYSTEM32\bzzmotg.dll
                        C:\WINDOWS\system32\Ctfdll32.exe
                        C:\WINDOWS\system32\Drivers\Bfi47.sys
                        C:\WINDOWS\system32\Drivers\bgK61.sys
                        C:\WINDOWS\system32\Drivers\Cgi82.sys
                        C:\WINDOWS\system32\Drivers\Dgj03.sys
                        C:\WINDOWS\system32\Drivers\Ehk60.sys
                        C:\WINDOWS\system32\Drivers\flP60.sys
                        C:\WINDOWS\system32\Drivers\glP60.sys
                        C:\WINDOWS\system32\Drivers\Jmp14.sys
                        C:\WINDOWS\system32\Drivers\joS50.sys
                        C:\WINDOWS\system32\Drivers\Lqu71.sys
                        C:\WINDOWS\system32\drivers\nkv2.sys
                        C:\WINDOWS\system32\Drivers\Nqt03.sys
                        C:\WINDOWS\system32\Drivers\nsV47.sys
                        C:\WINDOWS\system32\Drivers\otW72.sys
                        C:\WINDOWS\system32\Drivers\ouY71.sys
                        C:\WINDOWS\system32\Drivers\Svy61.sys
                        C:\WINDOWS\system32\Drivers\Uyc24.sys
                        C:\WINDOWS\system32\Drivers\Uyc68.sys
                        C:\WINDOWS\system32\Drivers\Xcf03.sys
                        C:\WINDOWS\system32\Drivers\Ydg24.sys
                        C:\WINDOWS\system32\lphc3bej0e3dr.exe
                        C:\WINDOWS\system32\noskrnl.sys
                        C:\WINDOWS\system32\WinNt32.dll
                        .

                        (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
                        .

                        C:\DOCUME~1\IIMAN3~1.000\APPLIC~1\TYPELI~1
                        C:\DOCUME~1\IIMAN3~1.000\APPLIC~1\TYPELI~1\[u]0[/u]
                        C:\DOCUME~1\IIMAN3~1.000\APPLIC~1\TYPELI~1\ckzpaknq.exe
                        C:\DOCUME~1\IIMAN3~1.000\APPLIC~1\TYPELI~1\hoyrynol.exe
                        C:\DOCUME~1\IIMAN3~1.000\APPLIC~1\TYPELI~1\plwpbazf.exe
                        C:\DOCUME~1\IIMAN3~1.000\APPLIC~1\TYPELI~1\SectOkayModeSixth.exe
                        C:\Documents and Settings\All Users\Application Data\Frag great bend logo
                        C:\Documents and Settings\All Users\Application Data\Frag great bend logo\copy logo.exe
                        C:\Documents and Settings\Brahim\Application Data\Microsoft\SystemCertificates\My
                        C:\Documents and Settings\Brahim\cbOCR.dll
                        C:\Documents and Settings\Brahim\Cookies\brahim@a[2].txt
                        C:\Documents and Settings\iiMAN3.INTERNET.000\cbOCR.dll
                        C:\Documents and Settings\iiMAN3.INTERNET\cbOCR.dll
                        C:\Documents and Settings\iiMAN3\cbOCR.dll
                        C:\Program Files\typelitemeal
                        C:\WINDOWS\SYSTEM32\bzzmotg.dll
                        C:\WINDOWS\system32\Ctfdll32.exe
                        .
                        ---- Previous Run -------
                        .
                        C:\DEL.bat
                        C:\Documents and Settings\Administrateur\Application Data\Microsoft\SystemCertificates\My
                        C:\Documents and Settings\Administrateur\Cookies\administrateur@promobenef[2].txt
                        C:\Documents and Settings\Administrateur\Cookies\administrateur@seriestreaming[2].txt
                        C:\Documents and Settings\All Users\Bureau\Antivirus XP 2008.lnk
                        C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008
                        C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008\Antivirus XP 2008.lnk
                        C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008\How to Register Antivirus XP 2008.lnk
                        C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008\License Agreement.lnk
                        C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008\Register Antivirus XP 2008.lnk
                        C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008\Uninstall.lnk
                        C:\Documents and Settings\Brahim\Application Data\rhc7bej0e3dr
                        C:\Documents and Settings\Brahim\Cookies\brahim@a[2].txt
                        C:\Documents and Settings\Brahim\Cookies\brahim@bluestreak[1].txt
                        C:\Documents and Settings\Brahim\Cookies\brahim@edt02[1].txt
                        C:\Documents and Settings\Brahim\Cookies\brahim@mywebsearch[2].txt
                        C:\Documents and Settings\Brahim\Cookies\brahim@www.clubteenpix[1].txt
                        C:\Documents and Settings\Brahim\Cookies\brahim@www.pixmania[1].txt
                        C:\Documents and Settings\Brahim\Cookies\brahim@www.toutpourlamicro[1].txt
                        C:\Documents and Settings\iiMAN3.INTERNET.000\Application Data\FunWebProducts
                        C:\Documents and Settings\iiMAN3.INTERNET.000\Application Data\FunWebProducts\Data\iiMAN3\avatar.dat
                        C:\Documents and Settings\iiMAN3.INTERNET.000\Application Data\rhc7bej0e3dr
                        C:\Documents and Settings\iiMAN3.INTERNET\Application Data\Microsoft\SystemCertificates\My
                        C:\Documents and Settings\iiMAN3.INTERNET\Cookies\iiman3@promobenef[2].txt
                        C:\Documents and Settings\iiMAN3\Application Data\Microsoft\SystemCertificates\My
                        C:\Documents and Settings\iiMAN3\Cookies\iiman3@promobenef[2].txt
                        C:\Documents and Settings\iiMAN3\Cookies\iiman3@www.toutpourlamicro[2].txt
                        C:\Documents and Settings\Invité\Application Data\Microsoft\SystemCertificates\My
                        C:\Documents and Settings\Invité\Cookies\invité@ad.yieldmanager[1].txt
                        C:\Documents and Settings\Invité\Cookies\invité@edt02[2].txt
                        C:\Documents and Settings\Invité\Cookies\invité@promobenef[1].txt
                        C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My
                        C:\Documents and Settings\mona81096\Application Data\Microsoft\SystemCertificates\My
                        C:\Documents and Settings\mona81096\Cookies\mona81096@promobenef[2].txt
                        C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My
                        C:\Program Files\FunWebProducts
                        C:\Program Files\FunWebProducts\Shared\Cache\AvatarSmallBtn.html
                        C:\Program Files\FunWebProducts\Shared\Cache\CursorManiaBtn.html
                        C:\Program Files\FunWebProducts\Shared\Cache\FunBuddyIconBtn.html
                        C:\Program Files\FunWebProducts\Shared\Cache\MailStampBtn.htmlx
                        C:\Program Files\FunWebProducts\Shared\Cache\MyFunCardsIMBtn.html
                        C:\Program Files\FunWebProducts\Shared\Cache\MyStationeryBtn.htmlx
                        C:\Program Files\FunWebProducts\Shared\Cache\SmileyCentralBtn.html
                        C:\Program Files\internet explorer\msimg32.dll
                        C:\Program Files\MyWebSearch
                        C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
                        C:\Program Files\MyWebSearch\bar\1.bin\MWSOESTB.DLL
                        C:\Program Files\MyWebSearch\bar\2.bin\F3BKGERR.JPG
                        C:\Program Files\MyWebSearch\bar\2.bin\F3CJPEG.DLL
                        C:\Program Files\MyWebSearch\bar\2.bin\F3DTACTL.DLL
                        C:\Program Files\MyWebSearch\bar\2.bin\F3HISTSW.DLL
                        C:\Program Files\MyWebSearch\bar\2.bin\F3HTMLMU.DLL
                        C:\Program Files\MyWebSearch\bar\2.bin\F3HTTPCT.DLL
                        C:\Program Files\MyWebSearch\bar\2.bin\F3IMSTUB.DLL
                        C:\Program Files\MyWebSearch\bar\2.bin\F3POPSWT.DLL
                        C:\Program Files\MyWebSearch\bar\2.bin\F3PSSAVR.SCR
                        C:\Program Files\MyWebSearch\bar\2.bin\F3REPROX.DLL
                        C:\Program Files\MyWebSearch\bar\2.bin\F3RESTUB.DLL
                        C:\Program Files\MyWebSearch\bar\2.bin\F3SCHMON.EXE
                        C:\Program Files\MyWebSearch\bar\2.bin\F3SCRCTR.DLL
                        C:\Program Files\MyWebSearch\bar\2.bin\F3SPACER.WMV
                        C:\Program Files\MyWebSearch\bar\2.bin\F3WALLPP.DAT
                        C:\Program Files\MyWebSearch\bar\2.bin\F3WPHOOK.DLL
                        C:\Program Files\MyWebSearch\bar\2.bin\FWPBUDDY.PNG
                        C:\Program Files\MyWebSearch\bar\2.bin\M3FFXTBR.JAR
                        C:\Program Files\MyWebSearch\bar\2.bin\M3FFXTBR.MANIFEST
                        C:\Program Files\MyWebSearch\bar\2.bin\M3HIGHIN.EXE
                        C:\Program Files\MyWebSearch\bar\2.bin\M3HTML.DLL
                        C:\Program Files\MyWebSearch\bar\2.bin\M3IDLE.DLL
                        C:\Program Files\MyWebSearch\bar\2.bin\M3IMPIPE.EXE
                        C:\Program Files\MyWebSearch\bar\2.bin\M3MEDINT.EXE
                        C:\Program Files\MyWebSearch\bar\2.bin\M3MSG.DLL
                        C:\Program Files\MyWebSearch\bar\2.bin\M3NTSTBR.JAR
                        C:\Program Files\MyWebSearch\bar\2.bin\M3NTSTBR.MANIFEST
                        C:\Program Files\MyWebSearch\bar\2.bin\M3OUTLCN.DLL
                        C:\Program Files\MyWebSearch\bar\2.bin\M3PLUGIN.DLL
                        C:\Program Files\MyWebSearch\bar\2.bin\M3SKIN.DLL
                        C:\Program Files\MyWebSearch\bar\2.bin\M3SKPLAY.EXE
                        C:\Program Files\MyWebSearch\bar\2.bin\M3SLSRCH.EXE
                        C:\Program Files\MyWebSearch\bar\2.bin\M3SRCHMN.EXE
                        C:\Program Files\MyWebSearch\bar\2.bin\MWSBAR.DLL
                        C:\Program Files\MyWebSearch\bar\2.bin\MWSOEMON.EXE
                        C:\Program Files\MyWebSearch\bar\2.bin\MWSOEPLG.DLL
                        C:\Program Files\MyWebSearch\bar\2.bin\MWSOESTB.DLL
                        C:\Program Files\MyWebSearch\bar\2.bin\MWSSVC.EXE
                        C:\Program Files\MyWebSearch\bar\2.bin\NPMYWEBS.DLL
                        C:\Program Files\MyWebSearch\bar\Avatar\COMMON.F3S
                        C:\Program Files\MyWebSearch\bar\Avatar\COMMON\avatar.htm
                        C:\Program Files\MyWebSearch\bar\Avatar\COMMON\bgfadel.gif
                        C:\Program Files\MyWebSearch\bar\Avatar\COMMON\bgfader.gif
                        C:\Program Files\MyWebSearch\bar\Avatar\COMMON\common-x.css
                        C:\Program Files\MyWebSearch\bar\Avatar\COMMON\common.css
                        C:\Program Files\MyWebSearch\bar\Avatar\COMMON\cornerbl.gif
                        C:\Program Files\MyWebSearch\bar\Avatar\COMMON\cornerbr.gif
                        C:\Program Files\MyWebSearch\bar\Avatar\COMMON\ext_def.gif
                        C:\Program Files\MyWebSearch\bar\Avatar\COMMON\ext_roll.gif
                        C:\Program Files\MyWebSearch\bar\Avatar\COMMON\include.js
                        C:\Program Files\MyWebSearch\bar\Avatar\COMMON\index.htm
                        C:\Program Files\MyWebSearch\bar\Avatar\COMMON\loader.htm
                        C:\Program Files\MyWebSearch\bar\Avatar\COMMON\loading.gif
                        C:\Program Files\MyWebSearch\bar\Avatar\COMMON\logo.gif
                        C:\Program Files\MyWebSearch\bar\Avatar\COMMON\max_def.gif
                        C:\Program Files\MyWebSearch\bar\Avatar\COMMON\max_roll.gif
                        C:\Program Files\MyWebSearch\bar\Avatar\COMMON\min_def.gif
                        C:\Program Files\MyWebSearch\bar\Avatar\COMMON\min_roll.gif
                        C:\Program Files\MyWebSearch\bar\Avatar\COMMON\noflash.htm
                        C:\Program Files\MyWebSearch\bar\Avatar\COMMON\res_def.gif
                        C:\Program Files\MyWebSearch\bar\Avatar\COMMON\res_roll.gif
                        C:\Program Files\MyWebSearch\bar\Avatar\COMMON\spacer.gif
                        C:\Program Files\MyWebSearch\bar\Avatar\COMMON\spacer.swf
                        C:\Program Files\MyWebSearch\bar\Avatar\COMMON\topgrad.gif
                        C:\Program Files\MyWebSearch\bar\Avatar\COMMON\window.ico
                        C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]0033F9A
                        C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]005D430
                        C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]005DBB1
                        C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]008C220
                        C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]028E898
                        C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]037C78A
                        C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]04C6782
                        C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]04C7136.bin
                        C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]04C74D0.bin
                        C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]04C7760.bin
                        C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]04C7D6B.bin
                        C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]04C9B73.bin
                        C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]0B1A6D2.bin
                        C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]0B1A9A0.bin
                        C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]0B1AE25.bin
                        C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]0B1B384.bin
                        C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]0B1B549.bin
                        C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]0B9BF64.bin
                        C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]0B9C1E4.bin
                        C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]0B9C3AA.bin
                        C:\Program Files\MyWebSearch\bar\Cache\files.ini
                        C:\Program Files\MyWebSearch\bar\Game\CHECKERS.F3S
                        C:\Program Files\MyWebSearch\bar\Game\CHESS.F3S
                        C:\Program Files\MyWebSearch\bar\Game\REVERSI.F3S
                        C:\Program Files\MyWebSearch\bar\History\search3
                        C:\Program Files\MyWebSearch\bar\icons\CM.ICO
                        C:\Program Files\MyWebSearch\bar\icons\MFC.ICO
                        C:\Program Files\MyWebSearch\bar\icons\PSS.ICO
                        C:\Program Files\MyWebSearch\bar\icons\SMILEY.ICO
                        C:\Program Files\MyWebSearch\bar\icons\WB.ICO
                        C:\Program Files\MyWebSearch\bar\icons\ZWINKY.ICO
                        C:\Program Files\MyWebSearch\bar\Message\COMMON.F3S
                        C:\Program Files\MyWebSearch\bar\Notifier\COMMON.F3S
                        C:\Program Files\MyWebSearch\bar\Notifier\DOG.F3S
                        C:\Program Files\MyWebSearch\bar\Notifier\FISH.F3S
                        C:\Program Files\MyWebSearch\bar\Notifier\KUNGFU.F3S
                        C:\Program Files\MyWebSearch\bar\Notifier\LIFEGARD.F3S
                        C:\Program Files\MyWebSearch\bar\Notifier\MAID.F3S
                        C:\Program Files\MyWebSearch\bar\Notifier\MAILBOX.F3S
                        C:\Program Files\MyWebSearch\bar\Notifier\OPERA.F3S
                        C:\Program Files\MyWebSearch\bar\Notifier\ROBOT.F3S
                        C:\Program Files\MyWebSearch\bar\Notifier\SEDUCT.F3S
                        C:\Program Files\MyWebSearch\bar\Notifier\SURFER.F3S
                        C:\Program Files\MyWebSearch\bar\Settings\prevcfg2.htm
                        C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat
                        C:\Program Files\MyWebSearch\SrchAstt\2.bin\MWSSRCAS.DLL
                        C:\Program Files\rhc7bej0e3dr
                        C:\WINDOWS\doll104.exe
                        C:\WINDOWS\doll119.exe
                        C:\WINDOWS\doll120.exe
                        C:\WINDOWS\doll123.exe
                        C:\WINDOWS\doll126.exe
                        C:\WINDOWS\doll128.exe
                        C:\WINDOWS\doll132.exe
                        C:\WINDOWS\doll137.exe
                        C:\WINDOWS\doll138.exe
                        C:\WINDOWS\doll143.exe
                        C:\WINDOWS\doll144.exe
                        C:\WINDOWS\doll148.exe
                        C:\WINDOWS\doll151.exe
                        C:\WINDOWS\doll152.exe
                        C:\WINDOWS\doll154.exe
                        C:\WINDOWS\doll155.exe
                        C:\WINDOWS\doll157.exe
                        C:\WINDOWS\doll159.exe
                        C:\WINDOWS\doll161.exe
                        C:\WINDOWS\doll166.exe
                        C:\WINDOWS\doll167.exe
                        C:\WINDOWS\doll176.exe
                        C:\WINDOWS\doll181.exe
                        C:\WINDOWS\doll185.exe
                        C:\WINDOWS\doll191.exe
                        C:\WINDOWS\doll194.exe
                        C:\WINDOWS\doll196.exe
                        C:\WINDOWS\doll197.exe
                        C:\WINDOWS\drabste.exe
                        C:\WINDOWS\draste.exe
                        C:\WINDOWS\glok+3ca-59fa.sys
                        C:\WINDOWS\glok+serv.config
                        C:\WINDOWS\ksacre.exe
                        C:\WINDOWS\system32\[u]0[/u]_exception.nls
                        C:\WINDOWS\system32\1.tmp
                        C:\WINDOWS\system32\blphc3bej0e3dr.scr
                        C:\WINDOWS\system32\drivers\ctl_w32.sys
                        c:\windows\system32\Drivers\Jnq72.sys
                        C:\WINDOWS\system32\f3PSSavr.scr
                        C:\WINDOWS\system32\koos.exe
                        C:\WINDOWS\system32\kprof
                        C:\WINDOWS\system32\lphc3bej0e3dr.exe
                        C:\WINDOWS\system32\phc3bej0e3dr.bmp
                        C:\WINDOWS\system32\poof
                        C:\WINDOWS\system32\pphc3bej0e3dr.exe
                        C:\WINDOWS\system32\WinCtrl32.dll
                        C:\WINDOWS\system32\WinData.cab
                        C:\WINDOWS\system32\WinNt32.dll
                        C:\WINDOWS\system32\WLCtrl32.dll
                        C:\WINDOWS\system32\WinNt32.dll . . . . Echec de suppression

                        .
                        ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
                        .

                        -------\Legacy_CTL_W32
                        -------\Legacy_ICF
                        -------\Legacy_JNQ72
                        -------\Legacy_MYWEBSEARCHSERVICE
                        -------\Legacy_NTIO256
                        -------\Legacy_POOF
                        -------\Legacy_RUNTIME
                        -------\Legacy_SMTPDRV
                        -------\Legacy_TCPSR
                        -------\Legacy_XLAVBA8
                        -------\Service_ICF
                        -------\Service_Jnq72
                        -------\Service_kprof
                        -------\Service_MyWebSearchService
                        -------\Service_ntio256
                        -------\Service_poof
                        -------\Service_runtime
                        -------\Service_tcpsr
                        -------\Service_xlavba8
                        -------\Legacy_LQU71
                        -------\Legacy_USB2_04
                        -------\Legacy_UYC24
                        -------\Service_Bfi47
                        -------\Service_bgK61
                        -------\Service_Cgi82
                        -------\Service_ctl_w32
                        -------\Service_Dgj03
                        -------\Service_Ehk60
                        -------\Service_flP60
                        -------\Service_glP60
                        -------\Service_Jmp14
                        -------\Service_joS50
                        -------\Service_Lqu71
                        -------\Service_noskrnl.sys
                        -------\Service_Nqt03
                        -------\Service_nsV47
                        -------\Service_otW72
                        -------\Service_ouY71
                        -------\Service_Svy61
                        -------\Service_USB2_04
                        -------\Service_Uyc24
                        -------\Service_Uyc68
                        -------\Service_Xcf03
                        -------\Service_Ydg24

                        ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-07-17 to 2008-08-17 ))))))))))))))))))))))))))))))))))))
                        .

                        2008-08-14 14:16 . 2008-08-14 14:16 <REP> d--hs---- C:\FOUND.098
                        2008-08-13 15:47 . 2008-08-13 15:47 <REP> d--hs---- C:\FOUND.097
                        2008-08-13 10:00 . 2008-08-13 10:00 <REP> d--hs---- C:\FOUND.096
                        2008-07-21 20:29 . 2008-07-21 20:29 <REP> d--hs---- C:\FOUND.093
                        2008-07-19 17:49 . 2008-07-19 17:49 <REP> d--hs---- C:\FOUND.092

                        .
                        (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                        .
                        2008-07-07 20:31 253,952 ----a-w C:\WINDOWS\system32\es.dll
                        2008-07-07 20:31 253,952 ----a-w C:\WINDOWS\system32\dllcache\es.dll
                        2008-06-30 14:40 --------- d-----w C:\Program Files\Bitmanagement Software
                        2008-06-29 13:15 192,512 ----a-w C:\WINDOWS\system32\cbOCR.dll
                        2008-06-25 16:55 979 ----a-w C:\WINDOWS\system32\drivers\fwdrv.err
                        2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
                        2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\dllcache\mscms.dll
                        2008-06-23 15:39 152,064 ----a-w C:\WINDOWS\system32\dllcache\cdfview.dll
                        2008-06-23 15:39 1,024,000 ----a-w C:\WINDOWS\system32\dllcache\browseui.dll
                        2008-06-23 09:49 18,432 ----a-w C:\WINDOWS\system32\dllcache\iedw.exe
                        2008-06-20 23:11 148,992 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
                        2008-06-20 17:41 247,808 ----a-w C:\WINDOWS\system32\mswsock.dll
                        2008-06-20 17:41 247,808 ----a-w C:\WINDOWS\system32\dllcache\mswsock.dll
                        2008-06-20 15:22 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
                        2008-06-20 15:22 225,920 ----a-w C:\WINDOWS\system32\dllcache\tcpip6.sys
                        2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
                        2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\dllcache\tcpip.sys
                        2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
                        2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\dllcache\afd.sys
                        2008-06-14 17:59 272,768 ------w C:\WINDOWS\system32\dllcache\bthport.sys
                        2008-04-19 11:24 2,402,832 ----a-w C:\Program Files\WLinstaller.exe1.exe
                        2008-04-06 18:04 6,116,304 ----a-w C:\Program Files\Firefox Setup 2.0.0.13.exe
                        2005-02-19 10:20 490 ----a-r C:\Program Files\mIRC32.lnk
                        2002-01-05 05:11 2,293,848 ----a-w C:\Program Files\FLV PlayerFCSetup.exe
                        2002-01-05 05:09 4,265,560 ----a-w C:\Program Files\FLV PlayerRCATSetup.exe
                        2002-01-05 04:49 411,248 ----a-w C:\Program Files\FLV PlayerRCSetup.exe
                        .

                        ------- Sigcheck -------

                        2004-08-19 16:10 14336 2979b03d5382a602623c0535b16ab9c0 C:\WINDOWS\system32\svchost.exe
                        2004-08-19 16:10 14336 2979b03d5382a602623c0535b16ab9c0 C:\WINDOWS\system32\dllcache\svchost.exe

                        2007-03-08 15:37 578560 753354f594809a9b96f73999b435a533 C:\WINDOWS\system32\user32.dll
                        2007-03-08 15:37 578560 753354f594809a9b96f73999b435a533 C:\WINDOWS\system32\dllcache\user32.dll
                        2005-03-02 18:20 578048 c34920eb988ce98910bd6b0417f334eb C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\user32.dll
                        2007-03-08 15:50 579072 4d88aaf39adabfe45958ea1384e2c4ff C:\WINDOWS\$hf_mig$\KB925902\SP2QFE\user32.dll
                        2004-08-19 16:09 578048 61c8c283ad063bb697ae61a155c64a5a C:\WINDOWS\$NtUninstallKB890859$\user32.dll
                        2005-03-02 18:10 578048 0df75fb73f705b011630159a43d7c354 C:\WINDOWS\$NtUninstallKB925902$\user32.dll

                        2004-08-19 16:09 82944 eed74b969b2ca1acc558ff60fb420e28 C:\WINDOWS\system32\ws2_32.dll
                        2004-08-19 16:09 82944 eed74b969b2ca1acc558ff60fb420e28 C:\WINDOWS\system32\dllcache\ws2_32.dll

                        2008-06-23 15:40 663552 95d92788889b847309c63e2ec287d1c0 C:\WINDOWS\system32\wininet.dll
                        2008-06-23 15:40 663552 95d92788889b847309c63e2ec287d1c0 C:\WINDOWS\system32\dllcache\wininet.dll
                        2007-08-22 12:57 669696 4f6a45b54d26708e2c2bf2c43d83edea C:\WINDOWS\$hf_mig$\KB939653\SP2QFE\wininet.dll
                        2007-10-11 05:59 670208 0465cde31add22f6233ffb4fe4af01cf C:\WINDOWS\$hf_mig$\KB942615\SP2QFE\wininet.dll
                        2007-12-07 00:47 670208 c057d734b1951393fd07e2607513d4d9 C:\WINDOWS\$hf_mig$\KB944533\SP2QFE\wininet.dll
                        2008-02-16 09:32 670208 dcb8a9f102663d962be60cde38a6c1d7 C:\WINDOWS\$hf_mig$\KB947864\SP2QFE\wininet.dll
                        2008-04-21 06:57 670720 f2f343d7ed0223645ba773b840eb4993 C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\wininet.dll
                        2008-04-21 06:43 670208 7af7d7d178f2863e7e7c880b55c88b76 C:\WINDOWS\$hf_mig$\KB950759\SP3GDR\wininet.dll
                        2008-04-21 06:30 670720 82b3264706b9921c67b196319fda51de C:\WINDOWS\$hf_mig$\KB950759\SP3QFE\wininet.dll
                        2008-06-23 16:15 671232 8ca18fd7cccabff7e84702bc1bbf5dcb C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\wininet.dll
                        2008-06-23 15:10 670208 d2177655bc338a07b99913f6a4bed52d C:\WINDOWS\$hf_mig$\KB953838\SP3GDR\wininet.dll
                        2008-06-23 14:56 670720 4e00327da458beffea8f4b222f466b20 C:\WINDOWS\$hf_mig$\KB953838\SP3QFE\wininet.dll
                        2008-06-23 15:40 663552 95d92788889b847309c63e2ec287d1c0 C:\WINDOWS\SoftwareDistribution\Download\[u]0[/u]8226861086a18779ae960326e29c1a3\sp2gdr\wininet.dll
                        2008-06-23 16:15 671232 8ca18fd7cccabff7e84702bc1bbf5dcb C:\WINDOWS\SoftwareDistribution\Download\[u]0[/u]8226861086a18779ae960326e29c1a3\sp2qfe\wininet.dll
                        2008-06-23 15:10 670208 d2177655bc338a07b99913f6a4bed52d C:\WINDOWS\SoftwareDistribution\Download\[u]0[/u]8226861086a18779ae960326e29c1a3\sp3gdr\wininet.dll
                        2008-06-23 14:56 670720 4e00327da458beffea8f4b222f466b20 C:\WINDOWS\SoftwareDistribution\Download\[u]0[/u]8226861086a18779ae960326e29c1a3\sp3qfe\wininet.dll
                        2004-08-19 16:09 660480 4e958b97efc3d801f49283d1820f48b7 C:\WINDOWS\$NtUninstallKB939653$\wininet.dll
                        2007-10-11 06:13 663552 d2fd027e5d3af96dee6c5cc225079df0 C:\WINDOWS\$NtUninstallKB944533$\wininet.dll
                        2007-12-07 01:07 663552 c5a40de381481d288addee45fc67f652 C:\WINDOWS\$NtUninstallKB947864$\wininet.dll
                        2008-02-16 09:02 663552 c9218cd3cd93586ffe9ae789282cae63 C:\WINDOWS\$NtUninstallKB950759$\wininet.dll
                        2007-08-22 13:13 663040 18048557aa56de4b1955fdf7a21f9b24 C:\WINDOWS\$NtUninstallKB942615$\wininet.dll
                        2008-04-21 07:02 663552 355a69cc05045428ce6b9e6bfbd4b74b C:\WINDOWS\$NtUninstallKB953838$\wininet.dll

                        2008-06-20 10:45 360320 2a5554fc5b1e04e131230e3ce035c3f9 C:\WINDOWS\system32\drivers\tcpip.sys
                        2008-06-20 10:45 360320 2a5554fc5b1e04e131230e3ce035c3f9 C:\WINDOWS\system32\dllcache\tcpip.sys
                        2006-04-20 12:18 360576 b2220c618b42a2212a59d91ebd6fc4b4 C:\WINDOWS\$hf_mig$\KB917953\SP2QFE\tcpip.sys
                        2007-10-30 16:53 360832 64798ecfa43d78c7178375fcdd16d8c8 C:\WINDOWS\$hf_mig$\KB941644\SP2QFE\tcpip.sys
                        2008-06-20 10:44 360960 744e57c99232201ae98c49168b918f48 C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\tcpip.sys
                        2008-06-20 11:51 361600 9aefa14bd6b182d61e3119fa5f436d3d C:\WINDOWS\$hf_mig$\KB951748\SP3GDR\tcpip.sys
                        2008-06-20 11:59 361600 ad978a1b783b5719720cff204b666c8e C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\tcpip.sys
                        2004-08-03 23:14 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\$NtUninstallKB917953$\tcpip.sys
                        2006-04-20 11:51 359808 1dbf125862891817f374f407626967f4 C:\WINDOWS\$NtUninstallKB941644$\tcpip.sys
                        2007-10-30 17:20 360064 90caff4b094573449a0872a0f919b178 C:\WINDOWS\$NtUninstallKB951748$\tcpip.sys

                        2004-08-19 16:10 506368 123eea158f74d0f67a51dcdf065d1091 C:\WINDOWS\system32\winlogon.exe
                        2004-08-19 16:10 506368 123eea158f74d0f67a51dcdf065d1091 C:\WINDOWS\system32\dllcache\winlogon.exe

                        2004-08-03 23:14 182912 558635d3af1c7546d26067d5d9b6959e C:\WINDOWS\system32\drivers\ndis.sys
                        2004-08-03 23:14 182912 558635d3af1c7546d26067d5d9b6959e C:\WINDOWS\system32\dllcache\ndis.sys

                        2007-02-28 16:02 2059648 a1d5231403329478ae4fe2778c55c77f C:\WINDOWS\system32\ntkrnlpa.exe
                        2007-02-28 16:02 2059648 a1d5231403329478ae4fe2778c55c77f C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
                        2007-02-28 16:02 2059648 a1d5231403329478ae4fe2778c55c77f C:\WINDOWS\Driver Cache\i386\ntkrnlpa.exe
                        2005-03-02 18:13 2059008 5311776074b6c13f983dc75baeac9c0c C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\ntkrnlpa.exe
                        2007-02-28 16:08 2061440 7a56a64eb50399613587e90292dd2aab C:\WINDOWS\$hf_mig$\KB931784\SP2QFE\ntkrnlpa.exe
                        2004-08-19 16:20 2058880 f252fae094c54572ece38a039f2103c4 C:\WINDOWS\$NtUninstallKB931784$\ntkrnlpa.exe

                        2007-02-28 16:02 2182400 7d6d19aac51a4325f6039f083c22303c C:\WINDOWS\system32\ntoskrnl.exe
                        2007-02-28 16:02 2182400 7d6d19aac51a4325f6039f083c22303c C:\WINDOWS\system32\dllcache\ntoskrnl.exe
                        2007-02-28 16:02 2182400 7d6d19aac51a4325f6039f083c22303c C:\WINDOWS\Driver Cache\i386\ntoskrnl.exe
                        2005-03-02 18:13 2181632 3e2a0a4a0c0b19fc113618a9562a3b2a C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe
                        2007-02-28 16:08 2184192 8e244108562e0e452eb68dff64cb08a9 C:\WINDOWS\$hf_mig$\KB931784\SP2QFE\ntoskrnl.exe
                        2004-08-19 16:04 2183040 7d38ce4398e6aa6339b4644feadcc0d8 C:\WINDOWS\$NtUninstallKB931784$\ntoskrnl.exe

                        2007-06-13 13:22 1037312 d0288319660edcfed07c7e74c4ea38a5 C:\WINDOWS\explorer.exe
                        2007-06-13 13:22 1037312 d0288319660edcfed07c7e74c4ea38a5 C:\WINDOWS\system32\dllcache\explorer.exe
                        2007-06-13 13:10 1037312 b795475444d6d57a572c14b9e1a29839 C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
                        2004-08-22 22:35 1036288 998f3f568f6074a35ab08cd3395a9dc2 C:\WINDOWS\$NtUninstallKB938828$\explorer.exe

                        2004-08-19 16:10 108544 63dcde1a0d86eeb8924d6738ff616ead C:\WINDOWS\system32\services.exe
                        2004-08-19 16:10 108544 63dcde1a0d86eeb8924d6738ff616ead C:\WINDOWS\system32\dllcache\services.exe

                        2004-08-19 16:09 13312 259af82a0932eea4f316f92db94707b6 C:\WINDOWS\system32\lsass.exe
                        2004-08-19 16:09 13312 259af82a0932eea4f316f92db94707b6 C:\WINDOWS\system32\dllcache\lsass.exe

                        2004-08-19 16:09 15360 64e41e8fee655b03e3f19ded21ba5118 C:\WINDOWS\system32\ctfmon.exe
                        2004-08-19 16:09 15360 64e41e8fee655b03e3f19ded21ba5118 C:\WINDOWS\system32\dllcache\ctfmon.exe

                        2005-06-10 23:53 57856 da81ec57acd4cdc3d4c51cf3d409af9f C:\WINDOWS\system32\spoolsv.exe
                        2005-06-10 23:53 57856 da81ec57acd4cdc3d4c51cf3d409af9f C:\WINDOWS\system32\dllcache\spoolsv.exe
                        2005-06-11 00:17 57856 ad3d9d191aea7b5445fe1d82ffbb4788 C:\WINDOWS\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
                        2004-08-19 16:10 57856 df9fc62ad51cb082b0ae371919a232cb C:\WINDOWS\$NtUninstallKB896423$\spoolsv.exe

                        2007-07-30 19:19 53080 f3e9065eb617a7e3a832a7976bfa021b C:\WINDOWS\system32\wuauclt.exe
                        2007-07-30 19:19 53080 f3e9065eb617a7e3a832a7976bfa021b C:\WINDOWS\system32\dllcache\wuauclt.exe

                        2004-08-19 16:10 25088 84717891f0734c611721f56c60b5fbc3 C:\WINDOWS\system32\userinit.exe
                        2004-08-19 16:10 25088 84717891f0734c611721f56c60b5fbc3 C:\WINDOWS\system32\dllcache\userinit.exe
                        .
                        -- Snapshot reset to current date --
                        .
                        ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
                        .
                        .
                        REGEDIT4
                        *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

                        [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                        "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 16:09 15360]
                        "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]

                        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                        "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
                        "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-18 22:35 266497]
                        "Glock Suite 1.1"="C:\WINDOWS\system32\glock32.exe" [2004-08-19 16:09 13312]
                        "Restart"="" [BU]
                        "C-Media Mixer"="Mixer.exe" [2002-07-12 16:33 1581056 C:\WINDOWS\mixer.exe]

                        [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                        "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 16:09 15360]

                        [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
                        "FlashPlayerUpdate"="C:\WINDOWS\system32\Macromed\Flash\FlashUtil9d.exe" [2007-06-11 20:04 190696]

                        [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
                        "NoDispBackgroundPage"= 1 (0x1)
                        "NoDispScrSavPage"= 1 (0x1)

                        [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
                        "UIHost"=hex(2):6c,6f,67,6f,6e,75,69,32,2e,65,78,65,00

                        [HKEY_LOCAL_MACHINE\software\microsoft\security center]
                        "UpdatesDisableNotify"=dword:00000001
                        "FirewallOverride"=dword:00000001
                        "AntiVirusOverride"=dword:00000001
                        "AntiVirusDisableNotify"=dword:00000001

                        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
                        "EnableFirewall"= 0 (0x0)
                        "DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

                        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                        "%windir%\\system32\\sessmgr.exe"=
                        "C:\\Program Files\\Yahoo!\\Messenger\\YPager.exe"=
                        "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
                        "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
                        "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

                        R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys [2005-12-15 18:13]
                        R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys [2005-12-15 18:01]
                        S0 Twa36;Twa36;C:\WINDOWS\system32\Drivers\Twa36.sys []
                        .
                        Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'

                        2008-08-17 C:\WINDOWS\Tasks\B853381C9188DEB8.job
                        - c:\docume~1\iiman3~1.000\applic~1\typeli~1\Web more loud.exe []
                        .
                        - - - - ORPHANS REMOVED - - - -

                        HKLM-Run-ctfdll32 - C:\WINDOWS\System32\Ctfdll32.exe
                        Notify-bzzmotg - bzzmotg.dll
                        MSConfigStartUp-MyWebSearch Plugin - C:\PROGRA~1\MYWEBS~1\bar\2.bin\M3PLUGIN.DLL

                        **************************************************************************

                        catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                        Rootkit scan 2008-08-17 20:48:29
                        Windows 5.1.2600 Service Pack 2 FAT NTAPI

                        Balayage processus cach‚s ...

                        Balayage cach‚ autostart entries ...

                        Balayage des fichiers cach‚s ...

                        Scan termin‚ avec succŠs
                        Les fichiers cach‚s: 0

                        **************************************************************************

                        [HKEY_LOCAL_MACHINE\system\ControlSet002\Services\Bfi47]
                        "ImagePath"="System32\Drivers\Bfi47.sys"

                        [HKEY_LOCAL_MACHINE\system\ControlSet002\Services\bgK61]
                        "ImagePath"="System32\Drivers\bgK61.sys"
                        0
                        1. imn12 Auteur
                          Voici le rapport :
                          ComboFix 08-08-16.01 - iiMAN3 2008-08-17 20:11:37.2 - [color=red][b]FAT32[/b][/color]x86
                          Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.50 [GMT 0:00]
                          Endroit: C:\Documents and Settings\iiMAN3.INTERNET.000\Bureau\ComboFix.exe
                          Command switches used :: C:\Documents and Settings\iiMAN3.INTERNET.000\Bureau\CFScript.txt
                          * Création d'un nouveau point de restauration

                          [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]

                          FILE ::
                          C:\Documents and Settings\Brahim\cbOCR.dll
                          C:\Documents and Settings\iiMAN3.INTERNET.000\cbOCR.dll
                          C:\Documents and Settings\iiMAN3.INTERNET\cbOCR.dll
                          C:\Documents and Settings\iiMAN3\cbOCR.dll
                          C:\WINDOWS\SYSTEM32\bzzmotg.dll
                          C:\WINDOWS\system32\Ctfdll32.exe
                          C:\WINDOWS\system32\Drivers\Bfi47.sys
                          C:\WINDOWS\system32\Drivers\bgK61.sys
                          C:\WINDOWS\system32\Drivers\Cgi82.sys
                          C:\WINDOWS\system32\Drivers\Dgj03.sys
                          C:\WINDOWS\system32\Drivers\Ehk60.sys
                          C:\WINDOWS\system32\Drivers\flP60.sys
                          C:\WINDOWS\system32\Drivers\glP60.sys
                          C:\WINDOWS\system32\Drivers\Jmp14.sys
                          C:\WINDOWS\system32\Drivers\joS50.sys
                          C:\WINDOWS\system32\Drivers\Lqu71.sys
                          C:\WINDOWS\system32\drivers\nkv2.sys
                          C:\WINDOWS\system32\Drivers\Nqt03.sys
                          C:\WINDOWS\system32\Drivers\nsV47.sys
                          C:\WINDOWS\system32\Drivers\otW72.sys
                          C:\WINDOWS\system32\Drivers\ouY71.sys
                          C:\WINDOWS\system32\Drivers\Svy61.sys
                          C:\WINDOWS\system32\Drivers\Uyc24.sys
                          C:\WINDOWS\system32\Drivers\Uyc68.sys
                          C:\WINDOWS\system32\Drivers\Xcf03.sys
                          C:\WINDOWS\system32\Drivers\Ydg24.sys
                          C:\WINDOWS\system32\lphc3bej0e3dr.exe
                          C:\WINDOWS\system32\noskrnl.sys
                          C:\WINDOWS\system32\WinNt32.dll
                          .

                          (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
                          .

                          C:\DOCUME~1\IIMAN3~1.000\APPLIC~1\TYPELI~1
                          C:\DOCUME~1\IIMAN3~1.000\APPLIC~1\TYPELI~1\[u]0[/u]
                          C:\DOCUME~1\IIMAN3~1.000\APPLIC~1\TYPELI~1\ckzpaknq.exe
                          C:\DOCUME~1\IIMAN3~1.000\APPLIC~1\TYPELI~1\hoyrynol.exe
                          C:\DOCUME~1\IIMAN3~1.000\APPLIC~1\TYPELI~1\plwpbazf.exe
                          C:\DOCUME~1\IIMAN3~1.000\APPLIC~1\TYPELI~1\SectOkayModeSixth.exe
                          C:\Documents and Settings\All Users\Application Data\Frag great bend logo
                          C:\Documents and Settings\All Users\Application Data\Frag great bend logo\copy logo.exe
                          C:\Documents and Settings\Brahim\Application Data\Microsoft\SystemCertificates\My
                          C:\Documents and Settings\Brahim\cbOCR.dll
                          C:\Documents and Settings\Brahim\Cookies\brahim@a[2].txt
                          C:\Documents and Settings\iiMAN3.INTERNET.000\cbOCR.dll
                          C:\Documents and Settings\iiMAN3.INTERNET\cbOCR.dll
                          C:\Documents and Settings\iiMAN3\cbOCR.dll
                          C:\Program Files\typelitemeal
                          C:\WINDOWS\SYSTEM32\bzzmotg.dll
                          C:\WINDOWS\system32\Ctfdll32.exe
                          .
                          ---- Previous Run -------
                          .
                          C:\DEL.bat
                          C:\Documents and Settings\Administrateur\Application Data\Microsoft\SystemCertificates\My
                          C:\Documents and Settings\Administrateur\Cookies\administrateur@promobenef[2].txt
                          C:\Documents and Settings\Administrateur\Cookies\administrateur@seriestreaming[2].txt
                          C:\Documents and Settings\All Users\Bureau\Antivirus XP 2008.lnk
                          C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008
                          C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008\Antivirus XP 2008.lnk
                          C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008\How to Register Antivirus XP 2008.lnk
                          C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008\License Agreement.lnk
                          C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008\Register Antivirus XP 2008.lnk
                          C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008\Uninstall.lnk
                          C:\Documents and Settings\Brahim\Application Data\rhc7bej0e3dr
                          C:\Documents and Settings\Brahim\Cookies\brahim@a[2].txt
                          C:\Documents and Settings\Brahim\Cookies\brahim@bluestreak[1].txt
                          C:\Documents and Settings\Brahim\Cookies\brahim@edt02[1].txt
                          C:\Documents and Settings\Brahim\Cookies\brahim@mywebsearch[2].txt
                          C:\Documents and Settings\Brahim\Cookies\brahim@www.clubteenpix[1].txt
                          C:\Documents and Settings\Brahim\Cookies\brahim@www.pixmania[1].txt
                          C:\Documents and Settings\Brahim\Cookies\brahim@www.toutpourlamicro[1].txt
                          C:\Documents and Settings\iiMAN3.INTERNET.000\Application Data\FunWebProducts
                          C:\Documents and Settings\iiMAN3.INTERNET.000\Application Data\FunWebProducts\Data\iiMAN3\avatar.dat
                          C:\Documents and Settings\iiMAN3.INTERNET.000\Application Data\rhc7bej0e3dr
                          C:\Documents and Settings\iiMAN3.INTERNET\Application Data\Microsoft\SystemCertificates\My
                          C:\Documents and Settings\iiMAN3.INTERNET\Cookies\iiman3@promobenef[2].txt
                          C:\Documents and Settings\iiMAN3\Application Data\Microsoft\SystemCertificates\My
                          C:\Documents and Settings\iiMAN3\Cookies\iiman3@promobenef[2].txt
                          C:\Documents and Settings\iiMAN3\Cookies\iiman3@www.toutpourlamicro[2].txt
                          C:\Documents and Settings\Invité\Application Data\Microsoft\SystemCertificates\My
                          C:\Documents and Settings\Invité\Cookies\invité@ad.yieldmanager[1].txt
                          C:\Documents and Settings\Invité\Cookies\invité@edt02[2].txt
                          C:\Documents and Settings\Invité\Cookies\invité@promobenef[1].txt
                          C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My
                          C:\Documents and Settings\mona81096\Application Data\Microsoft\SystemCertificates\My
                          C:\Documents and Settings\mona81096\Cookies\mona81096@promobenef[2].txt
                          C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My
                          C:\Program Files\FunWebProducts
                          C:\Program Files\FunWebProducts\Shared\Cache\AvatarSmallBtn.html
                          C:\Program Files\FunWebProducts\Shared\Cache\CursorManiaBtn.html
                          C:\Program Files\FunWebProducts\Shared\Cache\FunBuddyIconBtn.html
                          C:\Program Files\FunWebProducts\Shared\Cache\MailStampBtn.htmlx
                          C:\Program Files\FunWebProducts\Shared\Cache\MyFunCardsIMBtn.html
                          C:\Program Files\FunWebProducts\Shared\Cache\MyStationeryBtn.htmlx
                          C:\Program Files\FunWebProducts\Shared\Cache\SmileyCentralBtn.html
                          C:\Program Files\internet explorer\msimg32.dll
                          C:\Program Files\MyWebSearch
                          C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
                          C:\Program Files\MyWebSearch\bar\1.bin\MWSOESTB.DLL
                          C:\Program Files\MyWebSearch\bar\2.bin\F3BKGERR.JPG
                          C:\Program Files\MyWebSearch\bar\2.bin\F3CJPEG.DLL
                          C:\Program Files\MyWebSearch\bar\2.bin\F3DTACTL.DLL
                          C:\Program Files\MyWebSearch\bar\2.bin\F3HISTSW.DLL
                          C:\Program Files\MyWebSearch\bar\2.bin\F3HTMLMU.DLL
                          C:\Program Files\MyWebSearch\bar\2.bin\F3HTTPCT.DLL
                          C:\Program Files\MyWebSearch\bar\2.bin\F3IMSTUB.DLL
                          C:\Program Files\MyWebSearch\bar\2.bin\F3POPSWT.DLL
                          C:\Program Files\MyWebSearch\bar\2.bin\F3PSSAVR.SCR
                          C:\Program Files\MyWebSearch\bar\2.bin\F3REPROX.DLL
                          C:\Program Files\MyWebSearch\bar\2.bin\F3RESTUB.DLL
                          C:\Program Files\MyWebSearch\bar\2.bin\F3SCHMON.EXE
                          C:\Program Files\MyWebSearch\bar\2.bin\F3SCRCTR.DLL
                          C:\Program Files\MyWebSearch\bar\2.bin\F3SPACER.WMV
                          C:\Program Files\MyWebSearch\bar\2.bin\F3WALLPP.DAT
                          C:\Program Files\MyWebSearch\bar\2.bin\F3WPHOOK.DLL
                          C:\Program Files\MyWebSearch\bar\2.bin\FWPBUDDY.PNG
                          C:\Program Files\MyWebSearch\bar\2.bin\M3FFXTBR.JAR
                          C:\Program Files\MyWebSearch\bar\2.bin\M3FFXTBR.MANIFEST
                          C:\Program Files\MyWebSearch\bar\2.bin\M3HIGHIN.EXE
                          C:\Program Files\MyWebSearch\bar\2.bin\M3HTML.DLL
                          C:\Program Files\MyWebSearch\bar\2.bin\M3IDLE.DLL
                          C:\Program Files\MyWebSearch\bar\2.bin\M3IMPIPE.EXE
                          C:\Program Files\MyWebSearch\bar\2.bin\M3MEDINT.EXE
                          C:\Program Files\MyWebSearch\bar\2.bin\M3MSG.DLL
                          C:\Program Files\MyWebSearch\bar\2.bin\M3NTSTBR.JAR
                          C:\Program Files\MyWebSearch\bar\2.bin\M3NTSTBR.MANIFEST
                          C:\Program Files\MyWebSearch\bar\2.bin\M3OUTLCN.DLL
                          C:\Program Files\MyWebSearch\bar\2.bin\M3PLUGIN.DLL
                          C:\Program Files\MyWebSearch\bar\2.bin\M3SKIN.DLL
                          C:\Program Files\MyWebSearch\bar\2.bin\M3SKPLAY.EXE
                          C:\Program Files\MyWebSearch\bar\2.bin\M3SLSRCH.EXE
                          C:\Program Files\MyWebSearch\bar\2.bin\M3SRCHMN.EXE
                          C:\Program Files\MyWebSearch\bar\2.bin\MWSBAR.DLL
                          C:\Program Files\MyWebSearch\bar\2.bin\MWSOEMON.EXE
                          C:\Program Files\MyWebSearch\bar\2.bin\MWSOEPLG.DLL
                          C:\Program Files\MyWebSearch\bar\2.bin\MWSOESTB.DLL
                          C:\Program Files\MyWebSearch\bar\2.bin\MWSSVC.EXE
                          C:\Program Files\MyWebSearch\bar\2.bin\NPMYWEBS.DLL
                          C:\Program Files\MyWebSearch\bar\Avatar\COMMON.F3S
                          C:\Program Files\MyWebSearch\bar\Avatar\COMMON\avatar.htm
                          C:\Program Files\MyWebSearch\bar\Avatar\COMMON\bgfadel.gif
                          C:\Program Files\MyWebSearch\bar\Avatar\COMMON\bgfader.gif
                          C:\Program Files\MyWebSearch\bar\Avatar\COMMON\common-x.css
                          C:\Program Files\MyWebSearch\bar\Avatar\COMMON\common.css
                          C:\Program Files\MyWebSearch\bar\Avatar\COMMON\cornerbl.gif
                          C:\Program Files\MyWebSearch\bar\Avatar\COMMON\cornerbr.gif
                          C:\Program Files\MyWebSearch\bar\Avatar\COMMON\ext_def.gif
                          C:\Program Files\MyWebSearch\bar\Avatar\COMMON\ext_roll.gif
                          C:\Program Files\MyWebSearch\bar\Avatar\COMMON\include.js
                          C:\Program Files\MyWebSearch\bar\Avatar\COMMON\index.htm
                          C:\Program Files\MyWebSearch\bar\Avatar\COMMON\loader.htm
                          C:\Program Files\MyWebSearch\bar\Avatar\COMMON\loading.gif
                          C:\Program Files\MyWebSearch\bar\Avatar\COMMON\logo.gif
                          C:\Program Files\MyWebSearch\bar\Avatar\COMMON\max_def.gif
                          C:\Program Files\MyWebSearch\bar\Avatar\COMMON\max_roll.gif
                          C:\Program Files\MyWebSearch\bar\Avatar\COMMON\min_def.gif
                          C:\Program Files\MyWebSearch\bar\Avatar\COMMON\min_roll.gif
                          C:\Program Files\MyWebSearch\bar\Avatar\COMMON\noflash.htm
                          C:\Program Files\MyWebSearch\bar\Avatar\COMMON\res_def.gif
                          C:\Program Files\MyWebSearch\bar\Avatar\COMMON\res_roll.gif
                          C:\Program Files\MyWebSearch\bar\Avatar\COMMON\spacer.gif
                          C:\Program Files\MyWebSearch\bar\Avatar\COMMON\spacer.swf
                          C:\Program Files\MyWebSearch\bar\Avatar\COMMON\topgrad.gif
                          C:\Program Files\MyWebSearch\bar\Avatar\COMMON\window.ico
                          C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]0033F9A
                          C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]005D430
                          C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]005DBB1
                          C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]008C220
                          C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]028E898
                          C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]037C78A
                          C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]04C6782
                          C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]04C7136.bin
                          C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]04C74D0.bin
                          C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]04C7760.bin
                          C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]04C7D6B.bin
                          C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]04C9B73.bin
                          C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]0B1A6D2.bin
                          C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]0B1A9A0.bin
                          C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]0B1AE25.bin
                          C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]0B1B384.bin
                          C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]0B1B549.bin
                          C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]0B9BF64.bin
                          C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]0B9C1E4.bin
                          C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]0B9C3AA.bin
                          C:\Program Files\MyWebSearch\bar\Cache\files.ini
                          C:\Program Files\MyWebSearch\bar\Game\CHECKERS.F3S
                          C:\Program Files\MyWebSearch\bar\Game\CHESS.F3S
                          C:\Program Files\MyWebSearch\bar\Game\REVERSI.F3S
                          C:\Program Files\MyWebSearch\bar\History\search3
                          C:\Program Files\MyWebSearch\bar\icons\CM.ICO
                          C:\Program Files\MyWebSearch\bar\icons\MFC.ICO
                          C:\Program Files\MyWebSearch\bar\icons\PSS.ICO
                          C:\Program Files\MyWebSearch\bar\icons\SMILEY.ICO
                          C:\Program Files\MyWebSearch\bar\icons\WB.ICO
                          C:\Program Files\MyWebSearch\bar\icons\ZWINKY.ICO
                          C:\Program Files\MyWebSearch\bar\Message\COMMON.F3S
                          C:\Program Files\MyWebSearch\bar\Notifier\COMMON.F3S
                          C:\Program Files\MyWebSearch\bar\Notifier\DOG.F3S
                          C:\Program Files\MyWebSearch\bar\Notifier\FISH.F3S
                          C:\Program Files\MyWebSearch\bar\Notifier\KUNGFU.F3S
                          C:\Program Files\MyWebSearch\bar\Notifier\LIFEGARD.F3S
                          C:\Program Files\MyWebSearch\bar\Notifier\MAID.F3S
                          C:\Program Files\MyWebSearch\bar\Notifier\MAILBOX.F3S
                          C:\Program Files\MyWebSearch\bar\Notifier\OPERA.F3S
                          C:\Program Files\MyWebSearch\bar\Notifier\ROBOT.F3S
                          C:\Program Files\MyWebSearch\bar\Notifier\SEDUCT.F3S
                          C:\Program Files\MyWebSearch\bar\Notifier\SURFER.F3S
                          C:\Program Files\MyWebSearch\bar\Settings\prevcfg2.htm
                          C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat
                          C:\Program Files\MyWebSearch\SrchAstt\2.bin\MWSSRCAS.DLL
                          C:\Program Files\rhc7bej0e3dr
                          C:\WINDOWS\doll104.exe
                          C:\WINDOWS\doll119.exe
                          C:\WINDOWS\doll120.exe
                          C:\WINDOWS\doll123.exe
                          C:\WINDOWS\doll126.exe
                          C:\WINDOWS\doll128.exe
                          C:\WINDOWS\doll132.exe
                          C:\WINDOWS\doll137.exe
                          C:\WINDOWS\doll138.exe
                          C:\WINDOWS\doll143.exe
                          C:\WINDOWS\doll144.exe
                          C:\WINDOWS\doll148.exe
                          C:\WINDOWS\doll151.exe
                          C:\WINDOWS\doll152.exe
                          C:\WINDOWS\doll154.exe
                          C:\WINDOWS\doll155.exe
                          C:\WINDOWS\doll157.exe
                          C:\WINDOWS\doll159.exe
                          C:\WINDOWS\doll161.exe
                          C:\WINDOWS\doll166.exe
                          C:\WINDOWS\doll167.exe
                          C:\WINDOWS\doll176.exe
                          C:\WINDOWS\doll181.exe
                          C:\WINDOWS\doll185.exe
                          C:\WINDOWS\doll191.exe
                          C:\WINDOWS\doll194.exe
                          C:\WINDOWS\doll196.exe
                          C:\WINDOWS\doll197.exe
                          C:\WINDOWS\drabste.exe
                          C:\WINDOWS\draste.exe
                          C:\WINDOWS\glok+3ca-59fa.sys
                          C:\WINDOWS\glok+serv.config
                          C:\WINDOWS\ksacre.exe
                          C:\WINDOWS\system32\[u]0[/u]_exception.nls
                          C:\WINDOWS\system32\1.tmp
                          C:\WINDOWS\system32\blphc3bej0e3dr.scr
                          C:\WINDOWS\system32\drivers\ctl_w32.sys
                          c:\windows\system32\Drivers\Jnq72.sys
                          C:\WINDOWS\system32\f3PSSavr.scr
                          C:\WINDOWS\system32\koos.exe
                          C:\WINDOWS\system32\kprof
                          C:\WINDOWS\system32\lphc3bej0e3dr.exe
                          C:\WINDOWS\system32\phc3bej0e3dr.bmp
                          C:\WINDOWS\system32\poof
                          C:\WINDOWS\system32\pphc3bej0e3dr.exe
                          C:\WINDOWS\system32\WinCtrl32.dll
                          C:\WINDOWS\system32\WinData.cab
                          C:\WINDOWS\system32\WinNt32.dll
                          C:\WINDOWS\system32\WLCtrl32.dll
                          C:\WINDOWS\system32\WinNt32.dll . . . . Echec de suppression

                          .
                          ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
                          .

                          -------\Legacy_CTL_W32
                          -------\Legacy_ICF
                          -------\Legacy_JNQ72
                          -------\Legacy_MYWEBSEARCHSERVICE
                          -------\Legacy_NTIO256
                          -------\Legacy_POOF
                          -------\Legacy_RUNTIME
                          -------\Legacy_SMTPDRV
                          -------\Legacy_TCPSR
                          -------\Legacy_XLAVBA8
                          -------\Service_ICF
                          -------\Service_Jnq72
                          -------\Service_kprof
                          -------\Service_MyWebSearchService
                          -------\Service_ntio256
                          -------\Service_poof
                          -------\Service_runtime
                          -------\Service_tcpsr
                          -------\Service_xlavba8
                          -------\Legacy_LQU71
                          -------\Legacy_USB2_04
                          -------\Legacy_UYC24
                          -------\Service_Bfi47
                          -------\Service_bgK61
                          -------\Service_Cgi82
                          -------\Service_ctl_w32
                          -------\Service_Dgj03
                          -------\Service_Ehk60
                          -------\Service_flP60
                          -------\Service_glP60
                          -------\Service_Jmp14
                          -------\Service_joS50
                          -------\Service_Lqu71
                          -------\Service_noskrnl.sys
                          -------\Service_Nqt03
                          -------\Service_nsV47
                          -------\Service_otW72
                          -------\Service_ouY71
                          -------\Service_Svy61
                          -------\Service_USB2_04
                          -------\Service_Uyc24
                          -------\Service_Uyc68
                          -------\Service_Xcf03
                          -------\Service_Ydg24

                          ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-07-17 to 2008-08-17 ))))))))))))))))))))))))))))))))))))
                          .

                          2008-08-14 14:16 . 2008-08-14 14:16 <REP> d--hs---- C:\FOUND.098
                          2008-08-13 15:47 . 2008-08-13 15:47 <REP> d--hs---- C:\FOUND.097
                          2008-08-13 10:00 . 2008-08-13 10:00 <REP> d--hs---- C:\FOUND.096
                          2008-07-21 20:29 . 2008-07-21 20:29 <REP> d--hs---- C:\FOUND.093
                          2008-07-19 17:49 . 2008-07-19 17:49 <REP> d--hs---- C:\FOUND.092

                          .
                          (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                          .
                          2008-07-07 20:31 253,952 ----a-w C:\WINDOWS\system32\es.dll
                          2008-07-07 20:31 253,952 ----a-w C:\WINDOWS\system32\dllcache\es.dll
                          2008-06-30 14:40 --------- d-----w C:\Program Files\Bitmanagement Software
                          2008-06-29 13:15 192,512 ----a-w C:\WINDOWS\system32\cbOCR.dll
                          2008-06-25 16:55 979 ----a-w C:\WINDOWS\system32\drivers\fwdrv.err
                          2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
                          2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\dllcache\mscms.dll
                          2008-06-23 15:39 152,064 ----a-w C:\WINDOWS\system32\dllcache\cdfview.dll
                          2008-06-23 15:39 1,024,000 ----a-w C:\WINDOWS\system32\dllcache\browseui.dll
                          2008-06-23 09:49 18,432 ----a-w C:\WINDOWS\system32\dllcache\iedw.exe
                          2008-06-20 23:11 148,992 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
                          2008-06-20 17:41 247,808 ----a-w C:\WINDOWS\system32\mswsock.dll
                          2008-06-20 17:41 247,808 ----a-w C:\WINDOWS\system32\dllcache\mswsock.dll
                          2008-06-20 15:22 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
                          2008-06-20 15:22 225,920 ----a-w C:\WINDOWS\system32\dllcache\tcpip6.sys
                          2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
                          2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\dllcache\tcpip.sys
                          2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
                          2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\dllcache\afd.sys
                          2008-06-14 17:59 272,768 ------w C:\WINDOWS\system32\dllcache\bthport.sys
                          2008-04-19 11:24 2,402,832 ----a-w C:\Program Files\WLinstaller.exe1.exe
                          2008-04-06 18:04 6,116,304 ----a-w C:\Program Files\Firefox Setup 2.0.0.13.exe
                          2005-02-19 10:20 490 ----a-r C:\Program Files\mIRC32.lnk
                          2002-01-05 05:11 2,293,848 ----a-w C:\Program Files\FLV PlayerFCSetup.exe
                          2002-01-05 05:09 4,265,560 ----a-w C:\Program Files\FLV PlayerRCATSetup.exe
                          2002-01-05 04:49 411,248 ----a-w C:\Program Files\FLV PlayerRCSetup.exe
                          .

                          ------- Sigcheck -------

                          2004-08-19 16:10 14336 2979b03d5382a602623c0535b16ab9c0 C:\WINDOWS\system32\svchost.exe
                          2004-08-19 16:10 14336 2979b03d5382a602623c0535b16ab9c0 C:\WINDOWS\system32\dllcache\svchost.exe

                          2007-03-08 15:37 578560 753354f594809a9b96f73999b435a533 C:\WINDOWS\system32\user32.dll
                          2007-03-08 15:37 578560 753354f594809a9b96f73999b435a533 C:\WINDOWS\system32\dllcache\user32.dll
                          2005-03-02 18:20 578048 c34920eb988ce98910bd6b0417f334eb C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\user32.dll
                          2007-03-08 15:50 579072 4d88aaf39adabfe45958ea1384e2c4ff C:\WINDOWS\$hf_mig$\KB925902\SP2QFE\user32.dll
                          2004-08-19 16:09 578048 61c8c283ad063bb697ae61a155c64a5a C:\WINDOWS\$NtUninstallKB890859$\user32.dll
                          2005-03-02 18:10 578048 0df75fb73f705b011630159a43d7c354 C:\WINDOWS\$NtUninstallKB925902$\user32.dll

                          2004-08-19 16:09 82944 eed74b969b2ca1acc558ff60fb420e28 C:\WINDOWS\system32\ws2_32.dll
                          2004-08-19 16:09 82944 eed74b969b2ca1acc558ff60fb420e28 C:\WINDOWS\system32\dllcache\ws2_32.dll

                          2008-06-23 15:40 663552 95d92788889b847309c63e2ec287d1c0 C:\WINDOWS\system32\wininet.dll
                          2008-06-23 15:40 663552 95d92788889b847309c63e2ec287d1c0 C:\WINDOWS\system32\dllcache\wininet.dll
                          2007-08-22 12:57 669696 4f6a45b54d26708e2c2bf2c43d83edea C:\WINDOWS\$hf_mig$\KB939653\SP2QFE\wininet.dll
                          2007-10-11 05:59 670208 0465cde31add22f6233ffb4fe4af01cf C:\WINDOWS\$hf_mig$\KB942615\SP2QFE\wininet.dll
                          2007-12-07 00:47 670208 c057d734b1951393fd07e2607513d4d9 C:\WINDOWS\$hf_mig$\KB944533\SP2QFE\wininet.dll
                          2008-02-16 09:32 670208 dcb8a9f102663d962be60cde38a6c1d7 C:\WINDOWS\$hf_mig$\KB947864\SP2QFE\wininet.dll
                          2008-04-21 06:57 670720 f2f343d7ed0223645ba773b840eb4993 C:\WINDOWS\$hf_mig$\KB950759\SP2QFE\wininet.dll
                          2008-04-21 06:43 670208 7af7d7d178f2863e7e7c880b55c88b76 C:\WINDOWS\$hf_mig$\KB950759\SP3GDR\wininet.dll
                          2008-04-21 06:30 670720 82b3264706b9921c67b196319fda51de C:\WINDOWS\$hf_mig$\KB950759\SP3QFE\wininet.dll
                          2008-06-23 16:15 671232 8ca18fd7cccabff7e84702bc1bbf5dcb C:\WINDOWS\$hf_mig$\KB953838\SP2QFE\wininet.dll
                          2008-06-23 15:10 670208 d2177655bc338a07b99913f6a4bed52d C:\WINDOWS\$hf_mig$\KB953838\SP3GDR\wininet.dll
                          2008-06-23 14:56 670720 4e00327da458beffea8f4b222f466b20 C:\WINDOWS\$hf_mig$\KB953838\SP3QFE\wininet.dll
                          2008-06-23 15:40 663552 95d92788889b847309c63e2ec287d1c0 C:\WINDOWS\SoftwareDistribution\Download\[u]0[/u]8226861086a18779ae960326e29c1a3\sp2gdr\wininet.dll
                          2008-06-23 16:15 671232 8ca18fd7cccabff7e84702bc1bbf5dcb C:\WINDOWS\SoftwareDistribution\Download\[u]0[/u]8226861086a18779ae960326e29c1a3\sp2qfe\wininet.dll
                          2008-06-23 15:10 670208 d2177655bc338a07b99913f6a4bed52d C:\WINDOWS\SoftwareDistribution\Download\[u]0[/u]8226861086a18779ae960326e29c1a3\sp3gdr\wininet.dll
                          2008-06-23 14:56 670720 4e00327da458beffea8f4b222f466b20 C:\WINDOWS\SoftwareDistribution\Download\[u]0[/u]8226861086a18779ae960326e29c1a3\sp3qfe\wininet.dll
                          2004-08-19 16:09 660480 4e958b97efc3d801f49283d1820f48b7 C:\WINDOWS\$NtUninstallKB939653$\wininet.dll
                          2007-10-11 06:13 663552 d2fd027e5d3af96dee6c5cc225079df0 C:\WINDOWS\$NtUninstallKB944533$\wininet.dll
                          2007-12-07 01:07 663552 c5a40de381481d288addee45fc67f652 C:\WINDOWS\$NtUninstallKB947864$\wininet.dll
                          2008-02-16 09:02 663552 c9218cd3cd93586ffe9ae789282cae63 C:\WINDOWS\$NtUninstallKB950759$\wininet.dll
                          2007-08-22 13:13 663040 18048557aa56de4b1955fdf7a21f9b24 C:\WINDOWS\$NtUninstallKB942615$\wininet.dll
                          2008-04-21 07:02 663552 355a69cc05045428ce6b9e6bfbd4b74b C:\WINDOWS\$NtUninstallKB953838$\wininet.dll

                          2008-06-20 10:45 360320 2a5554fc5b1e04e131230e3ce035c3f9 C:\WINDOWS\system32\drivers\tcpip.sys
                          2008-06-20 10:45 360320 2a5554fc5b1e04e131230e3ce035c3f9 C:\WINDOWS\system32\dllcache\tcpip.sys
                          2006-04-20 12:18 360576 b2220c618b42a2212a59d91ebd6fc4b4 C:\WINDOWS\$hf_mig$\KB917953\SP2QFE\tcpip.sys
                          2007-10-30 16:53 360832 64798ecfa43d78c7178375fcdd16d8c8 C:\WINDOWS\$hf_mig$\KB941644\SP2QFE\tcpip.sys
                          2008-06-20 10:44 360960 744e57c99232201ae98c49168b918f48 C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\tcpip.sys
                          2008-06-20 11:51 361600 9aefa14bd6b182d61e3119fa5f436d3d C:\WINDOWS\$hf_mig$\KB951748\SP3GDR\tcpip.sys
                          2008-06-20 11:59 361600 ad978a1b783b5719720cff204b666c8e C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\tcpip.sys
                          2004-08-03 23:14 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\$NtUninstallKB917953$\tcpip.sys
                          2006-04-20 11:51 359808 1dbf125862891817f374f407626967f4 C:\WINDOWS\$NtUninstallKB941644$\tcpip.sys
                          2007-10-30 17:20 360064 90caff4b094573449a0872a0f919b178 C:\WINDOWS\$NtUninstallKB951748$\tcpip.sys

                          2004-08-19 16:10 506368 123eea158f74d0f67a51dcdf065d1091 C:\WINDOWS\system32\winlogon.exe
                          2004-08-19 16:10 506368 123eea158f74d0f67a51dcdf065d1091 C:\WINDOWS\system32\dllcache\winlogon.exe

                          2004-08-03 23:14 182912 558635d3af1c7546d26067d5d9b6959e C:\WINDOWS\system32\drivers\ndis.sys
                          2004-08-03 23:14 182912 558635d3af1c7546d26067d5d9b6959e C:\WINDOWS\system32\dllcache\ndis.sys

                          2007-02-28 16:02 2059648 a1d5231403329478ae4fe2778c55c77f C:\WINDOWS\system32\ntkrnlpa.exe
                          2007-02-28 16:02 2059648 a1d5231403329478ae4fe2778c55c77f C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
                          2007-02-28 16:02 2059648 a1d5231403329478ae4fe2778c55c77f C:\WINDOWS\Driver Cache\i386\ntkrnlpa.exe
                          2005-03-02 18:13 2059008 5311776074b6c13f983dc75baeac9c0c C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\ntkrnlpa.exe
                          2007-02-28 16:08 2061440 7a56a64eb50399613587e90292dd2aab C:\WINDOWS\$hf_mig$\KB931784\SP2QFE\ntkrnlpa.exe
                          2004-08-19 16:20 2058880 f252fae094c54572ece38a039f2103c4 C:\WINDOWS\$NtUninstallKB931784$\ntkrnlpa.exe

                          2007-02-28 16:02 2182400 7d6d19aac51a4325f6039f083c22303c C:\WINDOWS\system32\ntoskrnl.exe
                          2007-02-28 16:02 2182400 7d6d19aac51a4325f6039f083c22303c C:\WINDOWS\system32\dllcache\ntoskrnl.exe
                          2007-02-28 16:02 2182400 7d6d19aac51a4325f6039f083c22303c C:\WINDOWS\Driver Cache\i386\ntoskrnl.exe
                          2005-03-02 18:13 2181632 3e2a0a4a0c0b19fc113618a9562a3b2a C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe
                          2007-02-28 16:08 2184192 8e244108562e0e452eb68dff64cb08a9 C:\WINDOWS\$hf_mig$\KB931784\SP2QFE\ntoskrnl.exe
                          2004-08-19 16:04 2183040 7d38ce4398e6aa6339b4644feadcc0d8 C:\WINDOWS\$NtUninstallKB931784$\ntoskrnl.exe

                          2007-06-13 13:22 1037312 d0288319660edcfed07c7e74c4ea38a5 C:\WINDOWS\explorer.exe
                          2007-06-13 13:22 1037312 d0288319660edcfed07c7e74c4ea38a5 C:\WINDOWS\system32\dllcache\explorer.exe
                          2007-06-13 13:10 1037312 b795475444d6d57a572c14b9e1a29839 C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
                          2004-08-22 22:35 1036288 998f3f568f6074a35ab08cd3395a9dc2 C:\WINDOWS\$NtUninstallKB938828$\explorer.exe

                          2004-08-19 16:10 108544 63dcde1a0d86eeb8924d6738ff616ead C:\WINDOWS\system32\services.exe
                          2004-08-19 16:10 108544 63dcde1a0d86eeb8924d6738ff616ead C:\WINDOWS\system32\dllcache\services.exe

                          2004-08-19 16:09 13312 259af82a0932eea4f316f92db94707b6 C:\WINDOWS\system32\lsass.exe
                          2004-08-19 16:09 13312 259af82a0932eea4f316f92db94707b6 C:\WINDOWS\system32\dllcache\lsass.exe

                          2004-08-19 16:09 15360 64e41e8fee655b03e3f19ded21ba5118 C:\WINDOWS\system32\ctfmon.exe
                          2004-08-19 16:09 15360 64e41e8fee655b03e3f19ded21ba5118 C:\WINDOWS\system32\dllcache\ctfmon.exe

                          2005-06-10 23:53 57856 da81ec57acd4cdc3d4c51cf3d409af9f C:\WINDOWS\system32\spoolsv.exe
                          2005-06-10 23:53 57856 da81ec57acd4cdc3d4c51cf3d409af9f C:\WINDOWS\system32\dllcache\spoolsv.exe
                          2005-06-11 00:17 57856 ad3d9d191aea7b5445fe1d82ffbb4788 C:\WINDOWS\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
                          2004-08-19 16:10 57856 df9fc62ad51cb082b0ae371919a232cb C:\WINDOWS\$NtUninstallKB896423$\spoolsv.exe

                          2007-07-30 19:19 53080 f3e9065eb617a7e3a832a7976bfa021b C:\WINDOWS\system32\wuauclt.exe
                          2007-07-30 19:19 53080 f3e9065eb617a7e3a832a7976bfa021b C:\WINDOWS\system32\dllcache\wuauclt.exe

                          2004-08-19 16:10 25088 84717891f0734c611721f56c60b5fbc3 C:\WINDOWS\system32\userinit.exe
                          2004-08-19 16:10 25088 84717891f0734c611721f56c60b5fbc3 C:\WINDOWS\system32\dllcache\userinit.exe
                          .
                          -- Snapshot reset to current date --
                          .
                          ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
                          .
                          .
                          REGEDIT4
                          *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

                          [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                          "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 16:09 15360]
                          "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]

                          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                          "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
                          "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-18 22:35 266497]
                          "Glock Suite 1.1"="C:\WINDOWS\system32\glock32.exe" [2004-08-19 16:09 13312]
                          "Restart"="" [BU]
                          "C-Media Mixer"="Mixer.exe" [2002-07-12 16:33 1581056 C:\WINDOWS\mixer.exe]

                          [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                          "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 16:09 15360]

                          [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
                          "FlashPlayerUpdate"="C:\WINDOWS\system32\Macromed\Flash\FlashUtil9d.exe" [2007-06-11 20:04 190696]

                          [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
                          "NoDispBackgroundPage"= 1 (0x1)
                          "NoDispScrSavPage"= 1 (0x1)

                          [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
                          "UIHost"=hex(2):6c,6f,67,6f,6e,75,69,32,2e,65,78,65,00

                          [HKEY_LOCAL_MACHINE\software\microsoft\security center]
                          "UpdatesDisableNotify"=dword:00000001
                          "FirewallOverride"=dword:00000001
                          "AntiVirusOverride"=dword:00000001
                          "AntiVirusDisableNotify"=dword:00000001

                          [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
                          "EnableFirewall"= 0 (0x0)
                          "DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

                          [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                          "%windir%\\system32\\sessmgr.exe"=
                          "C:\\Program Files\\Yahoo!\\Messenger\\YPager.exe"=
                          "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
                          "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
                          "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

                          R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys [2005-12-15 18:13]
                          R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys [2005-12-15 18:01]
                          S0 Twa36;Twa36;C:\WINDOWS\system32\Drivers\Twa36.sys []
                          .
                          Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'

                          2008-08-17 C:\WINDOWS\Tasks\B853381C9188DEB8.job
                          - c:\docume~1\iiman3~1.000\applic~1\typeli~1\Web more loud.exe []
                          .
                          - - - - ORPHANS REMOVED - - - -

                          HKLM-Run-ctfdll32 - C:\WINDOWS\System32\Ctfdll32.exe
                          Notify-bzzmotg - bzzmotg.dll
                          MSConfigStartUp-MyWebSearch Plugin - C:\PROGRA~1\MYWEBS~1\bar\2.bin\M3PLUGIN.DLL

                          **************************************************************************

                          catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                          Rootkit scan 2008-08-17 20:48:29
                          Windows 5.1.2600 Service Pack 2 FAT NTAPI

                          Balayage processus cach‚s ...

                          Balayage cach‚ autostart entries ...

                          Balayage des fichiers cach‚s ...

                          Scan termin‚ avec succŠs
                          Les fichiers cach‚s: 0

                          **************************************************************************

                          [HKEY_LOCAL_MACHINE\system\ControlSet002\Services\Bfi47]
                          "ImagePath"="System32\Drivers\Bfi47.sys"

                          [HKEY_LOCAL_MACHINE\system\ControlSet002\Services\bgK61]
                          "ImagePath"="System32\Drivers\bgK61.sys"
                          0
                          1. ep44 Contributeur
                            très bien :)

                            on refais un autre tour

                            sélectionne ceci

                            selectionne ceci 
                            Registry::
[-HKEY_LOCAL_MACHINE\system\ControlSet002\Services\Bfi47]    
[-HKEY_LOCAL_MACHINE\system\ControlSet002\Services\bgK61]   
[-HKEY_LOCAL_MACHINE\system\ControlSet002\Services\Cgi82]    
[-HKEY_LOCAL_MACHINE\system\ControlSet002\Services\ctl_w32]    
[-HKEY_LOCAL_MACHINE\system\ControlSet002\Services\Dgj03]   
[-HKEY_LOCAL_MACHINE\system\ControlSet002\Services\Ehk60]    
[-HKEY_LOCAL_MACHINE\system\ControlSet002\Services\flP60]  
[-HKEY_LOCAL_MACHINE\system\ControlSet002\Services\glP60]  
[-HKEY_LOCAL_MACHINE\system\ControlSet002\Services\Jmp14]  
[-HKEY_LOCAL_MACHINE\system\ControlSet002\Services\joS50]    
[-HKEY_LOCAL_MACHINE\system\ControlSet002\Services\Lqu71]   
[-HKEY_LOCAL_MACHINE\system\ControlSet002\Services\noskrnl.sys]   
[-HKEY_LOCAL_MACHINE\system\ControlSet002\Services\Nqt03]    
[-HKEY_LOCAL_MACHINE\system\ControlSet002\Services\nsV47]   
[-HKEY_LOCAL_MACHINE\system\ControlSet002\Services\otW72]  
[-HKEY_LOCAL_MACHINE\system\ControlSet002\Services\ouY71]    
[-HKEY_LOCAL_MACHINE\system\ControlSet002\Services\Svy61]    
[-HKEY_LOCAL_MACHINE\system\ControlSet002\Services\USB2_04]  
[-HKEY_LOCAL_MACHINE\system\ControlSet002\Services\Uyc24]  
[-HKEY_LOCAL_MACHINE\system\ControlSet002\Services\Uyc68]  
[-HKEY_LOCAL_MACHINE\system\ControlSet002\Services\Xcf03]  
[-HKEY_LOCAL_MACHINE\system\ControlSet002\Services\Ydg24]  



File::
C:\WINDOWS\system32\cbOCR.dll       
C:\WINDOWS\system32\dllcache\svchost.exe          
C:\WINDOWS\system32\dllcache\winlogon.exe       
C:\WINDOWS\system32\dllcache\services.exe       
C:\WINDOWS\system32\dllcache\spoolsv.exe


                            * Copie le texte sélectionné (CTRL+C).
                            * Ouvre le bloc-notes (programme>Accessoires >bloc-notes).
                            * Veille à ce que Retour à la ligne ne soit pas coché dans Format.
                            * Colle le texte copié dans ce bloc-notes (CTRL+V).
                            * Sauvegarde ce fichier sous le nom de CFScript.txt
                            * Fais un glisser/déposer de ce fichier CFScript.txt sur le fichier ComboFix.exe comme ceci
                            http://apu.mabul.org/up/apu/2008/08/12/img-191202xzrpd.gif
                            * Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises : c'est normal!
                            Ne touche à rien tant que le scan n'est pas terminé.
                            * Une fois le scan achevé, un rapport va s'afficher : Poste son contenu.
                            * Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

                            Note: Le code ci-dessus a été intentionnellement rédigé pour CET utilisateur.
                            si vous n'êtes pas CET utilisateur, NE PAS appliquer ces directives : elles pourraient endommager votre système.

                            @+

                            0
                            1. imn12 Auteur
                              Voici le rapport =) :

                              ComboFix 08-08-17.03 - iiMAN3 2008-08-18 11:26:45.3 - [color=red][b]FAT32[/b][/color]x86
                              Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.86 [GMT 0:00]
                              Endroit: C:\Documents and Settings\iiMAN3.INTERNET.000\Bureau\ComboFix.exe
                              Command switches used :: C:\Documents and Settings\iiMAN3.INTERNET.000\Bureau\CFScript.txt
                              * Création d'un nouveau point de restauration

                              [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]

                              FILE ::
                              C:\WINDOWS\system32\cbOCR.dll
                              C:\WINDOWS\system32\dllcache\services.exe
                              C:\WINDOWS\system32\dllcache\spoolsv.exe
                              C:\WINDOWS\system32\dllcache\svchost.exe
                              C:\WINDOWS\system32\dllcache\winlogon.exe
                              .

                              (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
                              .

                              C:\Documents and Settings\Brahim\UserData
                              C:\Documents and Settings\Brahim\UserData\[u]0[/u]JCN0BQ1\historySitePos[1].xml
                              C:\Documents and Settings\Brahim\UserData\G7WZYJUX\historySearchPos[1].xml
                              C:\Documents and Settings\Brahim\UserData\G7WZYJUX\IsOnIE6tbPromo[1].xml
                              C:\Documents and Settings\Brahim\UserData\index.dat
                              C:\Documents and Settings\Brahim\UserData\ITUXY7YN\advstNetId[1].xml
                              C:\Documents and Settings\Brahim\UserData\ITUXY7YN\Tdy58[1].xml
                              C:\Documents and Settings\iiMAN3.INTERNET.000\UserData
                              C:\Documents and Settings\iiMAN3.INTERNET.000\UserData\index.dat
                              C:\Documents and Settings\iiMAN3.INTERNET.000\UserData\WX234163\Tdy58[1].xml
                              C:\Documents and Settings\iiMAN3.INTERNET\UserData
                              C:\Documents and Settings\iiMAN3.INTERNET\UserData\index.dat
                              C:\Documents and Settings\iiMAN3\UserData
                              C:\Documents and Settings\iiMAN3\UserData\index.dat
                              C:\Documents and Settings\Invité\UserData
                              C:\Documents and Settings\Invité\UserData\index.dat
                              C:\Documents and Settings\mona81096\UserData
                              C:\Documents and Settings\mona81096\UserData\index.dat
                              C:\WINDOWS\system32\cbOCR.dll
                              C:\WINDOWS\system32\dllcache\services.exe
                              C:\WINDOWS\system32\dllcache\spoolsv.exe
                              C:\WINDOWS\system32\dllcache\svchost.exe
                              C:\WINDOWS\system32\dllcache\winlogon.exe

                              .
                              ((((((((((((((((((((((((((((( Fichiers créés 2008-07-18 to 2008-08-18 ))))))))))))))))))))))))))))))))))))
                              .

                              2008-08-17 20:53 . 2008-08-17 20:53 <REP> d-------- C:\Documents and Settings\InvitÚ
                              2008-08-17 15:18 . 2008-08-17 15:18 <REP> d-------- C:\WINDOWS\erdnt.--0
                              2008-08-17 15:06 . 2000-08-31 08:00 28,672 --a------ C:\WINDOWS\nircmd.ex0
                              2008-08-17 15:02 . 2000-08-31 08:00 161,792 --a------ C:\WINDOWS\swreg.ex0
                              2008-08-17 15:02 . 2000-08-31 08:00 98,816 --a------ C:\WINDOWS\sed.ex0
                              2008-08-17 15:02 . 2000-08-31 08:00 89,504 --a------ C:\WINDOWS\fdsv.ex0
                              2008-08-17 15:02 . 2000-08-31 08:00 80,412 --a------ C:\WINDOWS\grep.ex0
                              2008-08-17 15:02 . 2000-08-31 08:00 68,096 --a------ C:\WINDOWS\zip.ex0
                              2008-08-17 15:02 . 2000-08-31 08:00 49,152 --a------ C:\WINDOWS\VFIND.EX0
                              2008-08-17 15:02 . 2000-08-31 08:00 28,672 --a------ C:\WINDOWS\NIRCMD.EX1
                              2008-08-14 14:16 . 2008-08-14 14:16 <REP> d--hs---- C:\FOUND.098
                              2008-08-13 15:47 . 2008-08-13 15:47 <REP> d--hs---- C:\FOUND.097
                              2008-08-13 10:00 . 2008-08-13 10:00 <REP> d--hs---- C:\FOUND.096
                              2008-07-21 20:29 . 2008-07-21 20:29 <REP> d--hs---- C:\FOUND.093
                              2008-07-19 17:49 . 2008-07-19 17:49 <REP> d--hs---- C:\FOUND.092

                              .
                              (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                              .
                              2008-07-07 20:31 253,952 ----a-w C:\WINDOWS\system32\es.dll
                              2008-07-07 20:31 253,952 ----a-w C:\WINDOWS\system32\dllcache\es.dll
                              2008-06-30 14:40 --------- d-----w C:\Program Files\Bitmanagement Software
                              2008-06-25 16:55 979 ----a-w C:\WINDOWS\system32\drivers\fwdrv.err
                              2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
                              2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\dllcache\mscms.dll
                              2008-06-23 15:39 152,064 ----a-w C:\WINDOWS\system32\dllcache\cdfview.dll
                              2008-06-23 15:39 1,024,000 ----a-w C:\WINDOWS\system32\dllcache\browseui.dll
                              2008-06-23 09:49 18,432 ----a-w C:\WINDOWS\system32\dllcache\iedw.exe
                              2008-06-20 23:11 148,992 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
                              2008-06-20 17:41 247,808 ----a-w C:\WINDOWS\system32\mswsock.dll
                              2008-06-20 17:41 247,808 ----a-w C:\WINDOWS\system32\dllcache\mswsock.dll
                              2008-06-20 15:22 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
                              2008-06-20 15:22 225,920 ----a-w C:\WINDOWS\system32\dllcache\tcpip6.sys
                              2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
                              2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\dllcache\tcpip.sys
                              2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
                              2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\dllcache\afd.sys
                              2008-06-14 17:59 272,768 ------w C:\WINDOWS\system32\dllcache\bthport.sys
                              2008-05-13 20:26 192,512 ----a-w C:\Documents and Settings\Invité\cbOCR.dll
                              2008-05-13 20:26 192,512 ----a-w C:\Documents and Settings\Invité\cbOCR.dll
                              2008-04-19 11:24 2,402,832 ----a-w C:\Program Files\WLinstaller.exe1.exe
                              2008-04-06 18:04 6,116,304 ----a-w C:\Program Files\Firefox Setup 2.0.0.13.exe
                              2005-02-19 10:20 490 ----a-r C:\Program Files\mIRC32.lnk
                              2002-01-05 05:11 2,293,848 ----a-w C:\Program Files\FLV PlayerFCSetup.exe
                              2002-01-05 05:09 4,265,560 ----a-w C:\Program Files\FLV PlayerRCATSetup.exe
                              2002-01-05 04:49 411,248 ----a-w C:\Program Files\FLV PlayerRCSetup.exe
                              .

                              ((((((((((((((((((((((((((((( snapshot_2008-08-17_20.51.24.79 )))))))))))))))))))))))))))))))))))))))))
                              .
                              + 2005-10-20 20:02:28 163,328 ----a-w C:\WINDOWS\erdnt.--0\subs\ERDNT.EXE
                              .
                              ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
                              .
                              .
                              REGEDIT4
                              *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

                              [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                              "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 16:09 15360]
                              "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]

                              [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                              "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
                              "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-18 22:35 266497]
                              "Glock Suite 1.1"="C:\WINDOWS\system32\glock32.exe" [2004-08-19 16:09 13312]
                              "Restart"="" [BU]
                              "C-Media Mixer"="Mixer.exe" [2002-07-12 16:33 1581056 C:\WINDOWS\mixer.exe]

                              [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                              "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 16:09 15360]

                              [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
                              "FlashPlayerUpdate"="C:\WINDOWS\system32\Macromed\Flash\FlashUtil9d.exe" [2007-06-11 20:04 190696]

                              C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
                              Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 04:44:06 29696]

                              [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
                              "NoDispBackgroundPage"= 1 (0x1)
                              "NoDispScrSavPage"= 1 (0x1)

                              [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
                              "UIHost"=hex(2):6c,6f,67,6f,6e,75,69,32,2e,65,78,65,00

                              [HKEY_LOCAL_MACHINE\software\microsoft\security center]
                              "UpdatesDisableNotify"=dword:00000001
                              "FirewallOverride"=dword:00000001
                              "AntiVirusOverride"=dword:00000001
                              "AntiVirusDisableNotify"=dword:00000001

                              [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
                              "EnableFirewall"= 0 (0x0)
                              "DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

                              [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                              "%windir%\\system32\\sessmgr.exe"=
                              "C:\\Program Files\\Yahoo!\\Messenger\\YPager.exe"=
                              "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
                              "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
                              "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

                              R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys [2005-12-15 18:13]
                              R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys [2005-12-15 18:01]
                              S0 Twa36;Twa36;C:\WINDOWS\system32\Drivers\Twa36.sys []

                              *Newly Created Service* - CATCHME
                              .
                              Contenu du dossier 'Scheduled Tasks/Tâches planifiées'

                              2008-08-17 C:\WINDOWS\Tasks\B853381C9188DEB8.job
                              - c:\docume~1\iiman3~1.000\applic~1\typeli~1\Web more loud.exe []
                              .
                              **************************************************************************

                              catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                              Rootkit scan 2008-08-18 11:39:35
                              Windows 5.1.2600 Service Pack 2 FAT NTAPI

                              Balayage processus cachés ...

                              Balayage caché autostart entries ...

                              Balayage des fichiers cachés ...

                              Scan terminé avec succès
                              Les fichiers cachés: 0

                              **************************************************************************
                              .
                              Temps d'accomplissement: 2008-08-18 11:45:39
                              ComboFix-quarantined-files.txt 2008-08-18 11:45:24
                              ComboFix2.txt 2008-08-17 20:53:14

                              Pre-Run: 1,590,345,728 octets libres
                              Post-Run: 1,528,438,784 octets libres

                              155 --- E O F --- 2008-08-18 11:44:03
                              0
                              1. lyonnel10
                                slt. je te conseille de telecharger l'antivirus "AVIRA ANTIVIR" par le site www.touslesdrivers.com
                                0
                                1. imn12 Auteur
                                  Merci =), c'est déja celui que j'utilise !

                                  Epp44, j'ai encore un problème un autre virus c'est infiltré ===> TR/Captcha.D
                                  Merci d'avance !
                                  0
                                  1. ep44 Contributeur
                                    Bonsoir

                                    oui malheureusement ce n'est pas fini

                                    on continu un autre fois avec combofix

                                    selectionne ceci 

                                    
Driver::
Twa36

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
"Glock Suite 1.1"=-


File::
C:\WINDOWS\system32\Drivers\Twa36.sys 
C:\Documents and Settings\Invité\cbOCR.dll 
C:\Program Files\WLinstaller.exe1.exe


                                    * Copie le texte sélectionné (CTRL+C).
                                    * Ouvre le bloc-notes (programme>Accessoires >bloc-notes).
                                    * Veille à ce que Retour à la ligne ne soit pas coché dans Format.
                                    * Colle le texte copié dans ce bloc-notes (CTRL+V).
                                    * Sauvegarde ce fichier sous le nom de CFScript.txt
                                    * Fais un glisser/déposer de ce fichier CFScript.txt sur le fichier ComboFix.exe comme ceci
                                    http://apu.mabul.org/up/apu/2008/08/12/img-191202xzrpd.gif
                                    * Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises : c'est normal!
                                    Ne touche à rien tant que le scan n'est pas terminé.
                                    * Une fois le scan achevé, un rapport va s'afficher : Poste son contenu.
                                    * Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

                                    Note: Le code ci-dessus a été intentionnellement rédigé pour CET utilisateur.
                                    si vous n'êtes pas CET utilisateur, NE PAS appliquer ces directives : elles pourraient endommager votre système.
                                    ensuite

                                    fait un scan en ligne

                                    avec bitdefender et colle le rapport

                                    https://www.bitdefender.com/toolbox/

                                    Scan à faire sous Internet Explorer

                                    un tuto
                                    http://pageperso.aol.fr/rginformatique/mapage/defender.htm

                                    ensuite un nouveau rapport hijack stp
                                    @+

                                    0
                                    1. imn12 Auteur
                                      Resalut =D !

                                      ==> Mon rapport avec Combofix :

                                      ComboFix 08-08-17.03 - iiMAN3 2008-08-20 20:31:09.4 - [color=red][b]FAT32[/b][/color]x86
                                      Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.92 [GMT 0:00]
                                      Endroit: C:\Documents and Settings\iiMAN3.INTERNET.000\Bureau\ComboFix.exe
                                      Command switches used :: C:\Documents and Settings\iiMAN3.INTERNET.000\Bureau\CFScript.txt
                                      * Création d'un nouveau point de restauration

                                      [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]

                                      FILE ::
                                      C:\Documents and Settings\Invité\cbOCR.dll
                                      C:\Program Files\WLinstaller.exe1.exe
                                      C:\WINDOWS\system32\Drivers\Twa36.sys
                                      .

                                      (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
                                      .

                                      C:\Documents and Settings\Brahim\Local Settings\Temporary Internet Files\
                                      C:\Documents and Settings\iiMAN3.INTERNET.000\Cookies\iiman3@a[1].txt
                                      C:\Documents and Settings\iiMAN3.INTERNET.000\Cookies\iiman3@edt02[2].txt
                                      C:\Documents and Settings\iiMAN3.INTERNET.000\UserData
                                      C:\Documents and Settings\iiMAN3.INTERNET.000\UserData\43MZY36D\historySitePos[1].xml
                                      C:\Documents and Settings\iiMAN3.INTERNET.000\UserData\E58DG1Q5\Tdy58[1].xml
                                      C:\Documents and Settings\iiMAN3.INTERNET.000\UserData\index.dat
                                      C:\Documents and Settings\iiMAN3.INTERNET.000\UserData\O1H9JMQ3\advstNetId[1].xml
                                      C:\Documents and Settings\iiMAN3.INTERNET.000\UserData\O1H9JMQ3\historySearchPos[1].xml
                                      C:\Documents and Settings\Invité\cbOCR.dll
                                      C:\Program Files\WLinstaller.exe1.exe

                                      .
                                      ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
                                      .

                                      -------\Legacy_TWA36
                                      -------\Service_Twa36

                                      ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-07-20 to 2008-08-20 ))))))))))))))))))))))))))))))))))))
                                      .

                                      2008-08-18 22:49 . 2008-08-18 22:49 <REP> d-------- C:\WINDOWS\system32\CatRoot_bak
                                      2008-08-18 21:30 . 2008-08-18 21:30 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
                                      2008-08-18 21:30 . 2008-08-18 21:30 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
                                      2008-08-18 19:31 . 2008-08-18 19:31 <REP> d--hs---- C:\FOUND.099
                                      2008-08-17 20:53 . 2008-08-17 20:53 <REP> d-------- C:\Documents and Settings\Invité
                                      2008-08-17 15:18 . 2008-08-17 15:18 <REP> d-------- C:\WINDOWS\erdnt.--0
                                      2008-08-17 15:06 . 2000-08-31 08:00 28,672 --a------ C:\WINDOWS\nircmd.ex0
                                      2008-08-17 15:02 . 2000-08-31 08:00 161,792 --a------ C:\WINDOWS\swreg.ex0
                                      2008-08-17 15:02 . 2000-08-31 08:00 98,816 --a------ C:\WINDOWS\sed.ex0
                                      2008-08-17 15:02 . 2000-08-31 08:00 89,504 --a------ C:\WINDOWS\fdsv.ex0
                                      2008-08-17 15:02 . 2000-08-31 08:00 80,412 --a------ C:\WINDOWS\grep.ex0
                                      2008-08-17 15:02 . 2000-08-31 08:00 68,096 --a------ C:\WINDOWS\zip.ex0
                                      2008-08-17 15:02 . 2000-08-31 08:00 49,152 --a------ C:\WINDOWS\VFIND.EX0
                                      2008-08-17 15:02 . 2000-08-31 08:00 28,672 --a------ C:\WINDOWS\NIRCMD.EX1
                                      2008-08-14 14:16 . 2008-08-14 14:16 <REP> d--hs---- C:\FOUND.098
                                      2008-08-13 15:47 . 2008-08-13 15:47 <REP> d--hs---- C:\FOUND.097
                                      2008-08-13 10:00 . 2008-08-13 10:00 <REP> d--hs---- C:\FOUND.096
                                      2008-07-21 20:29 . 2008-07-21 20:29 <REP> d--hs---- C:\FOUND.093

                                      .
                                      (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                                      .
                                      2008-07-18 22:10 94,920 ----a-w C:\WINDOWS\system32\dllcache\cdm.dll
                                      2008-07-18 22:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
                                      2008-07-18 22:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
                                      2008-07-18 22:10 53,448 ----a-w C:\WINDOWS\system32\dllcache\wuauclt.exe
                                      2008-07-18 22:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
                                      2008-07-18 22:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
                                      2008-07-18 22:10 36,552 ----a-w C:\WINDOWS\system32\dllcache\wups.dll
                                      2008-07-18 22:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
                                      2008-07-18 22:09 563,912 ----a-w C:\WINDOWS\system32\dllcache\wuapi.dll
                                      2008-07-18 22:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
                                      2008-07-18 22:09 325,832 ----a-w C:\WINDOWS\system32\dllcache\wucltui.dll
                                      2008-07-18 22:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
                                      2008-07-18 22:09 205,000 ----a-w C:\WINDOWS\system32\dllcache\wuweb.dll
                                      2008-07-18 22:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
                                      2008-07-18 22:09 1,811,656 ----a-w C:\WINDOWS\system32\dllcache\wuaueng.dll
                                      2008-07-18 22:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll
                                      2008-07-18 22:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
                                      2008-07-07 20:31 253,952 ----a-w C:\WINDOWS\system32\es.dll
                                      2008-07-07 20:31 253,952 ----a-w C:\WINDOWS\system32\dllcache\es.dll
                                      2008-06-30 14:40 --------- d-----w C:\Program Files\Bitmanagement Software
                                      2008-06-25 16:55 979 ----a-w C:\WINDOWS\system32\drivers\fwdrv.err
                                      2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
                                      2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\dllcache\mscms.dll
                                      2008-06-23 15:39 152,064 ----a-w C:\WINDOWS\system32\dllcache\cdfview.dll
                                      2008-06-23 15:39 1,024,000 ----a-w C:\WINDOWS\system32\dllcache\browseui.dll
                                      2008-06-23 09:49 18,432 ----a-w C:\WINDOWS\system32\dllcache\iedw.exe
                                      2008-06-20 23:11 148,992 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
                                      2008-06-20 17:41 247,808 ----a-w C:\WINDOWS\system32\mswsock.dll
                                      2008-06-20 17:41 247,808 ----a-w C:\WINDOWS\system32\dllcache\mswsock.dll
                                      2008-06-20 15:22 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
                                      2008-06-20 15:22 225,920 ----a-w C:\WINDOWS\system32\dllcache\tcpip6.sys
                                      2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
                                      2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\dllcache\tcpip.sys
                                      2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
                                      2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\dllcache\afd.sys
                                      2008-06-14 17:59 272,768 ------w C:\WINDOWS\system32\dllcache\bthport.sys
                                      2008-04-06 18:04 6,116,304 ----a-w C:\Program Files\Firefox Setup 2.0.0.13.exe
                                      2005-02-19 10:20 490 ----a-r C:\Program Files\mIRC32.lnk
                                      2002-01-05 05:11 2,293,848 ----a-w C:\Program Files\FLV PlayerFCSetup.exe
                                      2002-01-05 05:09 4,265,560 ----a-w C:\Program Files\FLV PlayerRCATSetup.exe
                                      2002-01-05 04:49 411,248 ----a-w C:\Program Files\FLV PlayerRCSetup.exe
                                      .

                                      ((((((((((((((((((((((((((((( snapshot_2008-08-17_20.51.24.79 )))))))))))))))))))))))))))))))))))))))))
                                      .
                                      + 2005-10-20 20:02:28 163,328 ----a-w C:\WINDOWS\erdnt.--0\subs\ERDNT.EXE
                                      + 2005-10-20 20:02:28 163,328 ----a-w C:\WINDOWS\erdnt\subs\ERDNT.EXE
                                      - 2007-08-21 06:17:24 683,520 ----a-w C:\WINDOWS\system32\dllcache\inetcomm.dll
                                      + 2008-04-11 18:51:06 683,520 ----a-w C:\WINDOWS\system32\dllcache\inetcomm.dll
                                      - 2007-08-21 06:17:24 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
                                      + 2008-04-11 18:51:06 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
                                      + 2008-07-18 22:10:20 36,552 ----a-w C:\WINDOWS\system32\SoftwareDistribution\Setup\ServiceStartup\wups.dll\7.2.6001.784\wups.dll
                                      + 2008-07-18 22:10:40 45,768 ----a-w C:\WINDOWS\system32\SoftwareDistribution\Setup\ServiceStartup\wups2.dll\7.2.6001.784\wups2.dll
                                      .
                                      ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
                                      .
                                      .
                                      REGEDIT4
                                      *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

                                      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                                      "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 16:09 15360]
                                      "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]
                                      "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 09:42 2156368]

                                      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                                      "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
                                      "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-18 22:35 266497]
                                      "Glock Suite 1.1"="C:\WINDOWS\system32\glock32.exe" [2004-08-19 16:09 13312]
                                      "Restart"="" [BU]
                                      "C-Media Mixer"="Mixer.exe" [2002-07-12 16:33 1581056 C:\WINDOWS\mixer.exe]

                                      [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                                      "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 16:09 15360]

                                      [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
                                      "FlashPlayerUpdate"="C:\WINDOWS\system32\Macromed\Flash\FlashUtil9d.exe" [2007-06-11 20:04 190696]

                                      [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
                                      "NoDispBackgroundPage"= 1 (0x1)
                                      "NoDispScrSavPage"= 1 (0x1)

                                      [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
                                      "UIHost"=hex(2):6c,6f,67,6f,6e,75,69,32,2e,65,78,65,00

                                      [HKEY_LOCAL_MACHINE\software\microsoft\security center]
                                      "UpdatesDisableNotify"=dword:00000001
                                      "FirewallOverride"=dword:00000001
                                      "AntiVirusOverride"=dword:00000001
                                      "AntiVirusDisableNotify"=dword:00000001

                                      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
                                      "EnableFirewall"= 0 (0x0)
                                      "DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

                                      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                                      "%windir%\\system32\\sessmgr.exe"=
                                      "C:\\Program Files\\Yahoo!\\Messenger\\YPager.exe"=
                                      "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
                                      "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
                                      "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

                                      R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys [2005-12-15 18:13]
                                      R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys [2005-12-15 18:01]
                                      .
                                      Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'

                                      2008-08-20 C:\WINDOWS\Tasks\B853381C9188DEB8.job
                                      - c:\docume~1\iiman3~1.000\applic~1\typeli~1\Web more loud.exe []
                                      .
                                      **************************************************************************

                                      catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                                      Rootkit scan 2008-08-20 20:45:23
                                      Windows 5.1.2600 Service Pack 2 FAT NTAPI

                                      Balayage processus cach‚s ...

                                      Balayage cach‚ autostart entries ...

                                      Balayage des fichiers cach‚s ...

                                      Scan termin‚ avec succŠs
                                      Les fichiers cach‚s: 0

                                      **************************************************************************
                                      .
                                      ------------------------ Other Running Processes ------------------------
                                      .
                                      C:\PROGRAM FILES\AVIRA\ANTIVIR PERSONALEDITION CLASSIC\AVGUARD.EXE
                                      C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
                                      C:\PROGRAM FILES\SUNBELT SOFTWARE\PERSONAL FIREWALL 4\KPF4SS.EXE
                                      C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
                                      C:\WINDOWS\system32\WgaTray.exe
                                      C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
                                      C:\WINDOWS\system32\NOTEPAD.EXE
                                      C:\Program Files\Mozilla Firefox\firefox.exe
                                      .
                                      **************************************************************************
                                      .
                                      Temps d'accomplissement: 2008-08-20 20:53:13 - machine was rebooted
                                      ComboFix-quarantined-files.txt 2008-08-20 20:52:58
                                      ComboFix3.txt 2008-08-17 20:53:14
                                      ComboFix2.txt 2008-08-18 11:45:48

                                      Pre-Run: 1,335,689,216 octets libres
                                      Post-Run: 1,341,308,928 octets libres

                                      180 --- E O F --- 2008-08-18 11:44:03
                                      0
                                      1. ep44 Contributeur
                                        Connait tu ceci
                                        C:\Documents and Settings\Invité

                                        e,suite

                                        Télécharge OTMoveIt (de OldTimer) sur ton Bureau.
                                        http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe
                                        clic double sur OTMoveIt.exe pour le lancer.
                                        copie la liste qui se trouve en citation ci-dessous,
                                        et colle-la dans le cadre de gauche de OTMoveIt :
                                        Paste List of Files/Folders to be moved.

                                        C:\FOUND.099
                                        C:\Documents and Settings\Invité
                                        C:\WINDOWS\erdnt.--0
                                        C:\WINDOWS\nircmd.ex0
                                        C:\WINDOWS\swreg.ex0
                                        C:\WINDOWS\sed.ex0
                                        C:\WINDOWS\fdsv.ex0
                                        C:\WINDOWS\grep.ex0
                                        C:\WINDOWS\zip.ex0
                                        C:\WINDOWS\VFIND.EX0
                                        C:\WINDOWS\NIRCMD.EX1
                                        C:\FOUND.098
                                        C:\FOUND.097
                                        C:\FOUND.096
                                        C:\FOUND.093
                                        EmptyTemp

                                        clique sur MoveIt! pour lancer la suppression.
                                        le résultat apparaîtra dans le cadre Results.
                                        clique sur Exit pour fermer.
                                        poste le rapport situé dans C:\_OTMoveIt\MovedFiles.

                                        il te sera peut-être demandé de faire redémarrer le PC pour achever la suppression.

                                        ensuite n'oublie pas bitdefender en ligne

                                        0
                                        1. imn12 Auteur
                                          Bonjour,

                                          Voilà, depuis hier j'essaie de faire ce fameux scanner en lige (bitdefender), de plus en haut dans le page sur une barre jaune on m'indique qu'il y' aurai peut-être besoin d'installer un module et pour ça il faut que je clique dessus, je clique donc dessus mais rien ne ce passe . Voici ce qui s'affiche :

                                          https://www.imagup.com

                                          Merci d'avance ! !
                                          0
                                          • 1
                                          • 2

                                          Discussions similaires

                                          Softonic,est-ce un virus ?
                                          techmel1

                                          6 réponses
                                          Chrome://newtab
                                          Nova

                                          14 réponses
                                          Désinstaller Softonic
                                          Diguimette

                                          5 réponses
                                          Supprimer New Tab
                                          tysaozon

                                          8 réponses
                                          Virus dans filezilla
                                          balnelius10

                                          9 réponses