Virus photos msn

voici le hijackthis
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:18:16, on 21/08/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\mobsync.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Hp\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\IncrediMail\bin\IMApp.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\conime.exe
C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/...
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/...
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - (no file)
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.509.6972\swg.dll
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\1.0"
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [HP Health Check Scheduler] [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "c:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [OneCareUI] "C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O8 - Extra context menu item: &Recherche AOL Toolbar - c:\program files\aol\aol toolbar 5.0\resources\fr-fr\local\search.html
O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.13\AMVConverter\grab.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.13\MediaManager\grab.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game13.zylom.com/activex/zylomgamesplayer.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Register/Branding/olr3313/OCX/v1018/flashax.cab
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

slt

reste ici et fais msn fix aprs avoir désactivé le compte utilisateur comme indiqué en 22

http://www.commentcamarche.net/forum/affich 7904511 message bizarre sur msn virus

quand j'appuie sur r pour rechercher il ne se pass rien

tu as bien désactivé le compte utilisateur comme indiqué en 22?

oui

Désactive le contrôle des comptes utilisateurs (tu le réactiveras après ta désinfection):

- Va dans démarrer puis panneau de configuration
- Double Clique sur l'icône "Comptes d'utilisateurs"
- Clique ensuite sur désactiver et valide.

télécharge combofix (par sUBs) ici :

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

et enregistre le sur le bureau.

déconnecte toi d'internet et ferme toutes tes applications.

désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)

double-clique sur combofix.exe et suis les instructions

à la fin, il va produire un rapport C:\ComboFix.txt

réactive ton parefeu, ton antivirus, la garde de ton antispyware

copie/colle le rapport C:\ComboFix.txt dans ta prochaine réponse.

Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi.

Tu as un tutoriel complet ici :

https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

_________________________________

colle le rapport d'un scan en ligne
avec un des suivants:

bitdefender en ligne :
http://www.bitdefender.fr/scan_fr/scan8/ie.html

Panda en ligne :
http://pandasoftware.fr

kaspersky:
https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr

ComboFix 08-08-24.03 - Nicoli 2008-08-25 22:39:25.1 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.1998 [GMT 2:00]
Endroit: C:\Users\Nicoli\Desktop\ComboFix.exe
* Création d'un nouveau point de restauration
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Windows\system32\KBL.LOG

.
((((((((((((((((((((((((((((( Fichiers créés 2008-07-25 to 2008-08-25 ))))))))))))))))))))))))))))))))))))
.

2008-08-25 22:00 . 2008-08-25 22:00 <REP> d-------- C:\Program Files\Real
2008-08-25 22:00 . 2008-08-25 22:04 <REP> d-------- C:\Program Files\Common Files\Real
2008-08-25 21:54 . 2008-08-25 21:56 <REP> d-------- C:\Program Files\WMVTOAVI
2008-08-25 21:50 . 2008-08-25 21:56 <REP> d-------- C:\Program Files\VideoLAN
2008-08-24 18:00 . 2008-08-24 18:00 <REP> d-------- C:\Users\All Users\PlayFirst
2008-08-24 18:00 . 2008-08-24 18:00 <REP> d-------- C:\ProgramData\PlayFirst
2008-08-22 12:28 . 2008-08-22 12:28 <REP> d-------- C:\Program Files\EMME
2008-08-21 10:17 . 2008-08-21 10:17 <REP> d-------- C:\Program Files\Trend Micro
2008-08-17 14:55 . 2008-08-17 14:55 <REP> d-------- C:\Program Files\MP3 Player Utilities 4.13
2008-08-16 23:35 . 2008-08-16 23:35 <REP> d-------- C:\Windows\System32\QuickTime
2008-08-16 23:35 . 2008-08-16 23:35 <REP> d-------- C:\Program Files\QuickTime
2008-08-16 23:35 . 1999-11-10 11:05 86,016 --a------ C:\Windows\unvise32qt.exe
2008-08-16 23:35 . 2008-08-16 23:35 54,812 --a------ C:\Windows\System32\QuickTime.qtp
2008-08-16 23:34 . 2008-08-16 23:34 <REP> d-------- C:\Program Files\Motus
2008-08-16 20:29 . 2008-08-16 20:29 <REP> d-------- C:\Program Files\TVAnts
2008-08-16 20:01 . 2008-08-16 20:01 <REP> d-------- C:\Users\All Users\TVU Networks
2008-08-16 20:01 . 2008-08-16 20:01 <REP> d-------- C:\ProgramData\TVU Networks
2008-08-16 20:00 . 2008-08-16 20:00 <REP> d-------- C:\Program Files\TVUPlayer
2008-08-15 18:59 . 2008-08-15 18:59 <REP> d-------- C:\Program Files\AxBx
2008-08-15 12:19 . 2008-08-15 12:19 <REP> d-------- C:\Users\All Users\Malwarebytes
2008-08-15 12:19 . 2008-08-15 12:19 <REP> d-------- C:\ProgramData\Malwarebytes
2008-08-15 12:19 . 2008-08-15 12:19 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-15 12:19 . 2008-07-30 20:07 38,472 --a------ C:\Windows\System32\drivers\mbamswissarmy.sys
2008-08-15 12:19 . 2008-07-30 20:07 17,144 --a------ C:\Windows\System32\drivers\mbam.sys
2008-08-15 00:08 . 2008-08-15 00:08 <REP> d-------- C:\Program Files\CCleaner
2008-08-15 00:00 . 2008-08-25 17:17 <REP> d-------- C:\Users\All Users\Google Updater
2008-08-15 00:00 . 2008-08-25 17:17 <REP> d-------- C:\ProgramData\Google Updater
2008-08-14 23:49 . 2008-08-15 19:01 <REP> d-a------ C:\Users\All Users\TEMP
2008-08-14 23:49 . 2008-08-15 19:01 <REP> d-a------ C:\ProgramData\TEMP
2008-08-14 02:23 . 2008-07-16 03:32 2,048 --a------ C:\Windows\System32\tzres.dll
2008-08-14 02:19 . 2008-06-27 03:55 1,383,424 --a------ C:\Windows\System32\mshtml.tlb
2008-08-14 02:19 . 2008-06-27 06:15 827,392 --a------ C:\Windows\System32\wininet.dll
2008-08-14 02:19 . 2008-04-10 07:12 738,304 --a------ C:\Windows\System32\inetcomm.dll
2008-08-14 02:19 . 2008-06-19 05:31 361,984 --a------ C:\Windows\System32\IPSECSVC.DLL
2008-08-14 02:19 . 2008-04-18 07:48 269,312 --a------ C:\Windows\System32\es.dll
2008-08-10 11:30 . 2008-08-10 11:30 <REP> d-------- C:\Users\All Users\AOL OCP
2008-08-10 11:30 . 2008-08-10 11:30 <REP> d-------- C:\Users\All Users\AOL
2008-08-10 11:30 . 2008-08-10 11:30 <REP> d-------- C:\ProgramData\AOL OCP
2008-08-10 11:30 . 2008-08-10 11:30 <REP> d-------- C:\ProgramData\AOL
2008-08-05 12:42 . 2008-08-05 12:42 <REP> d-------- C:\Users\All Users\Microgaming
2008-08-05 12:42 . 2008-08-05 12:42 <REP> d-------- C:\Users\All Users\MGS
2008-08-05 12:42 . 2008-08-05 12:42 <REP> d-------- C:\ProgramData\Microgaming
2008-08-05 12:42 . 2008-08-05 12:42 <REP> d-------- C:\ProgramData\MGS
2008-08-05 12:41 . 2008-08-05 12:41 <REP> d-------- C:\Windows\System32\FlashAX
2008-08-05 12:41 . 2008-08-05 12:41 <REP> d-------- C:\MicroGaming
2008-08-01 11:37 . 2006-11-28 21:46 28,224 --a------ C:\Windows\System32\drivers\PCAMp50.sys
2008-08-01 11:37 . 2006-11-28 21:46 27,072 --a------ C:\Windows\System32\drivers\PCASp50.sys
2008-08-01 11:31 . 2008-08-01 11:31 <REP> d-------- C:\Program Files\Securitoo
2008-08-01 11:31 . 2008-08-01 11:31 <REP> d-------- C:\Program Files\Inventel
2008-07-31 03:01 . 2008-07-31 03:01 <REP> d-------- C:\Program Files\MSXML 4.0
2008-07-30 16:06 . 2008-07-30 16:06 <REP> d-------- C:\Users\All Users\Messenger Plus!
2008-07-30 16:06 . 2008-07-30 16:06 <REP> d-------- C:\ProgramData\Messenger Plus!
2008-07-30 16:04 . 2008-07-30 16:04 <REP> d-------- C:\Users\All Users\Logitech
2008-07-30 16:04 . 2008-07-31 16:58 <REP> d-------- C:\Users\All Users\Logishrd
2008-07-30 16:04 . 2008-07-30 16:04 <REP> d-------- C:\ProgramData\Logitech
2008-07-30 16:04 . 2008-07-31 16:58 <REP> d-------- C:\ProgramData\Logishrd
2008-07-30 16:00 . 2008-07-31 16:58 <REP> d-------- C:\Program Files\Common Files\logishrd
2008-07-30 15:42 . 2008-07-30 15:42 <REP> d-------- C:\Program Files\Common Files\Adobe
2008-07-30 14:33 . 2008-08-13 16:25 <REP> d-------- C:\Program Files\PKR
2008-07-30 14:21 . 2008-05-23 00:22 3,596,288 --a------ C:\Windows\System32\qt-dx331.dll
2008-07-30 14:21 . 2008-07-04 08:34 860,160 --a------ C:\Windows\System32\lameACM.acm
2008-07-30 14:21 . 2008-01-10 14:15 755,027 --a------ C:\Windows\System32\xvidcore.dll
2008-07-30 14:21 . 2004-01-25 18:18 217,088 --a------ C:\Windows\System32\yv12vfw.dll
2008-07-30 14:21 . 2007-09-04 18:56 164,352 --a------ C:\Windows\System32\unrar.dll
2008-07-30 14:21 . 2008-01-10 14:16 159,839 --a------ C:\Windows\System32\xvidvfw.dll
2008-07-30 14:21 . 2007-09-21 02:52 118,784 --a------ C:\Windows\System32\ac3acm.acm
2008-07-30 14:21 . 2008-05-23 00:19 81,920 --a------ C:\Windows\System32\dpl100.dll
2008-07-30 14:21 . 2007-10-03 17:03 414 --a------ C:\Windows\System32\lame_acm.xml
2008-07-30 14:20 . 2008-07-30 14:21 <REP> d-------- C:\Program Files\K-Lite Codec Pack
2008-07-30 14:20 . 2008-05-31 01:22 683,520 --a------ C:\Windows\System32\divx.dll
2008-07-30 14:20 . 2008-06-12 20:36 7,680 --a------ C:\Windows\System32\ff_vfw.dll
2008-07-30 14:20 . 2007-07-10 18:10 547 --a------ C:\Windows\System32\ff_vfw.dll.manifest
2008-07-30 14:14 . 2008-07-30 14:14 <REP> d-------- C:\Users\All Users\IncrediMail
2008-07-30 14:14 . 2008-07-30 14:15 <REP> d-------- C:\Users\All Users\IM
2008-07-30 14:14 . 2008-07-30 14:14 <REP> d-------- C:\ProgramData\IncrediMail
2008-07-30 14:14 . 2008-07-30 14:15 <REP> d-------- C:\ProgramData\IM
2008-07-30 14:14 . 2008-07-30 14:14 <REP> d-------- C:\Program Files\IncrediMail
2008-07-30 14:02 . 2008-07-30 14:02 <REP> d-------- C:\Program Files\Messenger Plus! Live
2008-07-30 13:59 . 2008-07-30 13:59 <REP> d-------- C:\Program Files\Microsoft SQL Server Compact Edition
2008-07-30 13:59 . 2006-11-29 13:06 3,426,072 --a------ C:\Windows\System32\d3dx9_32.dll
2008-07-30 13:51 . 2008-07-30 13:51 <REP> d-------- C:\Users\All Users\eMule
2008-07-30 13:51 . 2008-07-30 13:51 <REP> d-------- C:\ProgramData\eMule
2008-07-30 13:50 . 2008-07-30 13:50 <REP> d-------- C:\Program Files\eMule
2008-07-30 13:41 . 2007-11-27 22:45 91,200 --a------ C:\Windows\System32\drivers\msfwdrv.sys
2008-07-30 13:41 . 2007-11-27 22:44 37,440 --a------ C:\Windows\System32\drivers\msfwhlpr.sys
2008-07-30 13:40 . 2008-07-30 13:41 <REP> d----c--- C:\Windows\System32\DRVSTORE
2008-07-30 13:40 . 2008-07-30 13:40 <REP> d-------- C:\Program Files\Common Files\PX Storage Engine
2008-07-30 13:40 . 2008-04-23 06:42 428,544 --a------ C:\Windows\System32\EncDec.dll
2008-07-30 13:40 . 2008-04-23 06:42 293,376 --a------ C:\Windows\System32\psisdecd.dll
2008-07-30 13:40 . 2008-04-23 06:41 218,624 --a------ C:\Windows\System32\psisrndr.ax
2008-07-30 13:40 . 2008-04-23 06:41 57,856 --a------ C:\Windows\System32\MSDvbNP.ax
2008-07-30 13:40 . 2008-05-15 16:15 53,168 --a------ C:\Windows\System32\drivers\MpFilter.sys
2008-07-30 13:38 . 2008-08-25 22:29 <REP> d-------- C:\Program Files\Microsoft Windows OneCare Live
2008-07-30 13:32 . 2008-06-26 03:45 12,240,896 --a------ C:\Windows\System32\NlsLexicons0007.dll
2008-07-30 13:32 . 2008-06-26 03:45 2,644,480 --a------ C:\Windows\System32\NlsLexicons0009.dll
2008-07-30 13:32 . 2008-06-26 05:29 801,280 --a------ C:\Windows\System32\NaturalLanguage6.dll
2008-07-30 13:29 . 2008-03-08 04:08 4,240,384 --a------ C:\Windows\System32\GameUXLegacyGDFs.dll
2008-07-30 13:29 . 2008-04-26 10:25 3,600,952 --a------ C:\Windows\System32\ntkrnlpa.exe
2008-07-30 13:29 . 2008-04-26 10:25 3,549,240 --a------ C:\Windows\System32\ntoskrnl.exe
2008-07-30 13:29 . 2008-03-08 06:21 1,695,744 --a------ C:\Windows\System32\gameux.dll
2008-07-30 13:29 . 2008-04-26 10:26 891,448 --a------ C:\Windows\System32\drivers\tcpip.sys
2008-07-30 13:29 . 2008-04-12 05:32 784,896 --a------ C:\Windows\System32\rpcrt4.dll
2008-07-30 13:29 . 2008-05-10 05:35 564,736 --a------ C:\Windows\System32\emdmgmt.dll
2008-07-30 13:29 . 2008-04-05 03:21 72,192 --a------ C:\Windows\System32\drivers\pacer.sys
2008-07-30 13:29 . 2008-04-05 05:34 15,360 --a------ C:\Windows\System32\pacerprf.dll
2008-07-30 13:27 . 2008-07-30 13:58 <REP> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
2008-07-30 13:26 . 2008-07-31 17:08 <REP> d-------- C:\Program Files\Windows Live
2008-07-30 13:25 . 2008-04-26 10:08 1,314,816 --a------ C:\Windows\System32\quartz.dll
2008-07-30 13:19 . 2008-07-30 13:19 <REP> d-------- C:\Users\All Users\Google
2008-07-30 13:19 . 2008-08-15 00:11 <REP> d-------- C:\Program Files\Google
2008-07-30 13:17 . 2008-07-30 13:57 <REP> d-------- C:\Users\All Users\WLInstaller
2008-07-30 13:17 . 2008-07-30 13:57 <REP> d-------- C:\ProgramData\WLInstaller
2008-07-30 12:20 . 2008-07-30 12:20 <REP> dr------- C:\Users\Nicoli\Searches
2008-07-30 12:20 . 2008-08-23 23:34 <REP> dr------- C:\Users\Nicoli\Contacts
2008-07-30 12:20 . 2008-07-30 12:20 81 --a------ C:\Windows\System32\LOG
2008-07-30 12:20 . 2008-07-30 12:20 44 --a------ C:\Windows\system\hpsysdrv.dat
2008-07-30 12:16 . 2008-07-30 12:16 <REP> d-------- C:\Users\All Users\Electronic Arts
2008-07-30 12:16 . 2008-07-30 12:16 <REP> d-------- C:\ProgramData\Electronic Arts
2008-07-30 12:12 . 2008-07-30 12:16 <REP> d-------- C:\Program Files\Electronic Arts
2008-07-30 12:11 . 2008-07-30 12:11 <REP> d-------- C:\Program Files\HPQ
2008-07-30 12:11 . 2008-07-30 12:11 <REP> d-------- C:\Program Files\Common Files\LightScribe
2008-07-30 12:10 . 2008-07-30 12:10 0 -rahs---- C:\Windows\System32\drivers\103C_HP_cNB_Presario A900 Notebook PC_Y5335KV_0U_QCND8253W3R_E482590-051_4A_I30ED_SHP_V83.21_F.33_T080429_WV3-1_L40C_M3062_J160_7Intel_86FD_92.00_#080730_N10EC8139;168C001C_(FM211EA#ABF)_XMOBILE_CN10_Z_2F.33.MRK
2008-07-30 12:09 . 2008-07-30 16:05 <REP> dr------- C:\Users\Nicoli\Videos
2008-07-30 12:09 . 2008-08-07 20:48 <REP> dr------- C:\Users\Nicoli\Saved Games
2008-07-30 12:09 . 2008-08-24 13:33 <REP> dr------- C:\Users\Nicoli\Pictures

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-22 10:29 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-08-14 09:32 --------- d-----w C:\Program Files\Windows Mail
2008-08-14 00:23 --------- d-----w C:\ProgramData\Microsoft Help
2008-08-07 18:48 --------- d-----w C:\ProgramData\WildTangent
2008-07-30 12:35 --------- d-----w C:\ProgramData\CyberLink
2008-07-30 11:20 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-07-30 11:18 --------- d-----w C:\Program Files\Java
2008-07-30 11:16 --------- d-----w C:\ProgramData\Symantec
2008-07-30 10:21 --------- d-----w C:\ProgramData\Hewlett-Packard
2008-07-30 10:04 --------- d-sh--w C:\ProgramData\Modèles
2008-07-30 10:04 --------- d-sh--w C:\ProgramData\Menu Démarrer
2008-07-30 10:04 --------- d-sh--w C:\ProgramData\Favoris
2008-07-30 10:04 --------- d-sh--w C:\ProgramData\Bureau
2008-07-30 10:04 --------- d-sh--w C:\Program Files\Fichiers communs
2008-07-18 18:39 587,264 ----a-w C:\Windows\WLXPGSS.SCR
2008-06-12 05:28 541,696 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-05-27 05:21 1,582,592 ----a-w C:\Windows\System32\tquery.dll
2008-05-27 05:21 1,418,240 ----a-w C:\Windows\System32\mssrch.dll
2008-05-27 05:17 87,552 ----a-w C:\Windows\System32\SearchFilterHost.exe
2008-05-27 05:17 87,552 ----a-w C:\Windows\System32\mssitlb.dll
2008-05-27 05:17 754,176 ----a-w C:\Windows\System32\propsys.dll
2008-05-27 05:17 60,416 ----a-w C:\Windows\System32\msscntrs.dll
2008-05-27 05:17 6,103,040 ----a-w C:\Windows\System32\chtbrkr.dll
2008-05-27 05:17 34,816 ----a-w C:\Windows\System32\msscb.dll
2008-05-27 05:17 32,768 ----a-w C:\Windows\System32\mssprxy.dll
2008-05-27 05:17 313,344 ----a-w C:\Windows\System32\thawbrkr.dll
2008-05-27 05:17 301,568 ----a-w C:\Windows\System32\srchadmin.dll
2008-05-27 05:17 194,560 ----a-w C:\Windows\System32\offfilt.dll
2008-05-27 05:17 143,872 ----a-w C:\Windows\System32\korwbrkr.dll
2008-05-27 05:17 11,776 ----a-w C:\Windows\System32\msshooks.dll
2008-05-27 05:17 1,671,680 ----a-w C:\Windows\System32\chsbrkr.dll
2008-05-27 04:59 18,904 ----a-w C:\Windows\System32\StructuredQuerySchemaTrivial.bin
2008-05-27 04:59 106,605 ----a-w C:\Windows\System32\StructuredQuerySchema.bin
2008-01-21 02:43 174 --sha-w C:\Program Files\desktop.ini
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-21 04:23 1233920]
"LightScribe Control Panel"="C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-08-23 17:36 455968]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]
"IncrediMail"="C:\Program Files\IncrediMail\bin\IncMail.exe" [2008-07-24 14:22 243072]
"ccleaner"="C:\Program Files\CCleaner\CCleaner.exe" [2008-07-29 15:41 1213680]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\Windows\system32\igfxtray.exe" [2007-08-28 14:43 141848]
"HotKeysCmds"="C:\Windows\system32\hkcmd.exe" [2007-08-28 14:43 154136]
"Persistence"="C:\Windows\system32\igfxpers.exe" [2007-08-28 14:43 137752]
"Apoint"="C:\Program Files\Apoint2K\Apoint.exe" [2007-06-30 12:14 159744]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-10-03 15:44 178712]
"QPService"="C:\Program Files\HP\QuickPlay\QPService.exe" [2007-12-19 19:27 468264]
"UCam_Menu"="C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2007-09-13 16:32 222504]
"HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 17:24 54840]
"hpWirelessAssistant"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-10-03 16:15 480560]
"SunJavaUpdateSched"="c:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"OneCareUI"="C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe" [2008-06-25 06:48 67112]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3codecp"= l3codecp.acm
"VIDC.YV12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\OneCareMP]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{DC9FE3DB-6BE8-4D95-9D7E-4F9EAEE750D9}"= UDP:C:\Program Files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{06A686F4-75BC-4259-B286-C0B71492019B}"= TCP:C:\Program Files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{F4B32B59-D931-4ABB-8151-C138A7853338}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{AEB37F41-6F5A-4BF1-8FA6-DA77D37284A0}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{80323D2D-86FD-4A68-B2E5-6A5ED3F36C3C}"= C:\Program Files\Cyberlink\PowerDirector\PDR.EXE:CyberLink PowerDirector
"{1C33E29A-A77C-4144-8B9A-52A9291B05CA}"= C:\Program Files\HP\QuickPlay\QP.exe:Quick Play
"{A403E1BB-06A3-47C4-AA57-4E7B7851CE7E}"= C:\Program Files\HP\QuickPlay\QPService.exe:Quick Play Resident Program
"{012C7CFC-796B-4A35-A615-99403638B346}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{3762E29A-9AAD-404A-BAB4-6E5DDB0EAAFE}"= Disabled:UDP:C:\Program Files\IncrediMail\bin\ImApp.exe:IncrediMail
"{3D4DFC70-BD7B-4E0C-958F-43DECB4B0A1A}"= Disabled:TCP:C:\Program Files\IncrediMail\bin\ImApp.exe:IncrediMail
"{404C0952-84D5-4ACD-AC54-162E32AD67E1}"= Disabled:UDP:C:\Program Files\IncrediMail\bin\IncMail.exe:IncrediMail
"{3A42597B-1B66-4971-8C48-2806326CA286}"= Disabled:TCP:C:\Program Files\IncrediMail\bin\IncMail.exe:IncrediMail
"{1C14C589-2C86-4E6F-8A1F-DB5D44FAC216}"= Disabled:UDP:C:\Program Files\IncrediMail\bin\ImpCnt.exe:IncrediMail
"{F73FA812-B398-4D9A-AC0B-2A7A28AC8399}"= Disabled:TCP:C:\Program Files\IncrediMail\bin\ImpCnt.exe:IncrediMail
"{772A99AF-8026-4CE2-9A71-FA2FCD3E249E}"= UDP:4662:emuletcp
"{DA0B3783-38BD-4BE0-9E27-76FF7E95471A}"= TCP:4672:emuleudp
"{0E2CA898-B17F-4585-B627-D8A198EEBA0E}"= UDP:63331:Windows Live OneCare
"{0C87BD26-48EF-4B48-98CF-01DF082E9D59}"= Disabled:UDP:C:\Program Files\IncrediMail\bin\IncMail.exe:IncrediMail
"{4AF1F07D-DAD5-438C-8313-09F1184E108B}"= Disabled:TCP:C:\Program Files\IncrediMail\bin\IncMail.exe:IncrediMail
"{F287762B-4A2E-4260-BA3C-D35B7A79A791}"= UDP:63331:Windows Live OneCare
"{A95B1987-7B2F-4186-9C14-E54A92045C0D}"= UDP:63331:Windows Live OneCare
"{F2878983-B0F5-4C7E-AAD7-CB135AD220EB}"= Disabled:UDP:C:\Program Files\IncrediMail\bin\ImApp.exe:IncrediMail
"{B0459D65-477D-4520-AAF5-6E30D90781FC}"= Disabled:TCP:C:\Program Files\IncrediMail\bin\ImApp.exe:IncrediMail

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

R2 OcHealthMon;Windows Live OneCare Health Monitor;C:\Program Files\Microsoft Windows OneCare Live\OcHealthMon.exe [2008-06-25 06:47]
R3 CnxtHdAudService;Conexant UAA Function Driver for High Definition Audio Service;C:\Windows\system32\drivers\CHDRT32.sys [2008-02-27 06:26]
R3 RTSTOR;USB Mass Storage Device;C:\Windows\system32\drivers\RTSTOR.SYS [2007-09-27 17:33]
S3 GameConsoleService;GameConsoleService;C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe [2008-05-06 00:25]
S3 PCAMp50;PCAMp50 NDIS Protocol Driver;C:\Windows\system32\Drivers\PCAMp50.sys [2006-11-28 21:46]
S3 PCASp50;PCASp50 NDIS Protocol Driver;C:\Windows\system32\Drivers\PCASp50.sys [2006-11-28 21:46]
S4 ErrDev;Microsoft Hardware Error Device Driver;C:\Windows\system32\drivers\errdev.sys [2008-01-21 04:23]
S4 MegaSR;MegaSR;C:\Windows\system32\drivers\megasr.sys [2008-01-21 04:23]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6ff2fcef-5e1e-11dd-925c-806e6f6e6963}]
\shell\AutoRun\command - E:\Reg\setup.exe

*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-HP Health Check Scheduler - [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe

.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.orange.fr/
R0 -: HKLM-Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fr_fr&c=81&bd=Presario&pf=laptop
O8 -: &Recherche AOL Toolbar - c:\program files\aol\aol toolbar 5.0\resources\fr-fr\local\search.html
O8 -: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.13\AMVConverter\grab.html
O8 -: E&xporter vers Microsoft Excel - C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 -: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.13\MediaManager\grab.html
O17 -: HKLM\CCS\Interface\{EDCA6CA3-CE2A-4A4F-B8C4-F0A81E88F06F}: NameServer = 192.168.1.1

O16 -: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game13.zylom.com/activex/zylomgamesplayer.cab
C:\Windows\Downloaded Program Files\ZylomGamesPlayer.inf
C:\Windows\Downloaded Program Files\zylomgamesplayer.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-25 22:42:43
Windows 6.0.6001 Service Pack 1 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-08-25 22:43:58
ComboFix-quarantined-files.txt 2008-08-25 20:43:56

Pre-Run: 98,175,164,416 octets libres
Post-Run: 98,159,611,904 octets libres

284 --- E O F --- 2008-08-14 00:24:10

mais tu vois quoi exactement dans les rapports hijackthis et combofix?

allo t toujours la?

bon ben finalement je ne suis pas plus avancé,quelqu'un peut il m'aider?

allez svp

le scan bitdefender n'a rien trouvé du tout donc je fais quoi?

rien de special
essaye de refaire msnfix

salu moi j'ai déja eu ce virus alor j'ai télécharger un antivirus pour msn ( spécial ) http://www.windowslive.fr/liveonecare/default.asp par contre c 90 jours gratui met des ke ta enlever le virus tu le suprime bonne chance ;)

rien de special
essaye de refaire msnfix

et colles le rapport