Publicité intempestive

Xtra -  
Bonjour,

Mon PC a un léger souci : il est envahi par de la publicité intempestive. Mais, ce ne sont pas des "pop-up classiques". En effet, toutes les fenêtes sont intitulées "CiD : [nom du site]" (à noter : ce ne sont que des sites que l'on utilise qui arrivent en pub, comme ça... laredoute, surcouf, orange... et c'est pour ça que j'hésite à les bloquer) et j'ai remarqué que depuis que j'ai ça, mon navigateur met un moment avant de s'ouvrir pour la première fois (comme si il se préparait à me lancer des pubs jusqu'à ce que j'arrête le PC).

Enfin, tant que je ne lance pas Internet, il n'y a pas de problème ; mais une fois que c'est fait, ça n'arrête plus.

Grand merci d'avance pour votre aide !
Configuration: Windows XP
Internet Explorer 7.0

42 réponses

Résumé de la discussion

Des utilisateurs rencontrent une infestation publicitaire sur Windows XP et Internet Explorer 7, avec des fenêtres affichant CiD : [nom du site] et un ralentissement du navigateur après connexion. Plusieurs solutions techniques sont proposées, notamment nettoyer le système avec HijackThis et CCleaner, désactiver le service LiveUpdate et lancer en mode sans échec avec Ad-fix puis générer des rapports pour analyse. D'autres retours décrivent l'utilisation de GenProc, des scans plus approfondis et la purge des entrées Run, des tâches planifiées et des cookies suspects, avec des résultats variables et un rappel à partager les rapports.

Bobot (l’IA à votre service)
  1. sKe69 Contributeur sécurité
    Salut,

    fais ceci pour voir de quoi il s'agit vraiment :

    Télécharges et installes le logiciel HijackThis :

    ici : ftp://ftp.commentcamarche.com/download/HJTInstall.exe
    ou ici : http://www.trendsecure.com/portal/en-US/_download/HJTInstall.exe
    ou ici : https://www.clubic.com/telecharger-fiche17891-hijackthis.html

    1- Cliques sur le setup pour lancer l'installe : laisses toi guider et ne modifies pas les paramètres d'installation .
    A la fin de l'installe , le prg ce lance automatiquement : fermes le en cliquant sur la croix rouge .
    Au final, tu dois avoir un raccourci sur ton bureau et aussi un cheminement comme : "C:\ program files\Trend Micro\HijackThis\HijackThis.exe " .
    Supprimes le raccourcis stp ...

    Important :
    Renommer le prg HijackThis (pour contrer une éventuelle infection Vundo):
    Rends toi sur ton PC ici "C:\ program files\Trend Micro\HijackThis\HijackThis.exe"<---cliques droit sur ce dernier et choisis "renommer" : tapes monjack et valides .
    Puis cliques droit sur "monjack.exe" et choisis "envoyer vers" -> le bureau ( créer un raccourci ).

    tuto pour utilisation
    Regardes ici, c'est parfaitement expliqué en images (merci balltrap34) :
    http://perso.orange.fr/rginformatique/section%20virus/demohijack.htm
    ( Ne fixes encore AUCUNE ligne, cela pourrait empêcher ton PC de fonctionner correctement )

    2-!! Déconnectes toi et fermes toute tes applications en cours !!

    Cliques sur le raccourci du bureau pour lancer le prg :
    fais un scan "monjack" (ou HijackThis renommé) en cliquant sur : "Do a system scan and save a logfile"

    ---> Postes le rapport généré pour analyse ...
    0
    1. Xtra
      le rapport :

      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 23:07:00, on 05/09/2008
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v7.00 (7.00.6000.16705)
      Boot mode: Normal

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\ehome\ehtray.exe
      C:\WINDOWS\RTHDCPL.EXE
      C:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe
      C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
      C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
      C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
      C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
      C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
      C:\Program Files\Fichiers communs\Real\Update_OB\RealOneMessageCenter.exe
      C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
      C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
      C:\Program Files\TomTom HOME 2\HOMERunner.exe
      C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
      C:\Program Files\Internet Explorer\IEXPLORE.EXE
      C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
      C:\WINDOWS\arservice.exe
      C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
      C:\WINDOWS\eHome\ehRecvr.exe
      C:\WINDOWS\eHome\ehSched.exe
      C:\WINDOWS\system32\ezNTSvc.exe
      C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
      C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
      C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
      C:\WINDOWS\system32\nvsvc32.exe
      C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\dllhost.exe
      C:\WINDOWS\eHome\ehmsas.exe
      C:\WINDOWS\system32\wuauclt.exe
      C:\HP\KBD\KBD.EXE
      C:\Program Files\Java\jre1.5.0_09\bin\jucheck.exe
      c:\windows\system\hpsysdrv.exe
      C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
      C:\Program Files\Trend Micro\HijackThis\Monjack.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://fr.search.yahoo.com/?fr=cb-hp06
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.wikipedia.org/wiki/Accueil
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = https://fr.search.yahoo.com/?fr=cb-hp06
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF
      R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer optimisé pour MSN
      R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxybiblio.hec.fr:8080
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
      F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\ezShellStart.exe
      O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
      O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
      O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
      O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
      O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
      O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode
      O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
      O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
      O4 - HKLM\..\Run: [DMAScheduler] "c:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe"
      O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
      O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
      O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
      O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
      O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
      O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe"
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
      O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
      O4 - HKLM\..\Run: [EEventManager] C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
      O4 - HKLM\..\Run: [MsgCenterExe] "C:\Program Files\Fichiers communs\Real\Update_OB\RealOneMessageCenter.exe" -osboot
      O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
      O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
      O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
      O4 - HKLM\..\Run: [Amok Eggs Four Web] C:\Documents and Settings\All Users\Application Data\part dead amok eggs\TEAM WIPE.exe
      O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
      O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\HOMERunner.exe"
      O4 - HKCU\..\Run: [amokrule] C:\DOCUME~1\HP_ADM~1\APPLIC~1\ONCEPO~1\BOOB DEAD.exe
      O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
      O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
      O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
      O4 - .DEFAULT User Startup: PinMcLnk.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
      O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
      O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.05\AMVConverter\grab.html
      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
      O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.05\MediaManager\grab.html
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
      O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
      O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
      O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
      O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
      O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
      O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
      O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
      O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O16 - DPF: STS Secure Viewer - http://83.206.149.125:8080/pmasweb//tools/pviewersetup.cab
      O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20070501/qtinstall.info.apple.com/qtactivex/qtplugin.cab
      O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://www.can.com.sg/mwf/mgaxctrl.cab
      O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game09.zylom.com/activex/zylomgamesplayer.cab
      O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
      O18 - Filter hijack: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - (no file)
      O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
      O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
      O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
      O23 - Service: EasyBits Magic Desktop Services for Windows NT (ezntsvc) - EasyBits Software Corp. - C:\WINDOWS\system32\ezNTSvc.exe
      O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
      O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
      O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
      O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
      O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
      O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
      0
      1. Xtra
        le rapport :

        Logfile of Trend Micro HijackThis v2.0.2
        Scan saved at 23:07:00, on 05/09/2008
        Platform: Windows XP SP2 (WinNT 5.01.2600)
        MSIE: Internet Explorer v7.00 (7.00.6000.16705)
        Boot mode: Normal

        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\system32\spoolsv.exe
        C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
        C:\WINDOWS\Explorer.EXE
        C:\WINDOWS\ehome\ehtray.exe
        C:\WINDOWS\RTHDCPL.EXE
        C:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe
        C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
        C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
        C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
        C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe
        C:\Program Files\QuickTime\qttask.exe
        C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
        C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
        C:\Program Files\Fichiers communs\Real\Update_OB\RealOneMessageCenter.exe
        C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
        C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
        C:\WINDOWS\system32\ctfmon.exe
        C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
        C:\Program Files\TomTom HOME 2\HOMERunner.exe
        C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
        C:\Program Files\Internet Explorer\IEXPLORE.EXE
        C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
        C:\WINDOWS\arservice.exe
        C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
        C:\WINDOWS\eHome\ehRecvr.exe
        C:\WINDOWS\eHome\ehSched.exe
        C:\WINDOWS\system32\ezNTSvc.exe
        C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
        C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
        C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
        C:\WINDOWS\system32\nvsvc32.exe
        C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\system32\dllhost.exe
        C:\WINDOWS\eHome\ehmsas.exe
        C:\WINDOWS\system32\wuauclt.exe
        C:\HP\KBD\KBD.EXE
        C:\Program Files\Java\jre1.5.0_09\bin\jucheck.exe
        c:\windows\system\hpsysdrv.exe
        C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
        C:\Program Files\Trend Micro\HijackThis\Monjack.exe

        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://fr.search.yahoo.com/?fr=cb-hp06
        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.wikipedia.org/wiki/Accueil
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = https://fr.search.yahoo.com/?fr=cb-hp06
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
        R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF
        R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer optimisé pour MSN
        R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxybiblio.hec.fr:8080
        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
        F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\ezShellStart.exe
        O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
        O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
        O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
        O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
        O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
        O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
        O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode
        O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
        O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE
        O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
        O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
        O4 - HKLM\..\Run: [DMAScheduler] "c:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe"
        O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
        O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
        O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
        O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
        O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
        O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe"
        O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
        O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
        O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
        O4 - HKLM\..\Run: [EEventManager] C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
        O4 - HKLM\..\Run: [MsgCenterExe] "C:\Program Files\Fichiers communs\Real\Update_OB\RealOneMessageCenter.exe" -osboot
        O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
        O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
        O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
        O4 - HKLM\..\Run: [Amok Eggs Four Web] C:\Documents and Settings\All Users\Application Data\part dead amok eggs\TEAM WIPE.exe
        O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
        O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
        O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\HOMERunner.exe"
        O4 - HKCU\..\Run: [amokrule] C:\DOCUME~1\HP_ADM~1\APPLIC~1\ONCEPO~1\BOOB DEAD.exe
        O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
        O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
        O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
        O4 - .DEFAULT User Startup: PinMcLnk.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
        O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
        O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.05\AMVConverter\grab.html
        O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
        O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.05\MediaManager\grab.html
        O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
        O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
        O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
        O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
        O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
        O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
        O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
        O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
        O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O16 - DPF: STS Secure Viewer - http://83.206.149.125:8080/pmasweb//tools/pviewersetup.cab
        O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20070501/qtinstall.info.apple.com/qtactivex/qtplugin.cab
        O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://www.can.com.sg/mwf/mgaxctrl.cab
        O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game09.zylom.com/activex/zylomgamesplayer.cab
        O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
        O18 - Filter hijack: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - (no file)
        O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
        O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
        O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
        O23 - Service: EasyBits Magic Desktop Services for Windows NT (ezntsvc) - EasyBits Software Corp. - C:\WINDOWS\system32\ezNTSvc.exe
        O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
        O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
        O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
        O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
        O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
        O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
        O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
        0
        1. sKe69 Contributeur sécurité
          Bien ... On commence :

          1- Il reste des traces de Norton qu'il faut absolument nettoyer en premier :

          Télécharges Norton removal tool sur ton bureau :
          ftp://ftp.symantec.com/public/francais/removal_tools/Norton_Removal_Tool.exe

          Déconnectes toi .
          Ensuite désinstales Norton avec Norton removal tool :Tu doubles click dessus et te laisses guider : il faut bien le désinstaler ( fait la manipe 2 fois si possible ).

          Une fois fais , enchaines avec ceci :

          2- Télécharges ToolBar S&D ( de Eric_71 ) :
          https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2

          ( Tuto : https://sites.google.com/site/toolbarsd/aideenimages )

          !! Déconnectes toi et fermes toute tes applications en cours le temps de la manipe !!

          * double-cliques sur l'.exe pour lancer l'installe et laisses toi guider ...
          * Une fois fait, cliques sur le raccourci créé sur ton bureau pour lancer l'outil .
          * Choisis l'option 1 ( "recherche") et tapes "entrée" .
          * Une fois le scan finit , un rapport va apparaître, copie/colles l'intégralité
          de son contenu dans ta prochaine réponse ...
          ( le rapport est en outre sauvegardé ici -> C:\TB.txt )
          0
          2. Xtra
            j'ai fait 2 fois le truc pour enlever norton

            et voici le rapport :

            -----------\\ ToolBar S&D 1.1.7 XP/Vista

            Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 2
            X86-based PC ( Multiprocessor Free : AMD Athlon(tm) 64 X2 Dual Core Processor 3800+ )
            BIOS : Phoenix - AwardBIOS v6.00PG
            USER : HP_Administrateur ( Administrator )
            BOOT : Normal boot
            Antivirus : Avira AntiVir PersonalEdition 8.0.1.27 (Activated)

            "C:\ToolBar SD" ( MAJ : 04-09-2008|15:03 )
            Option : [1] ( 05/09/2008|23:24 )

            -----------\\ Recherche de Fichiers / Dossiers ...

            -----------\\ Extensions

            (All Users) - {3112ca9c-de6d-4884-a869-9855de68056c} => google-toolbar

            -----------\\ [..\Internet Explorer\Main]

            [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
            "Local Page"="C:\\WINDOWS\\system32\\blank.htm"
            "Start Page"="https://fr.wikipedia.org/wiki/Accueil"
            "Search Page"="https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC"
            "Default_Search_URL"="http://ie.redirect.hp.com/..."
            "Default_Page_URL"="https://www.msn.com/fr-fr"

            [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
            "Default_Page_URL"="https://www.msn.com/fr-fr"
            "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
            "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
            "Start Page"="http://ie.redirect.hp.com/..."
            "Search Bar"="http://ie.redirect.hp.com/..."

            --------------------\\ Recherche d'autres infections

            Aucune autre infection trouvée !

            1 - "C:\ToolBar SD\TB_1.txt" - 05/09/2008|23:26 - Option : [1]

            -----------\\ Fin du rapport a 23:26:30,76
            0
            1. sKe69 Contributeur sécurité
              ToolBar ne détecte pas d'infection ... bizard pourtant ....

              Passons à la suite :

              1-Vas dans panneau de config/ajout et suppression de prg .
              Regardes dans la liste si tu trouves un prg comme : " CID Help ", "Circle Developement" ou
              "Adverts" --->si ils s'y trouvent , supprimes les .

              2-Télécharges Lop S&D :
              https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/LopSD.exe?attachauth=ANoY7co3ntqUavpZ3q1BG-h4pc13vqDZmhcNeEPChtsyrgAykRbhE8bZzhk979EfQD4AgwtQUHCaQ7ZQwNYMo3_0kA8htAspckDJtu2K5t6J9z6dLW4fpZyH4FpFL1tVMBZ8H-KnN7afZ5vt-WxZRpnynk-a0XmV_Y0C0q6DxGEDKie1TnPT7gFoZnoCnspzBmbW6ZzxA4fNr3oEDlbelNZON-LjF8nOmQ%3D%3D&attredirects=2

              Déconnetes toi et fermes toutes tes applications en cours .

              Double cliques sur sur l'.exe que tu viens de télécharger pour lancer l'installe .

              Une fois l'installation faite, cliques sur le raccourci pour lancer l'outil .

              Là,laisses toi guider:
              --->choisis l'option 1 (recherche) et valides.

              (Tu ne fais pas l'option de nettoyage ( 2 ou 3) ).

              Une fois le scan terminer ,le Bloc-Notes contenant le rapport va s'ouvrir.
              Postes ce rapport dans ta prochaine réponse pour analyse .

              Tuto : https://sites.google.com/site/eric71mespages/lop.sd.exe

              0
              1. Xtra
                il n'y avait rien de tout ça à supprimer

                et le rapport :

                --------------------\\ Lop S&D 4.2.4-0 XP/Vista

                Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 2
                X86-based PC ( Multiprocessor Free : AMD Athlon(tm) 64 X2 Dual Core Processor 3800+ )
                BIOS : Phoenix - AwardBIOS v6.00PG
                USER : HP_Administrateur ( Administrator )
                BOOT : Normal boot
                Antivirus : Avira AntiVir PersonalEdition 8.0.1.27 (Activated)

                "C:\Lop SD" ( MAJ : 04-09-2008|09:55 )
                Option : [1] ( 05/09/2008|23:35 )

                --------------------\\ Listing des dossiers dans APPLIC~1

                [15/11/2005|04:22] C:\DOCUME~1\ADMINI~1\APPLIC~1\Identities
                [12/08/2006|03:51] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft
                [12/08/2006|03:13] C:\DOCUME~1\ADMINI~1\APPLIC~1\Real

                [12/05/2008|10:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
                [24/08/2007|13:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
                [23/06/2008|19:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Avira
                [06/07/2008|11:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Azureus
                [12/08/2006|03:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink
                [17/09/2007|18:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
                [22/06/2008|10:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Grisoft
                [12/08/2006|03:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Hewlett-Packard
                [20/01/2007|21:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\HP
                [12/08/2006|03:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
                [30/12/2006|21:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\iWin
                [21/08/2007|13:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\JollyBear
                [03/03/2008|12:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
                [15/10/2007|15:02] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
                [24/06/2007|08:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Mozilla
                [28/10/2006|14:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\muvee Technologies
                [05/09/2008|23:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\NortonInstaller
                [27/10/2006|21:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Otto
                [01/07/2008|16:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\part dead amok eggs
                [21/08/2007|13:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\PlayFirst
                [14/08/2007|13:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sandlot Games
                [12/08/2006|02:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBSI
                [18/05/2008|12:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
                [12/08/2006|03:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sonic
                [27/05/2007|20:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SpinTop Games
                [08/11/2007|17:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
                [17/11/2007|19:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TERMINAL Studio
                [28/02/2008|20:02] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TomTom
                [23/12/2006|21:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
                [31/05/2007|17:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Live Toolbar
                [12/06/2008|16:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
                [13/05/2007|09:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Zylom

                [15/11/2005|04:22] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
                [12/08/2006|03:51] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
                [12/08/2006|03:13] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Real

                [24/07/2008|11:18] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Adobe
                [27/01/2007|17:49] C:\DOCUME~1\HP_ADM~1\APPLIC~1\AdobeUM
                [24/07/2008|15:52] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Apple Computer
                [18/05/2008|11:57] C:\DOCUME~1\HP_ADM~1\APPLIC~1\ArcSoft
                [06/07/2008|12:02] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Azureus
                [19/08/2007|18:57] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Beep Industries
                [21/01/2007|19:44] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Canvas Multi-Media
                [06/01/2007|20:52] C:\DOCUME~1\HP_ADM~1\APPLIC~1\CyberLink
                [23/12/2007|20:20] C:\DOCUME~1\HP_ADM~1\APPLIC~1\EPSON
                [29/07/2007|13:18] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Gaijin Ent
                [28/10/2006|13:26] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Google
                [22/06/2008|10:48] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Grisoft
                [31/10/2006|11:41] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Help
                [27/10/2006|21:28] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Hewlett-Packard
                [25/02/2007|21:49] C:\DOCUME~1\HP_ADM~1\APPLIC~1\HP
                [27/10/2006|21:54] C:\DOCUME~1\HP_ADM~1\APPLIC~1\HPQ
                [01/12/2007|16:27] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Identities
                [23/12/2007|20:05] C:\DOCUME~1\HP_ADM~1\APPLIC~1\InstallShield
                [05/08/2007|18:22] C:\DOCUME~1\HP_ADM~1\APPLIC~1\iWin
                [31/10/2006|10:34] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Leadertech
                [28/05/2007|10:53] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Macromedia
                [17/11/2007|19:40] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Magic Academy
                [18/05/2008|11:19] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Microsoft
                [24/06/2007|15:31] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Mozilla
                [19/08/2007|15:33] C:\DOCUME~1\HP_ADM~1\APPLIC~1\My Games
                [01/07/2008|16:57] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Once pop
                [27/10/2006|21:33] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Otto
                [21/08/2007|13:14] C:\DOCUME~1\HP_ADM~1\APPLIC~1\PlayFirst
                [27/10/2006|21:37] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Real
                [30/06/2008|19:37] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Samsung
                [18/05/2008|09:42] C:\DOCUME~1\HP_ADM~1\APPLIC~1\skypePM
                [31/10/2006|10:38] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Sonic
                [30/10/2006|18:51] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Sun
                [24/06/2007|15:31] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Talkback
                [31/10/2006|10:51] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Template
                [28/02/2008|20:02] C:\DOCUME~1\HP_ADM~1\APPLIC~1\TomTom
                [24/11/2007|20:18] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Zylom

                [15/11/2005|04:22] C:\DOCUME~1\INVIT~1\APPLIC~1\Identities
                [07/04/2007|11:51] C:\DOCUME~1\INVIT~1\APPLIC~1\Macromedia
                [12/08/2006|03:51] C:\DOCUME~1\INVIT~1\APPLIC~1\Microsoft
                [12/08/2006|03:13] C:\DOCUME~1\INVIT~1\APPLIC~1\Real
                [07/04/2007|11:57] C:\DOCUME~1\INVIT~1\APPLIC~1\Sun

                [15/11/2005|04:23] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

                [15/11/2005|04:23] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

                --------------------\\ Tâches planifiées dans C:\WINDOWS\tasks

                [05/09/2008 23:00][--ah-----] C:\WINDOWS\tasks\A5C227359185A1E1.job
                [05/09/2008 23:18][--ah-----] C:\WINDOWS\tasks\SA.DAT
                [10/08/2004 13:00][-rah-----] C:\WINDOWS\tasks\desktop.ini

                ( A5C227359185A1E1.job )=( c:\docume~1\hp_adm~1\applic~1\oncepo~1\CdromWinLoad.exe )

                --------------------\\ Listing des dossiers dans C:\Program Files

                [15/07/2008|19:58] C:\Program Files\Adobe
                [18/05/2008|11:57] C:\Program Files\Atout Clic 5e
                [23/06/2008|19:54] C:\Program Files\Avira
                [16/09/2007|12:42] C:\Program Files\Barbie(R) Aventures questres
                [15/09/2007|14:11] C:\Program Files\Bullfrog
                [18/05/2008|11:58] C:\Program Files\calendrier_eval 1.0
                [22/06/2008|10:28] C:\Program Files\CCleaner
                [16/06/2008|15:48] C:\Program Files\Circle Developement
                [12/11/2005|02:09] C:\Program Files\ComPlus Applications
                [30/06/2008|19:27] C:\Program Files\DIFX
                [12/08/2006|03:19] C:\Program Files\DivX
                [12/08/2006|03:33] C:\Program Files\EasyBits
                [22/06/2008|11:52] C:\Program Files\EasyBits For Kids
                [08/12/2007|17:47] C:\Program Files\Enjoy 5e
                [28/10/2006|13:32] C:\Program Files\Enjoy 6e
                [23/12/2007|20:09] C:\Program Files\EPSON
                [23/06/2008|20:01] C:\Program Files\Fichiers communs
                [12/08/2006|02:44] C:\Program Files\FrenchOtto
                [25/10/2007|17:52] C:\Program Files\Gamenext
                [22/06/2008|10:49] C:\Program Files\GemMasterFrench
                [18/05/2008|12:01] C:\Program Files\Google
                [22/06/2008|10:47] C:\Program Files\Grisoft
                [01/11/2006|16:40] C:\Program Files\Hachette Multim‚dia
                [24/08/2008|23:47] C:\Program Files\Hewlett-Packard
                [24/08/2008|23:48] C:\Program Files\HP
                [12/08/2006|03:13] C:\Program Files\HP DigitalMedia Archive
                [30/06/2008|19:26] C:\Program Files\InstallShield Installation Information
                [14/08/2008|20:47] C:\Program Files\Internet Explorer
                [31/10/2006|19:51] C:\Program Files\Java
                [18/11/2006|15:31] C:\Program Files\Mattel Media
                [14/08/2008|20:48] C:\Program Files\Messenger
                [16/06/2008|15:48] C:\Program Files\Messenger Plus! Live
                [01/06/2007|19:05] C:\Program Files\Microsoft CAPICOM 2.1.0.2
                [16/09/2007|12:52] C:\Program Files\Microsoft Encarta
                [15/11/2005|04:24] C:\Program Files\microsoft frontpage
                [18/05/2008|12:03] C:\Program Files\Microsoft Office
                [14/10/2007|13:07] C:\Program Files\Microsoft Visual Studio
                [18/05/2008|12:03] C:\Program Files\Microsoft Works
                [14/10/2007|13:07] C:\Program Files\Microsoft.NET
                [15/11/2005|04:24] C:\Program Files\Movie Maker
                [18/05/2008|12:04] C:\Program Files\Mozilla Firefox
                [15/11/2005|04:24] C:\Program Files\MSN
                [15/11/2005|04:25] C:\Program Files\MSN Gaming Zone
                [17/11/2006|12:36] C:\Program Files\MSXML 4.0
                [12/08/2006|03:19] C:\Program Files\muvee Technologies
                [11/05/2007|13:41] C:\Program Files\My Photo Calendars & Cards
                [15/11/2005|04:25] C:\Program Files\NetMeeting
                [01/07/2008|16:55] C:\Program Files\Once pop
                [15/11/2005|04:25] C:\Program Files\Online Services
                [02/12/2007|00:16] C:\Program Files\Optimum 95 Bt
                [13/06/2007|19:50] C:\Program Files\Outlook Express
                [12/08/2006|03:29] C:\Program Files\PC-Doctor 5 for Windows
                [24/08/2007|13:43] C:\Program Files\QuickTime
                [12/08/2006|03:13] C:\Program Files\Real
                [30/06/2008|19:25] C:\Program Files\Samsung
                [12/08/2006|03:35] C:\Program Files\Services en ligne
                [12/08/2006|03:14] C:\Program Files\Sonic
                [05/11/2006|14:52] C:\Program Files\The Adventure Company
                [04/11/2006|20:11] C:\Program Files\TLC-Edusoft
                [28/02/2008|20:02] C:\Program Files\TomTom HOME 2
                [05/09/2008|23:03] C:\Program Files\Trend Micro
                [09/05/2007|11:23] C:\Program Files\Uninstall Information
                [07/09/2007|19:34] C:\Program Files\Virtual Look
                [12/06/2008|17:01] C:\Program Files\Windows Live
                [18/05/2008|12:07] C:\Program Files\Windows Live Toolbar
                [23/12/2006|21:04] C:\Program Files\Windows Media Connect 2
                [16/09/2007|13:11] C:\Program Files\Windows Media Player
                [15/11/2005|04:25] C:\Program Files\Windows NT
                [15/11/2005|04:25] C:\Program Files\Windows Plus
                [12/11/2005|02:09] C:\Program Files\WindowsUpdate
                [19/12/2006|22:14] C:\Program Files\WinRAR
                [15/11/2005|04:26] C:\Program Files\xerox
                [09/12/2007|20:23] C:\Program Files\Zylom Games

                --------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs

                [12/05/2008|10:50] C:\Program Files\Fichiers communs\Adobe
                [14/10/2007|13:07] C:\Program Files\Fichiers communs\DESIGNER
                [12/08/2006|03:09] C:\Program Files\Fichiers communs\HP
                [24/08/2007|13:38] C:\Program Files\Fichiers communs\InstallShield
                [12/08/2006|02:50] C:\Program Files\Fichiers communs\Java
                [12/08/2006|03:15] C:\Program Files\Fichiers communs\LightScribe
                [12/08/2006|03:15] C:\Program Files\Fichiers communs\LS Getting Started
                [08/08/2008|20:30] C:\Program Files\Fichiers communs\Microsoft Shared
                [15/11/2005|04:24] C:\Program Files\Fichiers communs\MSSoap
                [12/08/2006|03:18] C:\Program Files\Fichiers communs\muvee Technologies
                [25/10/2007|17:52] C:\Program Files\Fichiers communs\Oberon Media
                [15/11/2005|04:24] C:\Program Files\Fichiers communs\ODBC
                [30/03/2008|18:19] C:\Program Files\Fichiers communs\Real
                [15/11/2005|04:24] C:\Program Files\Fichiers communs\Services
                [12/08/2006|03:14] C:\Program Files\Fichiers communs\Sonic Shared
                [15/11/2005|04:24] C:\Program Files\Fichiers communs\SpeechEngines
                [12/08/2006|03:14] C:\Program Files\Fichiers communs\SureThing Shared
                [05/09/2008|23:16] C:\Program Files\Fichiers communs\Symantec Shared
                [13/06/2007|19:50] C:\Program Files\Fichiers communs\System
                [28/10/2006|13:31] C:\Program Files\Fichiers communs\Thraex Software
                [12/08/2006|03:14] C:\Program Files\Fichiers communs\TiVo Shared
                [12/06/2008|16:58] C:\Program Files\Fichiers communs\WindowsLiveInstaller
                [30/03/2008|18:19] C:\Program Files\Fichiers communs\xing shared

                --------------------\\ Process

                ( 56 Processes )

                IEXPLORE.EXE ~ [PID:580]

                --------------------\\ Recherche avec S_Lop

                Aucun fichier / dossier Lop trouvé !

                --------------------\\ Recherche de Fichiers / Dossiers Lop

                C:\DOCUME~1\ALLUSE~1\APPLIC~1\part dead amok eggs
                C:\DOCUME~1\ALLUSE~1\APPLIC~1\part dead amok eggs\TEAM WIPE.exe
                C:\DOCUME~1\HP_ADM~1\APPLIC~1\oncepo~1
                C:\DOCUME~1\HP_ADM~1\APPLIC~1\oncepo~1\info htm sixth rdr.exe
                C:\DOCUME~1\HP_ADM~1\APPLIC~1\oncepo~1\xvduxszf.exe
                C:\DOCUME~1\HP_ADM~1\APPLIC~1\oncepo~1\yhfmkesq.exe
                C:\Program Files\oncepo~1
                C:\Program Files\Circle Developement
                C:\Program Files\Circle Developement\Uninstall.exe
                C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@advertstream[2].txt
                C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@www.adserver5[1].txt
                C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@adultfriendfinder[1].txt
                C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@advertising[1].txt
                C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@advertising[3].txt
                C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@adin.bigpoint[2].txt
                C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@bigpoint[1].txt
                C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@fr1.seafight.bigpoint[2].txt
                C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@banner.casinoking[2].txt
                C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@casinoking[2].txt
                C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@banner.cotedazurpalace[2].txt
                C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@cotedazurpalace[1].txt
                C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@adopt.euroclick[2].txt
                C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@sr2.livemediasrv[1].txt
                C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@sr2.livemediasrv[2].txt
                C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@pacificpoker[1].txt
                C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@partygaming.122.2o7[1].txt
                C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@partypoker[2].txt
                C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@fr1.seafight.bigpoint[2].txt
                C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@32vegas[1].txt
                C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@banner.32vegas[2].txt
                C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@www.vegasaffiliates[1].txt
                C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@www.lop[2].txt
                C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@2xmoinscher[2].txt
                C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@www.2xmoinscher[2].txt
                C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@888[2].txt
                C:\WINDOWS\Tasks\A5C227359185A1E1.job

                --------------------\\ Verification du Registre

                [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                "amokrule"="C:\\DOCUME~1\\HP_ADM~1\\APPLIC~1\\ONCEPO~1\\BOOB DEAD.exe"

                [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                "Amok Eggs Four Web"="C:\\Documents and Settings\\All Users\\Application Data\\part dead amok eggs\\TEAM WIPE.exe"

                --------------------\\ Verification du fichier Hosts

                Fichier Hosts PROPRE

                --------------------\\ Recherche de fichiers avec Catchme

                catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                Rootkit scan 2008-09-05 23:36:14
                Windows 5.1.2600 Service Pack 2 NTFS
                scanning hidden processes ...
                scanning hidden files ...
                scan completed successfully
                hidden processes: 0
                hidden files: 656

                --------------------\\ Recherche d'autres infections

                Aucune autre infection trouvée !

                [F:562][D:20]-> C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp
                [F:784][D:0]-> C:\DOCUME~1\HP_ADM~1\Cookies
                [F:8403][D:39]-> C:\DOCUME~1\HP_ADM~1\LOCALS~1\TEMPOR~1\content.IE5

                1 - "C:\Lop SD\LopR_1.txt" - 05/09/2008|23:37 - Option : [1]

                --------------------\\ Fin du rapport a 23:37:17
                0
                1. sKe69 Contributeur sécurité
                  bien ...

                  Déconnetes toi et fermes toutes tes applications en cours .

                  relances Lop S&D :
                  --->choisis l'option 3 ( nettoyage ) et valides.

                  Une fois le scan terminer ,le Bloc-Notes contenant le rapport va s'ouvrir.
                  Postes ce rapport dans ta prochaine réponse pour analyse + un nouvel Hijackthis et attends la suite ....
                  0
                  1. Xtra
                    le rapport de Lop S&D :

                    --------------------\\ Lop S&D 4.2.4-0 XP/Vista

                    Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 2
                    X86-based PC ( Multiprocessor Free : AMD Athlon(tm) 64 X2 Dual Core Processor 3800+ )
                    BIOS : Phoenix - AwardBIOS v6.00PG
                    USER : HP_Administrateur ( Administrator )
                    BOOT : Normal boot
                    Antivirus : Avira AntiVir PersonalEdition 8.0.1.27 (Not Activated)

                    "C:\Lop SD" ( MAJ : 04-09-2008|09:55 )
                    Option : [3] ( 05/09/2008|23:50 )

                    \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ SUPPRESSION

                    Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\part dead amok eggs\TEAM WIPE.exe
                    Supprime! - C:\DOCUME~1\HP_ADM~1\APPLIC~1\oncepo~1\info htm sixth rdr.exe
                    Supprime! - C:\DOCUME~1\HP_ADM~1\APPLIC~1\oncepo~1\xvduxszf.exe
                    Supprime! - C:\DOCUME~1\HP_ADM~1\APPLIC~1\oncepo~1\yhfmkesq.exe
                    Supprime! - C:\Program Files\Circle Developement\Uninstall.exe
                    Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@advertstream[2].txt
                    Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@www.adserver5[1].txt
                    Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@adultfriendfinder[1].txt
                    Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@advertising[1].txt
                    Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@advertising[3].txt
                    Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@adin.bigpoint[2].txt
                    Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@bigpoint[1].txt
                    Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@fr1.seafight.bigpoint[2].txt
                    Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@banner.casinoking[2].txt
                    Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@casinoking[2].txt
                    Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@banner.cotedazurpalace[2].txt
                    Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@cotedazurpalace[1].txt
                    Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@adopt.euroclick[2].txt
                    Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@sr2.livemediasrv[1].txt
                    Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@sr2.livemediasrv[2].txt
                    Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@pacificpoker[1].txt
                    Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@partygaming.122.2o7[1].txt
                    Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@partypoker[2].txt
                    Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@32vegas[1].txt
                    Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@banner.32vegas[2].txt
                    Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@www.vegasaffiliates[1].txt
                    Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@www.lop[2].txt
                    Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@2xmoinscher[2].txt
                    Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@www.2xmoinscher[2].txt
                    Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@888[2].txt
                    Supprime! - C:\WINDOWS\Tasks\A5C227359185A1E1.job
                    Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\part dead amok eggs
                    Supprime! - C:\DOCUME~1\HP_ADM~1\APPLIC~1\oncepo~1
                    Supprime! - C:\Program Files\oncepo~1
                    Supprime! - C:\Program Files\Circle Developement

                    \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

                    --------------------\\ Listing des dossiers dans APPLIC~1

                    [15/11/2005|04:22] C:\DOCUME~1\ADMINI~1\APPLIC~1\Identities
                    [12/08/2006|03:51] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft
                    [12/08/2006|03:13] C:\DOCUME~1\ADMINI~1\APPLIC~1\Real

                    [12/05/2008|10:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
                    [24/08/2007|13:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
                    [23/06/2008|19:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Avira
                    [06/07/2008|11:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Azureus
                    [12/08/2006|03:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink
                    [17/09/2007|18:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
                    [22/06/2008|10:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Grisoft
                    [12/08/2006|03:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Hewlett-Packard
                    [20/01/2007|21:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\HP
                    [12/08/2006|03:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
                    [30/12/2006|21:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\iWin
                    [21/08/2007|13:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\JollyBear
                    [03/03/2008|12:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
                    [15/10/2007|15:02] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
                    [24/06/2007|08:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Mozilla
                    [28/10/2006|14:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\muvee Technologies
                    [05/09/2008|23:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\NortonInstaller
                    [27/10/2006|21:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Otto
                    [21/08/2007|13:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\PlayFirst
                    [14/08/2007|13:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sandlot Games
                    [12/08/2006|02:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBSI
                    [18/05/2008|12:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
                    [12/08/2006|03:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sonic
                    [27/05/2007|20:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SpinTop Games
                    [08/11/2007|17:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
                    [17/11/2007|19:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TERMINAL Studio
                    [28/02/2008|20:02] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TomTom
                    [23/12/2006|21:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
                    [31/05/2007|17:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Live Toolbar
                    [12/06/2008|16:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
                    [13/05/2007|09:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Zylom

                    [15/11/2005|04:22] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
                    [12/08/2006|03:51] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
                    [12/08/2006|03:13] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Real

                    [24/07/2008|11:18] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Adobe
                    [27/01/2007|17:49] C:\DOCUME~1\HP_ADM~1\APPLIC~1\AdobeUM
                    [24/07/2008|15:52] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Apple Computer
                    [18/05/2008|11:57] C:\DOCUME~1\HP_ADM~1\APPLIC~1\ArcSoft
                    [06/07/2008|12:02] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Azureus
                    [19/08/2007|18:57] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Beep Industries
                    [21/01/2007|19:44] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Canvas Multi-Media
                    [06/01/2007|20:52] C:\DOCUME~1\HP_ADM~1\APPLIC~1\CyberLink
                    [23/12/2007|20:20] C:\DOCUME~1\HP_ADM~1\APPLIC~1\EPSON
                    [29/07/2007|13:18] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Gaijin Ent
                    [28/10/2006|13:26] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Google
                    [22/06/2008|10:48] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Grisoft
                    [31/10/2006|11:41] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Help
                    [27/10/2006|21:28] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Hewlett-Packard
                    [25/02/2007|21:49] C:\DOCUME~1\HP_ADM~1\APPLIC~1\HP
                    [27/10/2006|21:54] C:\DOCUME~1\HP_ADM~1\APPLIC~1\HPQ
                    [01/12/2007|16:27] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Identities
                    [23/12/2007|20:05] C:\DOCUME~1\HP_ADM~1\APPLIC~1\InstallShield
                    [05/08/2007|18:22] C:\DOCUME~1\HP_ADM~1\APPLIC~1\iWin
                    [31/10/2006|10:34] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Leadertech
                    [28/05/2007|10:53] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Macromedia
                    [17/11/2007|19:40] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Magic Academy
                    [18/05/2008|11:19] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Microsoft
                    [24/06/2007|15:31] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Mozilla
                    [19/08/2007|15:33] C:\DOCUME~1\HP_ADM~1\APPLIC~1\My Games
                    [27/10/2006|21:33] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Otto
                    [21/08/2007|13:14] C:\DOCUME~1\HP_ADM~1\APPLIC~1\PlayFirst
                    [27/10/2006|21:37] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Real
                    [30/06/2008|19:37] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Samsung
                    [18/05/2008|09:42] C:\DOCUME~1\HP_ADM~1\APPLIC~1\skypePM
                    [31/10/2006|10:38] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Sonic
                    [30/10/2006|18:51] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Sun
                    [24/06/2007|15:31] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Talkback
                    [31/10/2006|10:51] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Template
                    [28/02/2008|20:02] C:\DOCUME~1\HP_ADM~1\APPLIC~1\TomTom
                    [24/11/2007|20:18] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Zylom

                    [15/11/2005|04:22] C:\DOCUME~1\INVIT~1\APPLIC~1\Identities
                    [07/04/2007|11:51] C:\DOCUME~1\INVIT~1\APPLIC~1\Macromedia
                    [12/08/2006|03:51] C:\DOCUME~1\INVIT~1\APPLIC~1\Microsoft
                    [12/08/2006|03:13] C:\DOCUME~1\INVIT~1\APPLIC~1\Real
                    [07/04/2007|11:57] C:\DOCUME~1\INVIT~1\APPLIC~1\Sun

                    [15/11/2005|04:23] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

                    [15/11/2005|04:23] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

                    --------------------\\ Tâches planifiées dans C:\WINDOWS\tasks

                    [05/09/2008 23:18][--ah-----] C:\WINDOWS\tasks\SA.DAT
                    [10/08/2004 13:00][-rah-----] C:\WINDOWS\tasks\desktop.ini

                    --------------------\\ Listing des dossiers dans C:\Program Files

                    [15/07/2008|19:58] C:\Program Files\Adobe
                    [18/05/2008|11:57] C:\Program Files\Atout Clic 5e
                    [23/06/2008|19:54] C:\Program Files\Avira
                    [16/09/2007|12:42] C:\Program Files\Barbie(R) Aventures questres
                    [15/09/2007|14:11] C:\Program Files\Bullfrog
                    [18/05/2008|11:58] C:\Program Files\calendrier_eval 1.0
                    [22/06/2008|10:28] C:\Program Files\CCleaner
                    [12/11/2005|02:09] C:\Program Files\ComPlus Applications
                    [30/06/2008|19:27] C:\Program Files\DIFX
                    [12/08/2006|03:19] C:\Program Files\DivX
                    [12/08/2006|03:33] C:\Program Files\EasyBits
                    [22/06/2008|11:52] C:\Program Files\EasyBits For Kids
                    [08/12/2007|17:47] C:\Program Files\Enjoy 5e
                    [28/10/2006|13:32] C:\Program Files\Enjoy 6e
                    [23/12/2007|20:09] C:\Program Files\EPSON
                    [23/06/2008|20:01] C:\Program Files\Fichiers communs
                    [12/08/2006|02:44] C:\Program Files\FrenchOtto
                    [25/10/2007|17:52] C:\Program Files\Gamenext
                    [22/06/2008|10:49] C:\Program Files\GemMasterFrench
                    [18/05/2008|12:01] C:\Program Files\Google
                    [22/06/2008|10:47] C:\Program Files\Grisoft
                    [01/11/2006|16:40] C:\Program Files\Hachette Multim‚dia
                    [24/08/2008|23:47] C:\Program Files\Hewlett-Packard
                    [24/08/2008|23:48] C:\Program Files\HP
                    [12/08/2006|03:13] C:\Program Files\HP DigitalMedia Archive
                    [30/06/2008|19:26] C:\Program Files\InstallShield Installation Information
                    [14/08/2008|20:47] C:\Program Files\Internet Explorer
                    [31/10/2006|19:51] C:\Program Files\Java
                    [18/11/2006|15:31] C:\Program Files\Mattel Media
                    [14/08/2008|20:48] C:\Program Files\Messenger
                    [16/06/2008|15:48] C:\Program Files\Messenger Plus! Live
                    [01/06/2007|19:05] C:\Program Files\Microsoft CAPICOM 2.1.0.2
                    [16/09/2007|12:52] C:\Program Files\Microsoft Encarta
                    [15/11/2005|04:24] C:\Program Files\microsoft frontpage
                    [18/05/2008|12:03] C:\Program Files\Microsoft Office
                    [14/10/2007|13:07] C:\Program Files\Microsoft Visual Studio
                    [18/05/2008|12:03] C:\Program Files\Microsoft Works
                    [14/10/2007|13:07] C:\Program Files\Microsoft.NET
                    [15/11/2005|04:24] C:\Program Files\Movie Maker
                    [18/05/2008|12:04] C:\Program Files\Mozilla Firefox
                    [15/11/2005|04:24] C:\Program Files\MSN
                    [15/11/2005|04:25] C:\Program Files\MSN Gaming Zone
                    [17/11/2006|12:36] C:\Program Files\MSXML 4.0
                    [12/08/2006|03:19] C:\Program Files\muvee Technologies
                    [11/05/2007|13:41] C:\Program Files\My Photo Calendars & Cards
                    [15/11/2005|04:25] C:\Program Files\NetMeeting
                    [15/11/2005|04:25] C:\Program Files\Online Services
                    [02/12/2007|00:16] C:\Program Files\Optimum 95 Bt
                    [13/06/2007|19:50] C:\Program Files\Outlook Express
                    [12/08/2006|03:29] C:\Program Files\PC-Doctor 5 for Windows
                    [24/08/2007|13:43] C:\Program Files\QuickTime
                    [12/08/2006|03:13] C:\Program Files\Real
                    [30/06/2008|19:25] C:\Program Files\Samsung
                    [12/08/2006|03:35] C:\Program Files\Services en ligne
                    [12/08/2006|03:14] C:\Program Files\Sonic
                    [05/11/2006|14:52] C:\Program Files\The Adventure Company
                    [04/11/2006|20:11] C:\Program Files\TLC-Edusoft
                    [28/02/2008|20:02] C:\Program Files\TomTom HOME 2
                    [05/09/2008|23:03] C:\Program Files\Trend Micro
                    [09/05/2007|11:23] C:\Program Files\Uninstall Information
                    [07/09/2007|19:34] C:\Program Files\Virtual Look
                    [12/06/2008|17:01] C:\Program Files\Windows Live
                    [18/05/2008|12:07] C:\Program Files\Windows Live Toolbar
                    [23/12/2006|21:04] C:\Program Files\Windows Media Connect 2
                    [16/09/2007|13:11] C:\Program Files\Windows Media Player
                    [15/11/2005|04:25] C:\Program Files\Windows NT
                    [15/11/2005|04:25] C:\Program Files\Windows Plus
                    [12/11/2005|02:09] C:\Program Files\WindowsUpdate
                    [19/12/2006|22:14] C:\Program Files\WinRAR
                    [15/11/2005|04:26] C:\Program Files\xerox
                    [09/12/2007|20:23] C:\Program Files\Zylom Games

                    --------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs

                    [12/05/2008|10:50] C:\Program Files\Fichiers communs\Adobe
                    [14/10/2007|13:07] C:\Program Files\Fichiers communs\DESIGNER
                    [12/08/2006|03:09] C:\Program Files\Fichiers communs\HP
                    [24/08/2007|13:38] C:\Program Files\Fichiers communs\InstallShield
                    [12/08/2006|02:50] C:\Program Files\Fichiers communs\Java
                    [12/08/2006|03:15] C:\Program Files\Fichiers communs\LightScribe
                    [12/08/2006|03:15] C:\Program Files\Fichiers communs\LS Getting Started
                    [08/08/2008|20:30] C:\Program Files\Fichiers communs\Microsoft Shared
                    [15/11/2005|04:24] C:\Program Files\Fichiers communs\MSSoap
                    [12/08/2006|03:18] C:\Program Files\Fichiers communs\muvee Technologies
                    [25/10/2007|17:52] C:\Program Files\Fichiers communs\Oberon Media
                    [15/11/2005|04:24] C:\Program Files\Fichiers communs\ODBC
                    [30/03/2008|18:19] C:\Program Files\Fichiers communs\Real
                    [15/11/2005|04:24] C:\Program Files\Fichiers communs\Services
                    [12/08/2006|03:14] C:\Program Files\Fichiers communs\Sonic Shared
                    [15/11/2005|04:24] C:\Program Files\Fichiers communs\SpeechEngines
                    [12/08/2006|03:14] C:\Program Files\Fichiers communs\SureThing Shared
                    [05/09/2008|23:16] C:\Program Files\Fichiers communs\Symantec Shared
                    [13/06/2007|19:50] C:\Program Files\Fichiers communs\System
                    [28/10/2006|13:31] C:\Program Files\Fichiers communs\Thraex Software
                    [12/08/2006|03:14] C:\Program Files\Fichiers communs\TiVo Shared
                    [12/06/2008|16:58] C:\Program Files\Fichiers communs\WindowsLiveInstaller
                    [30/03/2008|18:19] C:\Program Files\Fichiers communs\xing shared

                    --------------------\\ Process

                    ( 55 Processes )

                    ... OK !

                    --------------------\\ Recherche avec S_Lop

                    Aucun fichier / dossier Lop trouvé !

                    --------------------\\ Recherche de Fichiers / Dossiers Lop

                    Aucun fichier / dossier Lop trouvé !

                    --------------------\\ Verification du Registre

                    ..... OK !

                    --------------------\\ Verification du fichier Hosts

                    Fichier Hosts PROPRE

                    --------------------\\ Recherche de fichiers avec Catchme

                    catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                    Rootkit scan 2008-09-05 23:50:47
                    Windows 5.1.2600 Service Pack 2 NTFS
                    scanning hidden processes ...
                    scanning hidden files ...
                    scan completed successfully
                    hidden processes: 0
                    hidden files: 656

                    --------------------\\ Recherche d'autres infections

                    Aucune autre infection trouvée !

                    [F:562][D:20]-> C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp
                    [F:759][D:0]-> C:\DOCUME~1\HP_ADM~1\Cookies
                    [F:8522][D:39]-> C:\DOCUME~1\HP_ADM~1\LOCALS~1\TEMPOR~1\content.IE5

                    1 - "C:\Lop SD\LopR_1.txt" - 05/09/2008|23:37 - Option : [1]
                    2 - "C:\Lop SD\LopR_2.txt" - 05/09/2008|23:51 - Option : [3]

                    --------------------\\ Fin du rapport a 23:51:48

                    et celui de Hijackthis :

                    Logfile of Trend Micro HijackThis v2.0.2
                    Scan saved at 23:52:08, on 05/09/2008
                    Platform: Windows XP SP2 (WinNT 5.01.2600)
                    MSIE: Internet Explorer v7.00 (7.00.6000.16705)
                    Boot mode: Normal

                    Running processes:
                    C:\WINDOWS\System32\smss.exe
                    C:\WINDOWS\system32\winlogon.exe
                    C:\WINDOWS\system32\services.exe
                    C:\WINDOWS\system32\lsass.exe
                    C:\WINDOWS\system32\svchost.exe
                    C:\WINDOWS\System32\svchost.exe
                    C:\WINDOWS\system32\svchost.exe
                    C:\WINDOWS\system32\spoolsv.exe
                    C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
                    C:\WINDOWS\Explorer.EXE
                    C:\WINDOWS\ehome\ehtray.exe
                    C:\WINDOWS\RTHDCPL.EXE
                    C:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe
                    C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
                    C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
                    C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
                    C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe
                    C:\Program Files\QuickTime\qttask.exe
                    C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
                    C:\Program Files\Fichiers communs\Real\Update_OB\RealOneMessageCenter.exe
                    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
                    C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
                    C:\WINDOWS\system32\ctfmon.exe
                    C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
                    C:\Program Files\TomTom HOME 2\HOMERunner.exe
                    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                    C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
                    C:\WINDOWS\arservice.exe
                    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                    C:\WINDOWS\eHome\ehRecvr.exe
                    C:\WINDOWS\eHome\ehSched.exe
                    C:\WINDOWS\system32\ezNTSvc.exe
                    C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
                    C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
                    C:\WINDOWS\system32\nvsvc32.exe
                    C:\WINDOWS\system32\svchost.exe
                    C:\WINDOWS\system32\dllhost.exe
                    C:\WINDOWS\eHome\ehmsas.exe
                    C:\WINDOWS\system32\wuauclt.exe
                    C:\HP\KBD\KBD.EXE
                    c:\windows\system\hpsysdrv.exe
                    C:\Program Files\Java\jre1.5.0_09\bin\jucheck.exe
                    C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
                    C:\WINDOWS\system32\cmd.exe
                    C:\WINDOWS\system32\NOTEPAD.EXE
                    C:\Program Files\Trend Micro\HijackThis\Monjack.exe

                    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
                    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://fr.search.yahoo.com/?fr=cb-hp06
                    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
                    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.wikipedia.org/wiki/Accueil
                    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
                    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = https://fr.search.yahoo.com/?fr=cb-hp06
                    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF
                    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
                    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer optimisé pour MSN
                    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxybiblio.hec.fr:8080
                    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                    F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\ezShellStart.exe
                    O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
                    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
                    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
                    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                    O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                    O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
                    O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode
                    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
                    O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE
                    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
                    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
                    O4 - HKLM\..\Run: [DMAScheduler] "c:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe"
                    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
                    O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
                    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
                    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
                    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                    O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe"
                    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
                    O4 - HKLM\..\Run: [EEventManager] C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
                    O4 - HKLM\..\Run: [MsgCenterExe] "C:\Program Files\Fichiers communs\Real\Update_OB\RealOneMessageCenter.exe" -osboot
                    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
                    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
                    O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
                    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
                    O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\HOMERunner.exe"
                    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                    O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
                    O4 - .DEFAULT User Startup: PinMcLnk.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
                    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                    O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.05\AMVConverter\grab.html
                    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
                    O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.05\MediaManager\grab.html
                    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
                    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
                    O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                    O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                    O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
                    O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
                    O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
                    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                    O16 - DPF: STS Secure Viewer - http://83.206.149.125:8080/pmasweb//tools/pviewersetup.cab
                    O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20070501/qtinstall.info.apple.com/qtactivex/qtplugin.cab
                    O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://www.can.com.sg/mwf/mgaxctrl.cab
                    O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game09.zylom.com/activex/zylomgamesplayer.cab
                    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
                    O18 - Filter hijack: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - (no file)
                    O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
                    O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
                    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                    O23 - Service: EasyBits Magic Desktop Services for Windows NT (ezntsvc) - EasyBits Software Corp. - C:\WINDOWS\system32\ezNTSvc.exe
                    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
                    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
                    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
                    O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
                    0
                    1. Xtra
                      le rapport de Lop S&D :

                      --------------------\\ Lop S&D 4.2.4-0 XP/Vista

                      Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 2
                      X86-based PC ( Multiprocessor Free : AMD Athlon(tm) 64 X2 Dual Core Processor 3800+ )
                      BIOS : Phoenix - AwardBIOS v6.00PG
                      USER : HP_Administrateur ( Administrator )
                      BOOT : Normal boot
                      Antivirus : Avira AntiVir PersonalEdition 8.0.1.27 (Not Activated)

                      "C:\Lop SD" ( MAJ : 04-09-2008|09:55 )
                      Option : [3] ( 05/09/2008|23:50 )

                      \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ SUPPRESSION

                      Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\part dead amok eggs\TEAM WIPE.exe
                      Supprime! - C:\DOCUME~1\HP_ADM~1\APPLIC~1\oncepo~1\info htm sixth rdr.exe
                      Supprime! - C:\DOCUME~1\HP_ADM~1\APPLIC~1\oncepo~1\xvduxszf.exe
                      Supprime! - C:\DOCUME~1\HP_ADM~1\APPLIC~1\oncepo~1\yhfmkesq.exe
                      Supprime! - C:\Program Files\Circle Developement\Uninstall.exe
                      Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@advertstream[2].txt
                      Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@www.adserver5[1].txt
                      Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@adultfriendfinder[1].txt
                      Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@advertising[1].txt
                      Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@advertising[3].txt
                      Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@adin.bigpoint[2].txt
                      Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@bigpoint[1].txt
                      Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@fr1.seafight.bigpoint[2].txt
                      Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@banner.casinoking[2].txt
                      Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@casinoking[2].txt
                      Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@banner.cotedazurpalace[2].txt
                      Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@cotedazurpalace[1].txt
                      Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@adopt.euroclick[2].txt
                      Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@sr2.livemediasrv[1].txt
                      Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@sr2.livemediasrv[2].txt
                      Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@pacificpoker[1].txt
                      Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@partygaming.122.2o7[1].txt
                      Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@partypoker[2].txt
                      Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@32vegas[1].txt
                      Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@banner.32vegas[2].txt
                      Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@www.vegasaffiliates[1].txt
                      Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@www.lop[2].txt
                      Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@2xmoinscher[2].txt
                      Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@www.2xmoinscher[2].txt
                      Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@888[2].txt
                      Supprime! - C:\WINDOWS\Tasks\A5C227359185A1E1.job
                      Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\part dead amok eggs
                      Supprime! - C:\DOCUME~1\HP_ADM~1\APPLIC~1\oncepo~1
                      Supprime! - C:\Program Files\oncepo~1
                      Supprime! - C:\Program Files\Circle Developement

                      \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

                      --------------------\\ Listing des dossiers dans APPLIC~1

                      [15/11/2005|04:22] C:\DOCUME~1\ADMINI~1\APPLIC~1\Identities
                      [12/08/2006|03:51] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft
                      [12/08/2006|03:13] C:\DOCUME~1\ADMINI~1\APPLIC~1\Real

                      [12/05/2008|10:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
                      [24/08/2007|13:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
                      [23/06/2008|19:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Avira
                      [06/07/2008|11:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Azureus
                      [12/08/2006|03:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink
                      [17/09/2007|18:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
                      [22/06/2008|10:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Grisoft
                      [12/08/2006|03:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Hewlett-Packard
                      [20/01/2007|21:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\HP
                      [12/08/2006|03:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
                      [30/12/2006|21:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\iWin
                      [21/08/2007|13:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\JollyBear
                      [03/03/2008|12:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
                      [15/10/2007|15:02] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
                      [24/06/2007|08:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Mozilla
                      [28/10/2006|14:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\muvee Technologies
                      [05/09/2008|23:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\NortonInstaller
                      [27/10/2006|21:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Otto
                      [21/08/2007|13:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\PlayFirst
                      [14/08/2007|13:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sandlot Games
                      [12/08/2006|02:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBSI
                      [18/05/2008|12:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
                      [12/08/2006|03:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sonic
                      [27/05/2007|20:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SpinTop Games
                      [08/11/2007|17:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
                      [17/11/2007|19:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TERMINAL Studio
                      [28/02/2008|20:02] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TomTom
                      [23/12/2006|21:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
                      [31/05/2007|17:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Live Toolbar
                      [12/06/2008|16:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
                      [13/05/2007|09:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Zylom

                      [15/11/2005|04:22] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
                      [12/08/2006|03:51] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
                      [12/08/2006|03:13] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Real

                      [24/07/2008|11:18] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Adobe
                      [27/01/2007|17:49] C:\DOCUME~1\HP_ADM~1\APPLIC~1\AdobeUM
                      [24/07/2008|15:52] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Apple Computer
                      [18/05/2008|11:57] C:\DOCUME~1\HP_ADM~1\APPLIC~1\ArcSoft
                      [06/07/2008|12:02] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Azureus
                      [19/08/2007|18:57] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Beep Industries
                      [21/01/2007|19:44] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Canvas Multi-Media
                      [06/01/2007|20:52] C:\DOCUME~1\HP_ADM~1\APPLIC~1\CyberLink
                      [23/12/2007|20:20] C:\DOCUME~1\HP_ADM~1\APPLIC~1\EPSON
                      [29/07/2007|13:18] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Gaijin Ent
                      [28/10/2006|13:26] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Google
                      [22/06/2008|10:48] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Grisoft
                      [31/10/2006|11:41] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Help
                      [27/10/2006|21:28] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Hewlett-Packard
                      [25/02/2007|21:49] C:\DOCUME~1\HP_ADM~1\APPLIC~1\HP
                      [27/10/2006|21:54] C:\DOCUME~1\HP_ADM~1\APPLIC~1\HPQ
                      [01/12/2007|16:27] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Identities
                      [23/12/2007|20:05] C:\DOCUME~1\HP_ADM~1\APPLIC~1\InstallShield
                      [05/08/2007|18:22] C:\DOCUME~1\HP_ADM~1\APPLIC~1\iWin
                      [31/10/2006|10:34] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Leadertech
                      [28/05/2007|10:53] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Macromedia
                      [17/11/2007|19:40] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Magic Academy
                      [18/05/2008|11:19] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Microsoft
                      [24/06/2007|15:31] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Mozilla
                      [19/08/2007|15:33] C:\DOCUME~1\HP_ADM~1\APPLIC~1\My Games
                      [27/10/2006|21:33] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Otto
                      [21/08/2007|13:14] C:\DOCUME~1\HP_ADM~1\APPLIC~1\PlayFirst
                      [27/10/2006|21:37] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Real
                      [30/06/2008|19:37] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Samsung
                      [18/05/2008|09:42] C:\DOCUME~1\HP_ADM~1\APPLIC~1\skypePM
                      [31/10/2006|10:38] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Sonic
                      [30/10/2006|18:51] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Sun
                      [24/06/2007|15:31] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Talkback
                      [31/10/2006|10:51] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Template
                      [28/02/2008|20:02] C:\DOCUME~1\HP_ADM~1\APPLIC~1\TomTom
                      [24/11/2007|20:18] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Zylom

                      [15/11/2005|04:22] C:\DOCUME~1\INVIT~1\APPLIC~1\Identities
                      [07/04/2007|11:51] C:\DOCUME~1\INVIT~1\APPLIC~1\Macromedia
                      [12/08/2006|03:51] C:\DOCUME~1\INVIT~1\APPLIC~1\Microsoft
                      [12/08/2006|03:13] C:\DOCUME~1\INVIT~1\APPLIC~1\Real
                      [07/04/2007|11:57] C:\DOCUME~1\INVIT~1\APPLIC~1\Sun

                      [15/11/2005|04:23] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

                      [15/11/2005|04:23] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

                      --------------------\\ Tâches planifiées dans C:\WINDOWS\tasks

                      [05/09/2008 23:18][--ah-----] C:\WINDOWS\tasks\SA.DAT
                      [10/08/2004 13:00][-rah-----] C:\WINDOWS\tasks\desktop.ini

                      --------------------\\ Listing des dossiers dans C:\Program Files

                      [15/07/2008|19:58] C:\Program Files\Adobe
                      [18/05/2008|11:57] C:\Program Files\Atout Clic 5e
                      [23/06/2008|19:54] C:\Program Files\Avira
                      [16/09/2007|12:42] C:\Program Files\Barbie(R) Aventures questres
                      [15/09/2007|14:11] C:\Program Files\Bullfrog
                      [18/05/2008|11:58] C:\Program Files\calendrier_eval 1.0
                      [22/06/2008|10:28] C:\Program Files\CCleaner
                      [12/11/2005|02:09] C:\Program Files\ComPlus Applications
                      [30/06/2008|19:27] C:\Program Files\DIFX
                      [12/08/2006|03:19] C:\Program Files\DivX
                      [12/08/2006|03:33] C:\Program Files\EasyBits
                      [22/06/2008|11:52] C:\Program Files\EasyBits For Kids
                      [08/12/2007|17:47] C:\Program Files\Enjoy 5e
                      [28/10/2006|13:32] C:\Program Files\Enjoy 6e
                      [23/12/2007|20:09] C:\Program Files\EPSON
                      [23/06/2008|20:01] C:\Program Files\Fichiers communs
                      [12/08/2006|02:44] C:\Program Files\FrenchOtto
                      [25/10/2007|17:52] C:\Program Files\Gamenext
                      [22/06/2008|10:49] C:\Program Files\GemMasterFrench
                      [18/05/2008|12:01] C:\Program Files\Google
                      [22/06/2008|10:47] C:\Program Files\Grisoft
                      [01/11/2006|16:40] C:\Program Files\Hachette Multim‚dia
                      [24/08/2008|23:47] C:\Program Files\Hewlett-Packard
                      [24/08/2008|23:48] C:\Program Files\HP
                      [12/08/2006|03:13] C:\Program Files\HP DigitalMedia Archive
                      [30/06/2008|19:26] C:\Program Files\InstallShield Installation Information
                      [14/08/2008|20:47] C:\Program Files\Internet Explorer
                      [31/10/2006|19:51] C:\Program Files\Java
                      [18/11/2006|15:31] C:\Program Files\Mattel Media
                      [14/08/2008|20:48] C:\Program Files\Messenger
                      [16/06/2008|15:48] C:\Program Files\Messenger Plus! Live
                      [01/06/2007|19:05] C:\Program Files\Microsoft CAPICOM 2.1.0.2
                      [16/09/2007|12:52] C:\Program Files\Microsoft Encarta
                      [15/11/2005|04:24] C:\Program Files\microsoft frontpage
                      [18/05/2008|12:03] C:\Program Files\Microsoft Office
                      [14/10/2007|13:07] C:\Program Files\Microsoft Visual Studio
                      [18/05/2008|12:03] C:\Program Files\Microsoft Works
                      [14/10/2007|13:07] C:\Program Files\Microsoft.NET
                      [15/11/2005|04:24] C:\Program Files\Movie Maker
                      [18/05/2008|12:04] C:\Program Files\Mozilla Firefox
                      [15/11/2005|04:24] C:\Program Files\MSN
                      [15/11/2005|04:25] C:\Program Files\MSN Gaming Zone
                      [17/11/2006|12:36] C:\Program Files\MSXML 4.0
                      [12/08/2006|03:19] C:\Program Files\muvee Technologies
                      [11/05/2007|13:41] C:\Program Files\My Photo Calendars & Cards
                      [15/11/2005|04:25] C:\Program Files\NetMeeting
                      [15/11/2005|04:25] C:\Program Files\Online Services
                      [02/12/2007|00:16] C:\Program Files\Optimum 95 Bt
                      [13/06/2007|19:50] C:\Program Files\Outlook Express
                      [12/08/2006|03:29] C:\Program Files\PC-Doctor 5 for Windows
                      [24/08/2007|13:43] C:\Program Files\QuickTime
                      [12/08/2006|03:13] C:\Program Files\Real
                      [30/06/2008|19:25] C:\Program Files\Samsung
                      [12/08/2006|03:35] C:\Program Files\Services en ligne
                      [12/08/2006|03:14] C:\Program Files\Sonic
                      [05/11/2006|14:52] C:\Program Files\The Adventure Company
                      [04/11/2006|20:11] C:\Program Files\TLC-Edusoft
                      [28/02/2008|20:02] C:\Program Files\TomTom HOME 2
                      [05/09/2008|23:03] C:\Program Files\Trend Micro
                      [09/05/2007|11:23] C:\Program Files\Uninstall Information
                      [07/09/2007|19:34] C:\Program Files\Virtual Look
                      [12/06/2008|17:01] C:\Program Files\Windows Live
                      [18/05/2008|12:07] C:\Program Files\Windows Live Toolbar
                      [23/12/2006|21:04] C:\Program Files\Windows Media Connect 2
                      [16/09/2007|13:11] C:\Program Files\Windows Media Player
                      [15/11/2005|04:25] C:\Program Files\Windows NT
                      [15/11/2005|04:25] C:\Program Files\Windows Plus
                      [12/11/2005|02:09] C:\Program Files\WindowsUpdate
                      [19/12/2006|22:14] C:\Program Files\WinRAR
                      [15/11/2005|04:26] C:\Program Files\xerox
                      [09/12/2007|20:23] C:\Program Files\Zylom Games

                      --------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs

                      [12/05/2008|10:50] C:\Program Files\Fichiers communs\Adobe
                      [14/10/2007|13:07] C:\Program Files\Fichiers communs\DESIGNER
                      [12/08/2006|03:09] C:\Program Files\Fichiers communs\HP
                      [24/08/2007|13:38] C:\Program Files\Fichiers communs\InstallShield
                      [12/08/2006|02:50] C:\Program Files\Fichiers communs\Java
                      [12/08/2006|03:15] C:\Program Files\Fichiers communs\LightScribe
                      [12/08/2006|03:15] C:\Program Files\Fichiers communs\LS Getting Started
                      [08/08/2008|20:30] C:\Program Files\Fichiers communs\Microsoft Shared
                      [15/11/2005|04:24] C:\Program Files\Fichiers communs\MSSoap
                      [12/08/2006|03:18] C:\Program Files\Fichiers communs\muvee Technologies
                      [25/10/2007|17:52] C:\Program Files\Fichiers communs\Oberon Media
                      [15/11/2005|04:24] C:\Program Files\Fichiers communs\ODBC
                      [30/03/2008|18:19] C:\Program Files\Fichiers communs\Real
                      [15/11/2005|04:24] C:\Program Files\Fichiers communs\Services
                      [12/08/2006|03:14] C:\Program Files\Fichiers communs\Sonic Shared
                      [15/11/2005|04:24] C:\Program Files\Fichiers communs\SpeechEngines
                      [12/08/2006|03:14] C:\Program Files\Fichiers communs\SureThing Shared
                      [05/09/2008|23:16] C:\Program Files\Fichiers communs\Symantec Shared
                      [13/06/2007|19:50] C:\Program Files\Fichiers communs\System
                      [28/10/2006|13:31] C:\Program Files\Fichiers communs\Thraex Software
                      [12/08/2006|03:14] C:\Program Files\Fichiers communs\TiVo Shared
                      [12/06/2008|16:58] C:\Program Files\Fichiers communs\WindowsLiveInstaller
                      [30/03/2008|18:19] C:\Program Files\Fichiers communs\xing shared

                      --------------------\\ Process

                      ( 55 Processes )

                      ... OK !

                      --------------------\\ Recherche avec S_Lop

                      Aucun fichier / dossier Lop trouvé !

                      --------------------\\ Recherche de Fichiers / Dossiers Lop

                      Aucun fichier / dossier Lop trouvé !

                      --------------------\\ Verification du Registre

                      ..... OK !

                      --------------------\\ Verification du fichier Hosts

                      Fichier Hosts PROPRE

                      --------------------\\ Recherche de fichiers avec Catchme

                      catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                      Rootkit scan 2008-09-05 23:50:47
                      Windows 5.1.2600 Service Pack 2 NTFS
                      scanning hidden processes ...
                      scanning hidden files ...
                      scan completed successfully
                      hidden processes: 0
                      hidden files: 656

                      --------------------\\ Recherche d'autres infections

                      Aucune autre infection trouvée !

                      [F:562][D:20]-> C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp
                      [F:759][D:0]-> C:\DOCUME~1\HP_ADM~1\Cookies
                      [F:8522][D:39]-> C:\DOCUME~1\HP_ADM~1\LOCALS~1\TEMPOR~1\content.IE5

                      1 - "C:\Lop SD\LopR_1.txt" - 05/09/2008|23:37 - Option : [1]
                      2 - "C:\Lop SD\LopR_2.txt" - 05/09/2008|23:51 - Option : [3]

                      --------------------\\ Fin du rapport a 23:51:48

                      et celui de Hijackthis :

                      Logfile of Trend Micro HijackThis v2.0.2
                      Scan saved at 23:52:08, on 05/09/2008
                      Platform: Windows XP SP2 (WinNT 5.01.2600)
                      MSIE: Internet Explorer v7.00 (7.00.6000.16705)
                      Boot mode: Normal

                      Running processes:
                      C:\WINDOWS\System32\smss.exe
                      C:\WINDOWS\system32\winlogon.exe
                      C:\WINDOWS\system32\services.exe
                      C:\WINDOWS\system32\lsass.exe
                      C:\WINDOWS\system32\svchost.exe
                      C:\WINDOWS\System32\svchost.exe
                      C:\WINDOWS\system32\svchost.exe
                      C:\WINDOWS\system32\spoolsv.exe
                      C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
                      C:\WINDOWS\Explorer.EXE
                      C:\WINDOWS\ehome\ehtray.exe
                      C:\WINDOWS\RTHDCPL.EXE
                      C:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe
                      C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
                      C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
                      C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
                      C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe
                      C:\Program Files\QuickTime\qttask.exe
                      C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
                      C:\Program Files\Fichiers communs\Real\Update_OB\RealOneMessageCenter.exe
                      C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
                      C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
                      C:\WINDOWS\system32\ctfmon.exe
                      C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
                      C:\Program Files\TomTom HOME 2\HOMERunner.exe
                      C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                      C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
                      C:\WINDOWS\arservice.exe
                      C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                      C:\WINDOWS\eHome\ehRecvr.exe
                      C:\WINDOWS\eHome\ehSched.exe
                      C:\WINDOWS\system32\ezNTSvc.exe
                      C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
                      C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
                      C:\WINDOWS\system32\nvsvc32.exe
                      C:\WINDOWS\system32\svchost.exe
                      C:\WINDOWS\system32\dllhost.exe
                      C:\WINDOWS\eHome\ehmsas.exe
                      C:\WINDOWS\system32\wuauclt.exe
                      C:\HP\KBD\KBD.EXE
                      c:\windows\system\hpsysdrv.exe
                      C:\Program Files\Java\jre1.5.0_09\bin\jucheck.exe
                      C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
                      C:\WINDOWS\system32\cmd.exe
                      C:\WINDOWS\system32\NOTEPAD.EXE
                      C:\Program Files\Trend Micro\HijackThis\Monjack.exe

                      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
                      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://fr.search.yahoo.com/?fr=cb-hp06
                      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
                      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.wikipedia.org/wiki/Accueil
                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = https://fr.search.yahoo.com/?fr=cb-hp06
                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF
                      R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
                      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer optimisé pour MSN
                      R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxybiblio.hec.fr:8080
                      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                      F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\ezShellStart.exe
                      O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
                      O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
                      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
                      O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                      O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                      O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
                      O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode
                      O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
                      O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE
                      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
                      O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
                      O4 - HKLM\..\Run: [DMAScheduler] "c:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe"
                      O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
                      O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
                      O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
                      O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
                      O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                      O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe"
                      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                      O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
                      O4 - HKLM\..\Run: [EEventManager] C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
                      O4 - HKLM\..\Run: [MsgCenterExe] "C:\Program Files\Fichiers communs\Real\Update_OB\RealOneMessageCenter.exe" -osboot
                      O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
                      O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
                      O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
                      O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                      O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
                      O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\HOMERunner.exe"
                      O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                      O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                      O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
                      O4 - .DEFAULT User Startup: PinMcLnk.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
                      O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                      O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.05\AMVConverter\grab.html
                      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
                      O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.05\MediaManager\grab.html
                      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
                      O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
                      O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                      O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                      O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
                      O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
                      O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
                      O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                      O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                      O16 - DPF: STS Secure Viewer - http://83.206.149.125:8080/pmasweb//tools/pviewersetup.cab
                      O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20070501/qtinstall.info.apple.com/qtactivex/qtplugin.cab
                      O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://www.can.com.sg/mwf/mgaxctrl.cab
                      O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game09.zylom.com/activex/zylomgamesplayer.cab
                      O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
                      O18 - Filter hijack: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - (no file)
                      O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
                      O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
                      O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                      O23 - Service: EasyBits Magic Desktop Services for Windows NT (ezntsvc) - EasyBits Software Corp. - C:\WINDOWS\system32\ezNTSvc.exe
                      O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
                      O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
                      O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
                      O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
                      0
                      1. Xtra
                        le rapport de Lop S&D :

                        --------------------\\ Lop S&D 4.2.4-0 XP/Vista

                        Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 2
                        X86-based PC ( Multiprocessor Free : AMD Athlon(tm) 64 X2 Dual Core Processor 3800+ )
                        BIOS : Phoenix - AwardBIOS v6.00PG
                        USER : HP_Administrateur ( Administrator )
                        BOOT : Normal boot
                        Antivirus : Avira AntiVir PersonalEdition 8.0.1.27 (Not Activated)

                        "C:\Lop SD" ( MAJ : 04-09-2008|09:55 )
                        Option : [3] ( 05/09/2008|23:50 )

                        \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ SUPPRESSION

                        Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\part dead amok eggs\TEAM WIPE.exe
                        Supprime! - C:\DOCUME~1\HP_ADM~1\APPLIC~1\oncepo~1\info htm sixth rdr.exe
                        Supprime! - C:\DOCUME~1\HP_ADM~1\APPLIC~1\oncepo~1\xvduxszf.exe
                        Supprime! - C:\DOCUME~1\HP_ADM~1\APPLIC~1\oncepo~1\yhfmkesq.exe
                        Supprime! - C:\Program Files\Circle Developement\Uninstall.exe
                        Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@advertstream[2].txt
                        Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@www.adserver5[1].txt
                        Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@adultfriendfinder[1].txt
                        Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@advertising[1].txt
                        Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@advertising[3].txt
                        Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@adin.bigpoint[2].txt
                        Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@bigpoint[1].txt
                        Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@fr1.seafight.bigpoint[2].txt
                        Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@banner.casinoking[2].txt
                        Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@casinoking[2].txt
                        Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@banner.cotedazurpalace[2].txt
                        Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@cotedazurpalace[1].txt
                        Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@adopt.euroclick[2].txt
                        Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@sr2.livemediasrv[1].txt
                        Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@sr2.livemediasrv[2].txt
                        Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@pacificpoker[1].txt
                        Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@partygaming.122.2o7[1].txt
                        Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@partypoker[2].txt
                        Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@32vegas[1].txt
                        Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@banner.32vegas[2].txt
                        Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@www.vegasaffiliates[1].txt
                        Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@www.lop[2].txt
                        Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@2xmoinscher[2].txt
                        Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@www.2xmoinscher[2].txt
                        Supprime! - C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrateur@888[2].txt
                        Supprime! - C:\WINDOWS\Tasks\A5C227359185A1E1.job
                        Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\part dead amok eggs
                        Supprime! - C:\DOCUME~1\HP_ADM~1\APPLIC~1\oncepo~1
                        Supprime! - C:\Program Files\oncepo~1
                        Supprime! - C:\Program Files\Circle Developement

                        \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

                        --------------------\\ Listing des dossiers dans APPLIC~1

                        [15/11/2005|04:22] C:\DOCUME~1\ADMINI~1\APPLIC~1\Identities
                        [12/08/2006|03:51] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft
                        [12/08/2006|03:13] C:\DOCUME~1\ADMINI~1\APPLIC~1\Real

                        [12/05/2008|10:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
                        [24/08/2007|13:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
                        [23/06/2008|19:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Avira
                        [06/07/2008|11:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Azureus
                        [12/08/2006|03:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink
                        [17/09/2007|18:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
                        [22/06/2008|10:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Grisoft
                        [12/08/2006|03:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Hewlett-Packard
                        [20/01/2007|21:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\HP
                        [12/08/2006|03:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
                        [30/12/2006|21:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\iWin
                        [21/08/2007|13:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\JollyBear
                        [03/03/2008|12:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
                        [15/10/2007|15:02] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
                        [24/06/2007|08:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Mozilla
                        [28/10/2006|14:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\muvee Technologies
                        [05/09/2008|23:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\NortonInstaller
                        [27/10/2006|21:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Otto
                        [21/08/2007|13:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\PlayFirst
                        [14/08/2007|13:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sandlot Games
                        [12/08/2006|02:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBSI
                        [18/05/2008|12:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
                        [12/08/2006|03:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sonic
                        [27/05/2007|20:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SpinTop Games
                        [08/11/2007|17:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
                        [17/11/2007|19:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TERMINAL Studio
                        [28/02/2008|20:02] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TomTom
                        [23/12/2006|21:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
                        [31/05/2007|17:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Live Toolbar
                        [12/06/2008|16:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
                        [13/05/2007|09:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Zylom

                        [15/11/2005|04:22] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
                        [12/08/2006|03:51] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
                        [12/08/2006|03:13] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Real

                        [24/07/2008|11:18] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Adobe
                        [27/01/2007|17:49] C:\DOCUME~1\HP_ADM~1\APPLIC~1\AdobeUM
                        [24/07/2008|15:52] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Apple Computer
                        [18/05/2008|11:57] C:\DOCUME~1\HP_ADM~1\APPLIC~1\ArcSoft
                        [06/07/2008|12:02] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Azureus
                        [19/08/2007|18:57] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Beep Industries
                        [21/01/2007|19:44] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Canvas Multi-Media
                        [06/01/2007|20:52] C:\DOCUME~1\HP_ADM~1\APPLIC~1\CyberLink
                        [23/12/2007|20:20] C:\DOCUME~1\HP_ADM~1\APPLIC~1\EPSON
                        [29/07/2007|13:18] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Gaijin Ent
                        [28/10/2006|13:26] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Google
                        [22/06/2008|10:48] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Grisoft
                        [31/10/2006|11:41] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Help
                        [27/10/2006|21:28] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Hewlett-Packard
                        [25/02/2007|21:49] C:\DOCUME~1\HP_ADM~1\APPLIC~1\HP
                        [27/10/2006|21:54] C:\DOCUME~1\HP_ADM~1\APPLIC~1\HPQ
                        [01/12/2007|16:27] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Identities
                        [23/12/2007|20:05] C:\DOCUME~1\HP_ADM~1\APPLIC~1\InstallShield
                        [05/08/2007|18:22] C:\DOCUME~1\HP_ADM~1\APPLIC~1\iWin
                        [31/10/2006|10:34] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Leadertech
                        [28/05/2007|10:53] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Macromedia
                        [17/11/2007|19:40] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Magic Academy
                        [18/05/2008|11:19] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Microsoft
                        [24/06/2007|15:31] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Mozilla
                        [19/08/2007|15:33] C:\DOCUME~1\HP_ADM~1\APPLIC~1\My Games
                        [27/10/2006|21:33] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Otto
                        [21/08/2007|13:14] C:\DOCUME~1\HP_ADM~1\APPLIC~1\PlayFirst
                        [27/10/2006|21:37] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Real
                        [30/06/2008|19:37] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Samsung
                        [18/05/2008|09:42] C:\DOCUME~1\HP_ADM~1\APPLIC~1\skypePM
                        [31/10/2006|10:38] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Sonic
                        [30/10/2006|18:51] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Sun
                        [24/06/2007|15:31] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Talkback
                        [31/10/2006|10:51] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Template
                        [28/02/2008|20:02] C:\DOCUME~1\HP_ADM~1\APPLIC~1\TomTom
                        [24/11/2007|20:18] C:\DOCUME~1\HP_ADM~1\APPLIC~1\Zylom

                        [15/11/2005|04:22] C:\DOCUME~1\INVIT~1\APPLIC~1\Identities
                        [07/04/2007|11:51] C:\DOCUME~1\INVIT~1\APPLIC~1\Macromedia
                        [12/08/2006|03:51] C:\DOCUME~1\INVIT~1\APPLIC~1\Microsoft
                        [12/08/2006|03:13] C:\DOCUME~1\INVIT~1\APPLIC~1\Real
                        [07/04/2007|11:57] C:\DOCUME~1\INVIT~1\APPLIC~1\Sun

                        [15/11/2005|04:23] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

                        [15/11/2005|04:23] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

                        --------------------\\ Tâches planifiées dans C:\WINDOWS\tasks

                        [05/09/2008 23:18][--ah-----] C:\WINDOWS\tasks\SA.DAT
                        [10/08/2004 13:00][-rah-----] C:\WINDOWS\tasks\desktop.ini

                        --------------------\\ Listing des dossiers dans C:\Program Files

                        [15/07/2008|19:58] C:\Program Files\Adobe
                        [18/05/2008|11:57] C:\Program Files\Atout Clic 5e
                        [23/06/2008|19:54] C:\Program Files\Avira
                        [16/09/2007|12:42] C:\Program Files\Barbie(R) Aventures questres
                        [15/09/2007|14:11] C:\Program Files\Bullfrog
                        [18/05/2008|11:58] C:\Program Files\calendrier_eval 1.0
                        [22/06/2008|10:28] C:\Program Files\CCleaner
                        [12/11/2005|02:09] C:\Program Files\ComPlus Applications
                        [30/06/2008|19:27] C:\Program Files\DIFX
                        [12/08/2006|03:19] C:\Program Files\DivX
                        [12/08/2006|03:33] C:\Program Files\EasyBits
                        [22/06/2008|11:52] C:\Program Files\EasyBits For Kids
                        [08/12/2007|17:47] C:\Program Files\Enjoy 5e
                        [28/10/2006|13:32] C:\Program Files\Enjoy 6e
                        [23/12/2007|20:09] C:\Program Files\EPSON
                        [23/06/2008|20:01] C:\Program Files\Fichiers communs
                        [12/08/2006|02:44] C:\Program Files\FrenchOtto
                        [25/10/2007|17:52] C:\Program Files\Gamenext
                        [22/06/2008|10:49] C:\Program Files\GemMasterFrench
                        [18/05/2008|12:01] C:\Program Files\Google
                        [22/06/2008|10:47] C:\Program Files\Grisoft
                        [01/11/2006|16:40] C:\Program Files\Hachette Multim‚dia
                        [24/08/2008|23:47] C:\Program Files\Hewlett-Packard
                        [24/08/2008|23:48] C:\Program Files\HP
                        [12/08/2006|03:13] C:\Program Files\HP DigitalMedia Archive
                        [30/06/2008|19:26] C:\Program Files\InstallShield Installation Information
                        [14/08/2008|20:47] C:\Program Files\Internet Explorer
                        [31/10/2006|19:51] C:\Program Files\Java
                        [18/11/2006|15:31] C:\Program Files\Mattel Media
                        [14/08/2008|20:48] C:\Program Files\Messenger
                        [16/06/2008|15:48] C:\Program Files\Messenger Plus! Live
                        [01/06/2007|19:05] C:\Program Files\Microsoft CAPICOM 2.1.0.2
                        [16/09/2007|12:52] C:\Program Files\Microsoft Encarta
                        [15/11/2005|04:24] C:\Program Files\microsoft frontpage
                        [18/05/2008|12:03] C:\Program Files\Microsoft Office
                        [14/10/2007|13:07] C:\Program Files\Microsoft Visual Studio
                        [18/05/2008|12:03] C:\Program Files\Microsoft Works
                        [14/10/2007|13:07] C:\Program Files\Microsoft.NET
                        [15/11/2005|04:24] C:\Program Files\Movie Maker
                        [18/05/2008|12:04] C:\Program Files\Mozilla Firefox
                        [15/11/2005|04:24] C:\Program Files\MSN
                        [15/11/2005|04:25] C:\Program Files\MSN Gaming Zone
                        [17/11/2006|12:36] C:\Program Files\MSXML 4.0
                        [12/08/2006|03:19] C:\Program Files\muvee Technologies
                        [11/05/2007|13:41] C:\Program Files\My Photo Calendars & Cards
                        [15/11/2005|04:25] C:\Program Files\NetMeeting
                        [15/11/2005|04:25] C:\Program Files\Online Services
                        [02/12/2007|00:16] C:\Program Files\Optimum 95 Bt
                        [13/06/2007|19:50] C:\Program Files\Outlook Express
                        [12/08/2006|03:29] C:\Program Files\PC-Doctor 5 for Windows
                        [24/08/2007|13:43] C:\Program Files\QuickTime
                        [12/08/2006|03:13] C:\Program Files\Real
                        [30/06/2008|19:25] C:\Program Files\Samsung
                        [12/08/2006|03:35] C:\Program Files\Services en ligne
                        [12/08/2006|03:14] C:\Program Files\Sonic
                        [05/11/2006|14:52] C:\Program Files\The Adventure Company
                        [04/11/2006|20:11] C:\Program Files\TLC-Edusoft
                        [28/02/2008|20:02] C:\Program Files\TomTom HOME 2
                        [05/09/2008|23:03] C:\Program Files\Trend Micro
                        [09/05/2007|11:23] C:\Program Files\Uninstall Information
                        [07/09/2007|19:34] C:\Program Files\Virtual Look
                        [12/06/2008|17:01] C:\Program Files\Windows Live
                        [18/05/2008|12:07] C:\Program Files\Windows Live Toolbar
                        [23/12/2006|21:04] C:\Program Files\Windows Media Connect 2
                        [16/09/2007|13:11] C:\Program Files\Windows Media Player
                        [15/11/2005|04:25] C:\Program Files\Windows NT
                        [15/11/2005|04:25] C:\Program Files\Windows Plus
                        [12/11/2005|02:09] C:\Program Files\WindowsUpdate
                        [19/12/2006|22:14] C:\Program Files\WinRAR
                        [15/11/2005|04:26] C:\Program Files\xerox
                        [09/12/2007|20:23] C:\Program Files\Zylom Games

                        --------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs

                        [12/05/2008|10:50] C:\Program Files\Fichiers communs\Adobe
                        [14/10/2007|13:07] C:\Program Files\Fichiers communs\DESIGNER
                        [12/08/2006|03:09] C:\Program Files\Fichiers communs\HP
                        [24/08/2007|13:38] C:\Program Files\Fichiers communs\InstallShield
                        [12/08/2006|02:50] C:\Program Files\Fichiers communs\Java
                        [12/08/2006|03:15] C:\Program Files\Fichiers communs\LightScribe
                        [12/08/2006|03:15] C:\Program Files\Fichiers communs\LS Getting Started
                        [08/08/2008|20:30] C:\Program Files\Fichiers communs\Microsoft Shared
                        [15/11/2005|04:24] C:\Program Files\Fichiers communs\MSSoap
                        [12/08/2006|03:18] C:\Program Files\Fichiers communs\muvee Technologies
                        [25/10/2007|17:52] C:\Program Files\Fichiers communs\Oberon Media
                        [15/11/2005|04:24] C:\Program Files\Fichiers communs\ODBC
                        [30/03/2008|18:19] C:\Program Files\Fichiers communs\Real
                        [15/11/2005|04:24] C:\Program Files\Fichiers communs\Services
                        [12/08/2006|03:14] C:\Program Files\Fichiers communs\Sonic Shared
                        [15/11/2005|04:24] C:\Program Files\Fichiers communs\SpeechEngines
                        [12/08/2006|03:14] C:\Program Files\Fichiers communs\SureThing Shared
                        [05/09/2008|23:16] C:\Program Files\Fichiers communs\Symantec Shared
                        [13/06/2007|19:50] C:\Program Files\Fichiers communs\System
                        [28/10/2006|13:31] C:\Program Files\Fichiers communs\Thraex Software
                        [12/08/2006|03:14] C:\Program Files\Fichiers communs\TiVo Shared
                        [12/06/2008|16:58] C:\Program Files\Fichiers communs\WindowsLiveInstaller
                        [30/03/2008|18:19] C:\Program Files\Fichiers communs\xing shared

                        --------------------\\ Process

                        ( 55 Processes )

                        ... OK !

                        --------------------\\ Recherche avec S_Lop

                        Aucun fichier / dossier Lop trouvé !

                        --------------------\\ Recherche de Fichiers / Dossiers Lop

                        Aucun fichier / dossier Lop trouvé !

                        --------------------\\ Verification du Registre

                        ..... OK !

                        --------------------\\ Verification du fichier Hosts

                        Fichier Hosts PROPRE

                        --------------------\\ Recherche de fichiers avec Catchme

                        catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                        Rootkit scan 2008-09-05 23:50:47
                        Windows 5.1.2600 Service Pack 2 NTFS
                        scanning hidden processes ...
                        scanning hidden files ...
                        scan completed successfully
                        hidden processes: 0
                        hidden files: 656

                        --------------------\\ Recherche d'autres infections

                        Aucune autre infection trouvée !

                        [F:562][D:20]-> C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp
                        [F:759][D:0]-> C:\DOCUME~1\HP_ADM~1\Cookies
                        [F:8522][D:39]-> C:\DOCUME~1\HP_ADM~1\LOCALS~1\TEMPOR~1\content.IE5

                        1 - "C:\Lop SD\LopR_1.txt" - 05/09/2008|23:37 - Option : [1]
                        2 - "C:\Lop SD\LopR_2.txt" - 05/09/2008|23:51 - Option : [3]

                        --------------------\\ Fin du rapport a 23:51:48

                        et celui de Hijackthis :

                        Logfile of Trend Micro HijackThis v2.0.2
                        Scan saved at 23:52:08, on 05/09/2008
                        Platform: Windows XP SP2 (WinNT 5.01.2600)
                        MSIE: Internet Explorer v7.00 (7.00.6000.16705)
                        Boot mode: Normal

                        Running processes:
                        C:\WINDOWS\System32\smss.exe
                        C:\WINDOWS\system32\winlogon.exe
                        C:\WINDOWS\system32\services.exe
                        C:\WINDOWS\system32\lsass.exe
                        C:\WINDOWS\system32\svchost.exe
                        C:\WINDOWS\System32\svchost.exe
                        C:\WINDOWS\system32\svchost.exe
                        C:\WINDOWS\system32\spoolsv.exe
                        C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
                        C:\WINDOWS\Explorer.EXE
                        C:\WINDOWS\ehome\ehtray.exe
                        C:\WINDOWS\RTHDCPL.EXE
                        C:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe
                        C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
                        C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
                        C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
                        C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe
                        C:\Program Files\QuickTime\qttask.exe
                        C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
                        C:\Program Files\Fichiers communs\Real\Update_OB\RealOneMessageCenter.exe
                        C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
                        C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
                        C:\WINDOWS\system32\ctfmon.exe
                        C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
                        C:\Program Files\TomTom HOME 2\HOMERunner.exe
                        C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                        C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
                        C:\WINDOWS\arservice.exe
                        C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                        C:\WINDOWS\eHome\ehRecvr.exe
                        C:\WINDOWS\eHome\ehSched.exe
                        C:\WINDOWS\system32\ezNTSvc.exe
                        C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
                        C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
                        C:\WINDOWS\system32\nvsvc32.exe
                        C:\WINDOWS\system32\svchost.exe
                        C:\WINDOWS\system32\dllhost.exe
                        C:\WINDOWS\eHome\ehmsas.exe
                        C:\WINDOWS\system32\wuauclt.exe
                        C:\HP\KBD\KBD.EXE
                        c:\windows\system\hpsysdrv.exe
                        C:\Program Files\Java\jre1.5.0_09\bin\jucheck.exe
                        C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
                        C:\WINDOWS\system32\cmd.exe
                        C:\WINDOWS\system32\NOTEPAD.EXE
                        C:\Program Files\Trend Micro\HijackThis\Monjack.exe

                        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
                        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://fr.search.yahoo.com/?fr=cb-hp06
                        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
                        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.wikipedia.org/wiki/Accueil
                        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
                        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = https://fr.search.yahoo.com/?fr=cb-hp06
                        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                        R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF
                        R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
                        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer optimisé pour MSN
                        R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxybiblio.hec.fr:8080
                        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                        F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\ezShellStart.exe
                        O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
                        O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
                        O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
                        O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                        O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                        O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
                        O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode
                        O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
                        O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE
                        O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
                        O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
                        O4 - HKLM\..\Run: [DMAScheduler] "c:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe"
                        O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
                        O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
                        O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
                        O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
                        O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                        O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe"
                        O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                        O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
                        O4 - HKLM\..\Run: [EEventManager] C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
                        O4 - HKLM\..\Run: [MsgCenterExe] "C:\Program Files\Fichiers communs\Real\Update_OB\RealOneMessageCenter.exe" -osboot
                        O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
                        O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
                        O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
                        O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                        O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
                        O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\HOMERunner.exe"
                        O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                        O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                        O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
                        O4 - .DEFAULT User Startup: PinMcLnk.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
                        O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                        O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.05\AMVConverter\grab.html
                        O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
                        O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.05\MediaManager\grab.html
                        O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
                        O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
                        O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                        O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                        O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
                        O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
                        O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
                        O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                        O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                        O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                        O16 - DPF: STS Secure Viewer - http://83.206.149.125:8080/pmasweb//tools/pviewersetup.cab
                        O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20070501/qtinstall.info.apple.com/qtactivex/qtplugin.cab
                        O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://www.can.com.sg/mwf/mgaxctrl.cab
                        O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game09.zylom.com/activex/zylomgamesplayer.cab
                        O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
                        O18 - Filter hijack: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - (no file)
                        O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
                        O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
                        O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                        O23 - Service: EasyBits Magic Desktop Services for Windows NT (ezntsvc) - EasyBits Software Corp. - C:\WINDOWS\system32\ezNTSvc.exe
                        O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                        O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
                        O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
                        O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
                        O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
                        0
                        1. Xtra
                          Hum je crois que ça a marché... j'ai plus de pubs depuis qq min mais je ne voudrais pas crier victoire trop vite !
                          0
                          1. sKe69 Contributeur sécurité
                            Bien ...

                            crier victoire trop vite !
                            --> effectivement ... ^^

                            la suite :

                            1- Télécharges : - CCleaner
                            https://www.pcastuces.com/logitheque/ccleaner.htm
                            Ce logiciel va permettre de supprimer tous les fichiers temporaires et de corrigé ton registre .Lors de l'installation, avant de cliquer sur le bouton "installer", décoche toutes les "options supplémentaires" sauf les 2 première.
                            Une fois le prg instalé et lancé, Clique sur "Options", "Avancé" et décoche la case "Effacer uniquement les fichiers, du dossier Temp de Windows, plus vieux que 48 heures"( Par la suite, laisse-le avec ses réglages par défaut. C'est tout ).

                            Un tuto ( aide ):
                            http://perso.orange.fr/jesses/Docs/Logiciels/CCleaner.htm

                            ---> Utilisation:
                            ! déconnectes toi et fermes toutes applications en cours !
                            * vas dans "nettoyeur" : fait analyse puis nettoyage
                            * vas dans "registre" : fait chercher les erreurs et réparer ( plusieurs fois jusqu'à ce qu'il n'y est plus d'erreur ) .

                            ( CCleaner : soft à garder sur son PC , super utile pour de bons nettoyages ... )

                            2- Télécharges MalwareByte's :
                            ici ftp://ftp.commentcamarche.com/download/mbam-setup.exe
                            ou ici : http://www.malwarebytes.org/mbam.php

                            Installes le ( choisis bien "francais" ; ne modifies pas les paramètres d'installe ) et mets le à jour .

                            (NB : S'il te manque "COMCTL32.OCX" lors de l'installe, alors télécharges le ici : https://www.malekal.com/tutorial-aboutbuster/ )

                            Potasses le tuto pour te familiariser avec le prg : https://forum.pcastuces.com/sujet.asp?f=31&s=3
                            ( cela dis, il est très simple d'utilisation ).

                            Impératif : redémarres en mode sans échec :
                            Comment aller en Mode sans échec
                            1) Redémarres ton ordi
                            2) Tapote la touche F8 immédiatement, (F5 sur certains PC) juste après le "Bip"
                            3) Tu verras un écran avec options de démarrage apparaître
                            4) Choisis la première option : Sans Échec, et valide avec "Entrée"
                            5) Choisis ton compte habituel, et non Administrateur (si besoin ... )
                            (attention : pas de connexion possible en mode sans échec , donc copies ou imprimes bien la manipe pour éviter les erreurs ...)

                            Lances Malwarebyte's .

                            Fais un scan dit "complet" ( sélectionnes bien tous tes disks avant le scan ! ) et supprimes tout ce qu'il peut trouver, c'est à dire :
                            -->Laisses le scan se terminer,puis à la fin tu cliques sur "résultat" .
                            -->Vérifies que tous les objets infectés soient validés, puis cliques sur " suppression " .

                            Redémarres ton PC ( mode normal ).

                            Postes le rapport sauvegardé après la suppression des objets infectés (dans l'onglet "rapport/log"de Malwarebytes, le dernier en date) accompagné d'un nouvel hijackthis ( fait en mode normal ) ...
                            0
                            1. Xtra
                              le rapport de malware byte :

                              Malwarebytes' Anti-Malware 1.26
                              Version de la base de données: 1125
                              Windows 5.1.2600 Service Pack 2

                              07/09/2008 22:11:17
                              mbam-log-2008-09-07 (22-11-17).txt

                              Type de recherche: Examen complet (C:\|D:\|)
                              Eléments examinés: 175849
                              Temps écoulé: 1 hour(s), 14 minute(s), 49 second(s)

                              Processus mémoire infecté(s): 0
                              Module(s) mémoire infecté(s): 0
                              Clé(s) du Registre infectée(s): 0
                              Valeur(s) du Registre infectée(s): 0
                              Elément(s) de données du Registre infecté(s): 0
                              Dossier(s) infecté(s): 0
                              Fichier(s) infecté(s): 0

                              Processus mémoire infecté(s):
                              (Aucun élément nuisible détecté)

                              Module(s) mémoire infecté(s):
                              (Aucun élément nuisible détecté)

                              Clé(s) du Registre infectée(s):
                              (Aucun élément nuisible détecté)

                              Valeur(s) du Registre infectée(s):
                              (Aucun élément nuisible détecté)

                              Elément(s) de données du Registre infecté(s):
                              (Aucun élément nuisible détecté)

                              Dossier(s) infecté(s):
                              (Aucun élément nuisible détecté)

                              le rapport de hijack this :

                              Logfile of Trend Micro HijackThis v2.0.2
                              Scan saved at 22:13:11, on 07/09/2008
                              Platform: Windows XP SP2 (WinNT 5.01.2600)
                              MSIE: Internet Explorer v7.00 (7.00.6000.16705)
                              Boot mode: Normal

                              Running processes:
                              C:\WINDOWS\System32\smss.exe
                              C:\WINDOWS\system32\winlogon.exe
                              C:\WINDOWS\system32\services.exe
                              C:\WINDOWS\system32\lsass.exe
                              C:\WINDOWS\system32\svchost.exe
                              C:\WINDOWS\System32\svchost.exe
                              C:\WINDOWS\system32\svchost.exe
                              C:\WINDOWS\system32\spoolsv.exe
                              C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
                              C:\WINDOWS\Explorer.EXE
                              C:\WINDOWS\ehome\ehtray.exe
                              C:\WINDOWS\RTHDCPL.EXE
                              C:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe
                              C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
                              C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
                              C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
                              C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe
                              C:\Program Files\QuickTime\qttask.exe
                              C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
                              C:\Program Files\Fichiers communs\Real\Update_OB\RealOneMessageCenter.exe
                              C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
                              C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
                              C:\WINDOWS\system32\ctfmon.exe
                              C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
                              C:\Program Files\TomTom HOME 2\HOMERunner.exe
                              C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                              C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
                              C:\WINDOWS\arservice.exe
                              C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                              C:\WINDOWS\eHome\ehRecvr.exe
                              C:\WINDOWS\eHome\ehSched.exe
                              C:\WINDOWS\system32\ezNTSvc.exe
                              C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
                              C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
                              C:\WINDOWS\system32\nvsvc32.exe
                              C:\WINDOWS\system32\svchost.exe
                              C:\WINDOWS\system32\dllhost.exe
                              C:\WINDOWS\eHome\ehmsas.exe
                              C:\HP\KBD\KBD.EXE
                              C:\Program Files\Internet Explorer\iexplore.exe
                              C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
                              c:\windows\system\hpsysdrv.exe
                              C:\WINDOWS\system32\wuauclt.exe
                              C:\Program Files\Java\jre1.5.0_09\bin\jucheck.exe
                              C:\WINDOWS\system32\NOTEPAD.EXE
                              C:\Program Files\Trend Micro\HijackThis\Monjack.exe

                              R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
                              R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://fr.search.yahoo.com/?fr=cb-hp06
                              R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
                              R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.wikipedia.org/wiki/Accueil
                              R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
                              R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                              R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = https://fr.search.yahoo.com/?fr=cb-hp06
                              R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                              R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF
                              R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
                              R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer optimisé pour MSN
                              R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxybiblio.hec.fr:8080
                              R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                              F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\ezShellStart.exe
                              O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
                              O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
                              O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
                              O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                              O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                              O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
                              O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode
                              O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
                              O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE
                              O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
                              O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
                              O4 - HKLM\..\Run: [DMAScheduler] "c:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe"
                              O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
                              O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
                              O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
                              O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
                              O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                              O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe"
                              O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                              O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
                              O4 - HKLM\..\Run: [EEventManager] C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
                              O4 - HKLM\..\Run: [MsgCenterExe] "C:\Program Files\Fichiers communs\Real\Update_OB\RealOneMessageCenter.exe" -osboot
                              O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
                              O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
                              O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
                              O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                              O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
                              O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\HOMERunner.exe"
                              O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                              O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                              O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
                              O4 - .DEFAULT User Startup: PinMcLnk.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
                              O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                              O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.05\AMVConverter\grab.html
                              O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
                              O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.05\MediaManager\grab.html
                              O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
                              O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
                              O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                              O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                              O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
                              O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
                              O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
                              O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                              O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                              O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                              O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                              O16 - DPF: STS Secure Viewer - http://83.206.149.125:8080/pmasweb//tools/pviewersetup.cab
                              O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20070501/qtinstall.info.apple.com/qtactivex/qtplugin.cab
                              O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://www.can.com.sg/mwf/mgaxctrl.cab
                              O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game09.zylom.com/activex/zylomgamesplayer.cab
                              O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
                              O18 - Filter hijack: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - (no file)
                              O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
                              O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
                              O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                              O23 - Service: EasyBits Magic Desktop Services for Windows NT (ezntsvc) - EasyBits Software Corp. - C:\WINDOWS\system32\ezNTSvc.exe
                              O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                              O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
                              O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
                              O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
                              O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
                              0
                              1. sKe69 Contributeur sécurité
                                bon ... Malwarebytes n'a rien trouvé ( quelque part tant mieux ! ^^ )

                                Mais il reste néanmois encore une bestiole sur ton PC ... :-/

                                Fais ce qui suit :

                                Téléchargez ceci (de gchris) : http://gchrisftp.free.fr/divers/Ad-Fix/Ad-Fix.zip

                                !! Important : désactives ton anti-virus le temps de la manipe , tu le réactivera ensuite !!

                                Dézippez-le sur votre bureau (clic droit -> extraire tout).

                                Attention : vérifiez que vous êtes bien connecté à internet.

                                Dans le dossier créé, double-cliquez sur le fichier "Ad-Fix.bat" ou "Ad-fix"
                                Choisissez l'option 1.

                                Si vous avez un message de votre pare-feu qui vous demande si vous voulez autoriser le fichier URL2FILE.EXE à
                                se connecter à Internet ---> autorisez, c'est nécessaire à ad-fix pour vérifier la version.

                                Quand c'est finit (cela peut prendre plusieurs minutes), un rapport s'ouvre avec le bloc-notes.
                                Merci de faire un copier/coller ici du contenu du rapport (Ad-Fix.txt) .
                                0
                                1. Xtra
                                  le rapport :

                                  Ad-Fix v0.101e
                                  by gchris

                                  OPTION 1 (Scan) :

                                  »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

                                  Démarré à :

                                  19:54:43,21 08/09/2008

                                  Executé depuis :

                                  C:\Documents and Settings\HP_Administrateur\Bureau\Ad-Fix

                                  Os :

                                  Microsoft Windows XP [version 5.1.2600]

                                  »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

                                  »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

                                  Recherche de fichier manquant

                                  »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

                                  »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

                                  Recherche de fichiers cachés (pas forcément mauvais)

                                  Fichiers cachés à la racine du disque système :

                                  AUTOEXEC.BAT
                                  BOOT.BAK
                                  boot.ini
                                  Bootfont.bin
                                  cmldr
                                  CONFIG.SYS
                                  ffastun.ffa
                                  ffastun.ffl
                                  ffastun.ffo
                                  ffastun0.ffx
                                  hiberfil.sys
                                  IO.SYS
                                  MSDOS.SYS
                                  NTDETECT.COM
                                  ntldr
                                  pagefile.sys
                                  sqmdata00.sqm
                                  sqmdata01.sqm
                                  sqmdata02.sqm
                                  sqmdata03.sqm
                                  sqmdata04.sqm
                                  sqmdata05.sqm
                                  sqmdata06.sqm
                                  sqmdata07.sqm
                                  sqmdata08.sqm
                                  sqmdata09.sqm
                                  sqmdata10.sqm
                                  sqmdata11.sqm
                                  sqmdata12.sqm
                                  sqmdata13.sqm
                                  sqmdata14.sqm
                                  sqmdata15.sqm
                                  sqmdata16.sqm
                                  sqmdata17.sqm
                                  sqmdata18.sqm
                                  sqmdata19.sqm
                                  sqmnoopt00.sqm
                                  sqmnoopt01.sqm
                                  sqmnoopt02.sqm
                                  sqmnoopt03.sqm
                                  sqmnoopt04.sqm
                                  sqmnoopt05.sqm
                                  sqmnoopt06.sqm
                                  sqmnoopt07.sqm
                                  sqmnoopt08.sqm
                                  sqmnoopt09.sqm
                                  sqmnoopt10.sqm
                                  sqmnoopt11.sqm
                                  sqmnoopt12.sqm
                                  sqmnoopt13.sqm
                                  sqmnoopt14.sqm
                                  sqmnoopt15.sqm
                                  sqmnoopt16.sqm
                                  sqmnoopt17.sqm
                                  sqmnoopt18.sqm
                                  sqmnoopt19.sqm

                                  Fichiers cachés dans le répertoire Windows :

                                  QTFont.qfn
                                  WindowsShell.Manifest
                                  winnt.bmp
                                  winnt256.bmp

                                  Fichiers cachés dans le répertoire System32 :

                                  cdplayer.exe.manifest
                                  logonui.exe.manifest
                                  ncpa.cpl.manifest
                                  nwc.cpl.manifest
                                  sapi.cpl.manifest
                                  WindowsLogon.manifest
                                  wuaucpl.cpl.manifest

                                  »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

                                  »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

                                  Analyse du registre

                                  ---------- USER AGENT -- POST PLATFORM

                                  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]

                                  ----------

                                  ---------- AppInit_DLLs

                                  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
                                  "AppInit_DLLs"=""
                                  "LoadAppInit_DLLs"=dword:00000001

                                  ----------
                                  HKCR\TypeLib\{05563f82-69a7-40a6-8670-153b635a7ef6} Détecté !

                                  Complete!

                                  »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

                                  »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

                                  Recherche de fichiers et dossiers

                                  C:\WINDOWS\Downloaded Program Files\setup.inf Détecté !

                                  »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

                                  Terminé à 19:56:26,90
                                  0
                                  1. sKe69 Contributeur sécurité
                                    Salut ,

                                    Nettoyage Ad-fix :

                                    Impératif : Démarrer en mode sans échec :
                                    Comment aller en Mode sans échec
                                    1) Redémarres ton ordi
                                    2) Tapotes la touche F8 immédiatement, (F5 sur certains PC) juste après le "Bip"
                                    3) Tu verras un écran avec options de démarrage apparaître
                                    4) Choisis la première option : Sans Échec, et valide avec "Entrée"
                                    5) Choisis ton compte habituel, et non Administrateur (si besoin ... )
                                    (attention : pas de connexion possible en mode sans échec , donc copies ou imprimes bien la manipe pour éviter les erreur ...)

                                    --->Lancez de nouveau Ad-fix

                                    Choisissez l'option 2
                                    (Le bureau ou les icônes vont disparaître, c'est normal.)
                                    Quand c'est terminé, pressez la touche "entrée" pour redémarrer l'ordinateur.

                                    Copiez collez ici, le contenu du nouveau rapport générer (le sauvegarder de façon à le retrouver), accompagné d'un nouveau rapport hijackthis ( celui-ci fais en mode normal ) pour analyse ...
                                    0
                                    1. Xtra
                                      le rapport d'adfix :

                                      Ad-Fix v0.101e
                                      by gchris

                                      OPTION 2 (Fix) :

                                      »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

                                      Démarré à :

                                      22:37:55,53 08/09/2008
                                      en mode sans échec

                                      Executé depuis :

                                      C:\Documents and Settings\HP_Administrateur\Bureau\Ad-Fix

                                      Os :

                                      Microsoft Windows XP [version 5.1.2600]

                                      »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

                                      »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

                                      Recherche de fichier manquant

                                      »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

                                      »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

                                      Nettoyage du registre

                                      HKCR\TypeLib\{05563f82-69a7-40a6-8670-153b635a7ef6} Supprimé !

                                      »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

                                      »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

                                      Suppression des fichiers

                                      C:\WINDOWS\Downloaded Program Files\setup.inf Supprimé !

                                      »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

                                      Terminé à 22:41:51,51

                                      Redémarrage effectué

                                      et le rapport d'hijackthis :

                                      Logfile of Trend Micro HijackThis v2.0.2
                                      Scan saved at 22:44:47, on 08/09/2008
                                      Platform: Windows XP SP2 (WinNT 5.01.2600)
                                      MSIE: Internet Explorer v7.00 (7.00.6000.16705)
                                      Boot mode: Normal

                                      Running processes:
                                      C:\WINDOWS\System32\smss.exe
                                      C:\WINDOWS\system32\winlogon.exe
                                      C:\WINDOWS\system32\services.exe
                                      C:\WINDOWS\system32\lsass.exe
                                      C:\WINDOWS\system32\svchost.exe
                                      C:\WINDOWS\System32\svchost.exe
                                      C:\WINDOWS\system32\svchost.exe
                                      C:\WINDOWS\system32\spoolsv.exe
                                      C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
                                      C:\WINDOWS\Explorer.EXE
                                      C:\WINDOWS\NOTEPAD.EXE
                                      C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
                                      C:\WINDOWS\arservice.exe
                                      C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                                      C:\WINDOWS\eHome\ehRecvr.exe
                                      C:\WINDOWS\eHome\ehSched.exe
                                      C:\WINDOWS\system32\ezNTSvc.exe
                                      C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
                                      C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
                                      C:\WINDOWS\system32\nvsvc32.exe
                                      C:\WINDOWS\system32\svchost.exe
                                      C:\WINDOWS\ehome\ehtray.exe
                                      C:\WINDOWS\RTHDCPL.EXE
                                      C:\WINDOWS\ARPWRMSG.EXE
                                      C:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe
                                      C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe
                                      C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
                                      C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
                                      C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
                                      C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe
                                      C:\Program Files\QuickTime\qttask.exe
                                      C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
                                      C:\Program Files\Fichiers communs\Real\Update_OB\RealOneMessageCenter.exe
                                      C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
                                      C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
                                      C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
                                      C:\WINDOWS\system32\ctfmon.exe
                                      C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
                                      C:\Program Files\TomTom HOME 2\HOMERunner.exe
                                      C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                                      C:\WINDOWS\eHome\ehmsas.exe
                                      C:\WINDOWS\system32\dllhost.exe
                                      C:\WINDOWS\system32\wuauclt.exe
                                      C:\HP\KBD\KBD.EXE
                                      C:\Program Files\Trend Micro\HijackThis\Monjack.exe
                                      C:\WINDOWS\system32\wuauclt.exe
                                      C:\Program Files\Internet Explorer\iexplore.exe
                                      C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe

                                      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
                                      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://fr.search.yahoo.com/?fr=cb-hp06
                                      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
                                      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.wikipedia.org/wiki/Accueil
                                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
                                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = https://fr.search.yahoo.com/?fr=cb-hp06
                                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                                      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF
                                      R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
                                      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer optimisé pour MSN
                                      R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxybiblio.hec.fr:8080
                                      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                                      F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\ezShellStart.exe
                                      O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
                                      O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
                                      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
                                      O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                                      O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                                      O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
                                      O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode
                                      O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
                                      O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE
                                      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
                                      O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
                                      O4 - HKLM\..\Run: [DMAScheduler] "c:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe"
                                      O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
                                      O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
                                      O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
                                      O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
                                      O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                                      O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe"
                                      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                                      O4 - HKLM\..\Run: [EEventManager] C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
                                      O4 - HKLM\..\Run: [MsgCenterExe] "C:\Program Files\Fichiers communs\Real\Update_OB\RealOneMessageCenter.exe" -osboot
                                      O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
                                      O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
                                      O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
                                      O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                                      O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
                                      O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\HOMERunner.exe"
                                      O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                                      O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                                      O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
                                      O4 - .DEFAULT User Startup: PinMcLnk.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
                                      O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                                      O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.05\AMVConverter\grab.html
                                      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
                                      O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.05\MediaManager\grab.html
                                      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
                                      O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
                                      O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                                      O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                                      O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
                                      O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
                                      O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
                                      O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                                      O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                                      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                                      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                                      O16 - DPF: STS Secure Viewer - http://83.206.149.125:8080/pmasweb//tools/pviewersetup.cab
                                      O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20070501/qtinstall.info.apple.com/qtactivex/qtplugin.cab
                                      O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://www.can.com.sg/mwf/mgaxctrl.cab
                                      O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game09.zylom.com/activex/zylomgamesplayer.cab
                                      O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
                                      O18 - Filter hijack: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - (no file)
                                      O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
                                      O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
                                      O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                                      O23 - Service: EasyBits Magic Desktop Services for Windows NT (ezntsvc) - EasyBits Software Corp. - C:\WINDOWS\system32\ezNTSvc.exe
                                      O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                                      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
                                      O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
                                      O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
                                      O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
                                      0
                                      1. sKe69 Contributeur sécurité
                                        Bien ... Cela perciste ...

                                        changeons le fusil d'épaule ...

                                        Fais exactement ce qui suit :

                                        Télécharges ComboFix (par sUBs) sur ton Bureau (et pas ailleurs !):
                                        http://download.bleepingcomputer.com/sUBs/ComboFix.exe <--- clik droit sur ce lien et choisis "enregistrer la cible sous ... " : dans la fenêtre qui s'ouvre tape C-Fix et valide .

                                        --------------------------------------------- [ ! ATTENTION ! ] ----------------------------------------------------------
                                        !! Déconnectes toi,fermes tes applications en cours et DESACTIVES TOUTES TES DEFENSES (anti-virus, guardes anti spy-ware, pare-feu) le temps de la manipe :
                                        en effet , activés, ils pourraient gêner fortement la procédure de recherche et de nettoyage de l'outil ( voir planter le PC )...Tu les réactiveras donc après !!
                                        --->Important : si tu rencontres des difficultés à ce niveau là, fais m'en part avant de poursuivre ...
                                        Tuto ( aide ) ici : https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

                                        (Note : si tu es infecté par un Bagle , ceci ne te concerne pas dans l'immédiat ...)
                                        ---------------------------------------------------------------------------------------------------------------------------------

                                        Ensuite :
                                        double-cliques C-Fix.exe ( = combofix.exe ) .

                                        Appuyes sur la touche Y (Yes) pour démarrer le scan .

                                        Attention :
                                        --> n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi .
                                        --> Il se peut que le PC redémarre de lui même ( pour finaliser le nettoyage ) , laisses le faire .
                                        --> si un message d'erreur windows apparait à un momment : clik sur la croix rouge en haut à droite de la fenêtre pour la fermer ( et pas sur autre chose ! sinon pas de rapport ... )

                                        Le rapport sera crée dans: C:\Combofix.txt

                                        Postes le rapport Combofix accompagné d'un nouveau rapport hijackthis pour analyse ...
                                        0
                                        1. Xtra
                                          Le rapport de combofix :

                                          ComboFix 08-09-05.12 - HP_Administrateur 2008-09-09 19:35:56.1 - NTFSx86
                                          Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1561 [GMT 2:00]
                                          Endroit: C:\Documents and Settings\HP_Administrateur\Bureau\C-fix.exe
                                          * Création d'un nouveau point de restauration
                                          .

                                          (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
                                          .

                                          C:\Documents and Settings\Administrateur\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
                                          D:\Autorun.inf
                                          C:\Documents and Settings\Invité\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML . . . . Echec de suppression

                                          .
                                          ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-08-09 to 2008-09-09 ))))))))))))))))))))))))))))))))))))
                                          .

                                          2008-09-08 22:37 . 2004-05-05 09:40 16,384 --a------ C:\WINDOWS\system32\restart.exe
                                          2008-09-08 19:54 . 2007-02-09 10:26 184,320 --a------ C:\WINDOWS\system32\delnext.exe
                                          2008-09-07 20:49 . 2008-09-07 20:50 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
                                          2008-09-07 20:49 . 2008-09-07 20:49 <REP> d-------- C:\Documents and Settings\HP_Administrateur\Application Data\Malwarebytes
                                          2008-09-07 20:49 . 2008-09-07 20:49 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
                                          2008-09-07 20:49 . 2008-09-02 00:16 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
                                          2008-09-07 20:49 . 2008-09-02 00:16 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
                                          2008-09-07 19:57 . 2008-09-07 19:57 <REP> d-------- C:\Program Files\CCleaner
                                          2008-09-05 23:35 . 2008-09-05 23:51 <REP> d-------- C:\Lop SD
                                          2008-09-05 23:26 . 2008-09-05 23:26 4,802 --a------ C:\Documents and Settings\Orph.egd
                                          2008-09-05 23:23 . 2008-09-05 23:26 <REP> d-------- C:\ToolBar SD
                                          2008-09-05 23:15 . 2008-09-05 23:15 <REP> d-------- C:\Documents and Settings\All Users\Application Data\NortonInstaller
                                          2008-09-05 23:03 . 2008-09-05 23:03 <REP> d-------- C:\Program Files\Trend Micro

                                          .
                                          (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                                          .
                                          2008-09-05 21:16 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared
                                          2008-08-24 21:48 --------- d-----w C:\Program Files\HP
                                          2008-08-24 21:47 --------- d-----w C:\Program Files\Hewlett-Packard
                                          2008-07-24 13:52 --------- d-----w C:\Documents and Settings\HP_Administrateur\Application Data\Apple Computer
                                          2007-12-30 17:36 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
                                          2006-12-29 15:07 1,004 ----a-w C:\Documents and Settings\HP_Administrateur\Application Data\wklnhst.dat
                                          2006-10-27 19:28 251 ----a-w C:\Program Files\wt3d.ini
                                          1998-08-24 10:09 10,000 ----a-w C:\WINDOWS\inf\unregpn.exe
                                          2006-11-01 09:57 22 -csha-w C:\WINDOWS\SMINST\HPCD.sys
                                          .

                                          ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
                                          .
                                          .
                                          *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
                                          REGEDIT4

                                          [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                                          "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 15360]
                                          "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
                                          "TomTomHOME.exe"="C:\Program Files\TomTom HOME 2\HOMERunner.exe" [2008-02-18 206184]

                                          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                                          "ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-05 64512]
                                          "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-05-10 7311360]
                                          "DMAScheduler"="c:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe" [2006-04-13 90112]
                                          "Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2005-07-22 237568]
                                          "HPBootOp"="C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2006-02-15 249856]
                                          "HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
                                          "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" [2006-10-12 49263]
                                          "TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2008-03-30 185896]
                                          "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-07-11 282624]
                                          "EEventManager"="C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe" [2006-10-12 102400]
                                          "MsgCenterExe"="C:\Program Files\Fichiers communs\Real\Update_OB\RealOneMessageCenter.exe" [2008-03-30 69632]
                                          "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
                                          "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 6731312]
                                          "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-17 266497]
                                          "ftutil2"="ftutil2.dll" [2004-06-07 C:\WINDOWS\system32\ftutil2.dll]
                                          "RTHDCPL"="RTHDCPL.EXE" [2006-06-14 C:\WINDOWS\RTHDCPL.EXE]
                                          "AlwaysReady Power Message APP"="ARPWRMSG.EXE" [2005-08-03 C:\WINDOWS\arpwrmsg.exe]
                                          "nwiz"="nwiz.exe" [2006-05-10 C:\WINDOWS\system32\nwiz.exe]

                                          [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
                                          "InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
                                          "InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

                                          [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
                                          "DisableLockWorkstation"= 0 (0x0)
                                          "DisableChangePassword"= 0 (0x0)

                                          [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
                                          "NoLogoff"= 0 (0x0)

                                          [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
                                          "{E54729E8-BB3D-4270-9D49-7389EA579090}"= "C:\WINDOWS\system32\EZUPBH~1.DLL" [2006-10-27 49152]

                                          [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
                                          "VIDC.VDOM"= vdowave.drv

                                          [HKEY_LOCAL_MACHINE\software\microsoft\security center]
                                          "AntiVirusDisableNotify"=dword:00000001

                                          [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
                                          "DisableMonitoring"=dword:00000001

                                          [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                                          "%windir%\\system32\\sessmgr.exe"=
                                          "C:\\Program Files\\Messenger\\msmsgs.exe"=
                                          "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
                                          "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
                                          "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

                                          R2 ezntsvc;EasyBits Magic Desktop Services for Windows NT;C:\WINDOWS\system32\ezNTSvc.exe [2006-10-27 33792]
                                          R3 usbstor;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-10 26496]
                                          S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]

                                          [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b6791b4b-e623-11dc-87ad-0018f341777c}]
                                          \Shell\AutoRun\command - J:\InstallTomTomHOME.exe
                                          .
                                          - - - - ORPHANS REMOVED - - - -

                                          HKLM-Run-Adobe Photo Downloader - C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe
                                          HKLM-Run-PCDrProfiler - (no file)

                                          .
                                          ------- Supplementary Scan -------
                                          .
                                          FireFox -: Profile - C:\Documents and Settings\HP_Administrateur\Application Data\Mozilla\Firefox\Profiles\6r1zctki.default\
                                          FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
                                          FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.msn.fr/
                                          FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://fr.msn.com/
                                          .

                                          **************************************************************************

                                          catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                                          Rootkit scan 2008-09-09 19:41:33
                                          Windows 5.1.2600 Service Pack 2 NTFS

                                          Balayage processus cach‚s ...

                                          Balayage cach‚ autostart entries ...

                                          Balayage des fichiers cach‚s ...

                                          Scan termin‚ avec succŠs
                                          Les fichiers cach‚s: 0

                                          **************************************************************************
                                          .
                                          ------------------------ Other Running Processes ------------------------
                                          .
                                          C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
                                          C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
                                          C:\WINDOWS\arservice.exe
                                          C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                                          C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                                          C:\WINDOWS\ehome\ehrecvr.exe
                                          C:\WINDOWS\ehome\ehSched.exe
                                          C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
                                          C:\WINDOWS\system32\nvsvc32.exe
                                          C:\WINDOWS\ehome\mcrdsvc.exe
                                          C:\WINDOWS\system32\dllhost.exe
                                          C:\WINDOWS\ehome\ehmsas.exe
                                          C:\Program Files\Java\jre1.5.0_09\bin\jucheck.exe
                                          .
                                          **************************************************************************
                                          .
                                          Temps d'accomplissement: 2008-09-09 19:47:27 - machine was rebooted
                                          ComboFix-quarantined-files.txt 2008-09-09 17:47:22

                                          Pre-Run: 161,138,421,760 octets libres
                                          Post-Run: 161,500,516,352 octets libres

                                          139 --- E O F --- 2008-09-09 17:34:44

                                          et le rapport de hijackthis :
                                          Logfile of Trend Micro HijackThis v2.0.2
                                          Scan saved at 19:47:47, on 09/09/2008
                                          Platform: Windows XP SP2 (WinNT 5.01.2600)
                                          MSIE: Internet Explorer v7.00 (7.00.6000.16705)
                                          Boot mode: Normal

                                          Running processes:
                                          C:\WINDOWS\System32\smss.exe
                                          C:\WINDOWS\system32\winlogon.exe
                                          C:\WINDOWS\system32\services.exe
                                          C:\WINDOWS\system32\lsass.exe
                                          C:\WINDOWS\system32\svchost.exe
                                          C:\WINDOWS\System32\svchost.exe
                                          C:\WINDOWS\system32\svchost.exe
                                          C:\WINDOWS\system32\spoolsv.exe
                                          C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
                                          C:\WINDOWS\ehome\ehtray.exe
                                          C:\WINDOWS\RTHDCPL.EXE
                                          C:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe
                                          C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe
                                          C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
                                          C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
                                          C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
                                          C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe
                                          C:\Program Files\QuickTime\qttask.exe
                                          C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
                                          C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
                                          C:\WINDOWS\arservice.exe
                                          C:\Program Files\Fichiers communs\Real\Update_OB\RealOneMessageCenter.exe
                                          C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
                                          C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
                                          C:\WINDOWS\system32\ctfmon.exe
                                          C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
                                          C:\Program Files\TomTom HOME 2\HOMERunner.exe
                                          C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                                          C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                                          C:\WINDOWS\eHome\ehRecvr.exe
                                          C:\WINDOWS\eHome\ehSched.exe
                                          C:\WINDOWS\system32\ezNTSvc.exe
                                          C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
                                          C:\WINDOWS\system32\nvsvc32.exe
                                          C:\WINDOWS\system32\svchost.exe
                                          C:\WINDOWS\system32\dllhost.exe
                                          C:\WINDOWS\eHome\ehmsas.exe
                                          C:\WINDOWS\system32\wuauclt.exe
                                          C:\Program Files\Java\jre1.5.0_09\bin\jucheck.exe
                                          C:\WINDOWS\explorer.exe
                                          C:\WINDOWS\system32\notepad.exe
                                          C:\HP\KBD\KBD.EXE
                                          C:\Program Files\Trend Micro\HijackThis\Monjack.exe
                                          C:\Program Files\internet explorer\iexplore.exe
                                          C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe

                                          R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://fr.search.yahoo.com/?fr=cb-hp06
                                          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.wikipedia.org/wiki/Accueil
                                          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                                          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                                          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = https://fr.search.yahoo.com/?fr=cb-hp06
                                          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                                          R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF
                                          R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
                                          R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxybiblio.hec.fr:8080
                                          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                                          O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
                                          O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
                                          O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
                                          O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                                          O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                                          O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
                                          O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode
                                          O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
                                          O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE
                                          O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
                                          O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
                                          O4 - HKLM\..\Run: [DMAScheduler] "c:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe"
                                          O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
                                          O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
                                          O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
                                          O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
                                          O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                                          O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                                          O4 - HKLM\..\Run: [EEventManager] C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
                                          O4 - HKLM\..\Run: [MsgCenterExe] "C:\Program Files\Fichiers communs\Real\Update_OB\RealOneMessageCenter.exe" -osboot
                                          O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
                                          O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
                                          O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
                                          O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                                          O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
                                          O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\HOMERunner.exe"
                                          O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                                          O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                                          O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
                                          O4 - .DEFAULT User Startup: PinMcLnk.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
                                          O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                                          O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.05\AMVConverter\grab.html
                                          O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
                                          O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.05\MediaManager\grab.html
                                          O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
                                          O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
                                          O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                                          O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                                          O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
                                          O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
                                          O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
                                          O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                                          O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                                          O16 - DPF: STS Secure Viewer - http://83.206.149.125:8080/pmasweb//tools/pviewersetup.cab
                                          O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20070501/qtinstall.info.apple.com/qtactivex/qtplugin.cab
                                          O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://www.can.com.sg/mwf/mgaxctrl.cab
                                          O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game09.zylom.com/activex/zylomgamesplayer.cab
                                          O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
                                          O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
                                          O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
                                          O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                                          O23 - Service: EasyBits Magic Desktop Services for Windows NT (ezntsvc) - EasyBits Software Corp. - C:\WINDOWS\system32\ezNTSvc.exe
                                          O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                                          O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
                                          O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
                                          O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
                                          O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
                                          0
                                          • 1
                                          • 2
                                          • 3

                                          Discussions similaires

                                          Message "Un bloqueur de publicité empêche la lecture..."
                                          pistouri

                                          0 réponse
                                          comment desactiver un bloqueur de pub
                                          amour10

                                          4 réponses
                                          M6 Replay désactiver le bloqueur de publicité
                                          katydel88

                                          14 réponses
                                          publicité intempestive
                                          alost

                                          5 réponses
                                          TF1 replay demande désactiver un bloqueur de pub déjà désactivé
                                          Purplejasmine

                                          12 réponses