Virus extrêmement tenace!!!

Résolu
siroderab -  
Bonjour,

cela fait maintenant plus de quatre jours que j'essai de nettoyer mon ordi. Ça a commencé avec un update de LimeWire (dont je suis maintenant débarassé) qui a foutu le bordel total. Après avoir utilisé MacAfee, SpyHunter Spybot et avoir siphonné au moins la moitié de mon ceveau, je suis encore au prise avec un virus qui ne cesse de vouloir m'installer Antivirus 2009, m'affiche un écran bleu, me harcèle constamment en installant des .dll au démarrage et j'en passe...

SVP, si quelqu'un est en mesure de m'aider, se serait grandement apprécié. Ci-joint le rapport tout frais de Hijackthis, comme ça semble être souvent le point de départ.

Merci à l'avance de votre aide,

siroderab
Configuration: Windows XP sp3
Internet Explorer 7.0

11 réponses

  1. siroderab
    oups! voici le log :0)

    Logfile of HijackThis v1.99.1
    Scan saved at 21:55:40, on 2008-09-22
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16705)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\WLTRYSVC.EXE
    C:\WINDOWS\System32\bcmwltry.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\WINDOWS\ATKKBService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
    C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE
    C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
    C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe
    C:\Program Files\McAfee\Common Framework\FrameworkService.exe
    C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
    C:\WINDOWS\system32\java.exe
    C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
    C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
    C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
    C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
    C:\Program Files\Fichiers communs\Pure Networks Shared\Platform\nmsrvc.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Microsoft IntelliPoint\point32.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\WINDOWS\system32\WLTRAY.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\McAfee\Common Framework\UdaterUI.exe
    C:\WINDOWS\system32\Rundll32.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Program Files\Windows Media Player\WMPNSCFG.exe
    C:\Program Files\McAfee\Common Framework\McTray.exe
    C:\Program Files\BOINC\boincmgr.exe
    C:\PROGRA~1\Webshots\webshots.scr
    C:\Program Files\BOINC\boinc.exe
    C:\Program Files\BOINC\projects\setiathome.berkeley.edu\astropulse_4.35_windows_intelx86.exe
    C:\PROGRA~1\MICROS~3\Office\OUTLOOK.EXE
    C:\Program Files\Microsoft Office\Office\WINWORD.EXE
    C:\Program Files\Internet Explorer\Iexplore.exe
    G:\Dezippeur\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.radio-canada.ca/nouvelles/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
    O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
    O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [BM4735dd61] Rundll32.exe "C:\WINDOWS\system32\lorghecd.dll",s
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - Startup: BOINC Manager.lnk = C:\Program Files\BOINC\boincmgr.exe
    O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
    O11 - Options group: [INTERNATIONAL] International*
    O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} (asusTek_sysctrl Class) - http://support.asus.com/common/asusTek_sys_ctrl.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
    O18 - Protocol: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Fichiers communs\Pure Networks Shared\Platform\puresp4.dll
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
    O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll
    O20 - AppInit_DLLs: gnxwyo.dll
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
    O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
    O23 - Service: EPSON V3 Service4(01) (EPSON_PM_RPCV4_01) - SEIKO EPSON CORPORATION - C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE
    O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
    O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing)
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Linksys Updater (LinksysUpdater) - Unknown owner - C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe" -s "C:\Program Files\Linksys\Linksys Updater\conf\wrapper.conf (file missing)
    O23 - Service: McAfee Framework Service (McAfeeFramework) - Unknown owner - C:\Program Files\McAfee\Common Framework\FrameworkService.exe" /ServiceStart (file missing)
    O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
    O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
    O23 - Service: Pure Networks Platform Service (nmservice) - Pure Networks, Inc. - C:\Program Files\Fichiers communs\Pure Networks Shared\Platform\nmsrvc.exe
    O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
    O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
    1. Sloubi76
      Bonjour siroderab

      Télécharge et installe Malwarebyte's Anti-Malware :
      http://www.malwarebytes.org/mbam/program/mbam-setup.exe

      - A la fin de l'installation, veille à ce que l'option « mettre a jour Malwarebyte's Anti-Malware » soit cochée
      - Lance Malwarebyte's Anti-Malware, laisse les Mises à jour se télécharger et referme le programme

      Redémarre en "Mode sans échec" : redémarre ton ordinateur et tapote sur la touche F8 jusqu'à l'affichage du menu des options avancées de Windows, et sélectionne "Mode sans échec".
      Choisis ta session habituelle

      Lance Malwarebyte's Anti-Malware
      - Puis va dans l'onglet "Recherche", coche "Exécuter un examen complet" puis "Rechercher"
      - Sélectionne tes disques durs" puis clique sur "Lancer l’examen"
      - A la fin du scan, clique sur Afficher les résultats puis sur Enregistrer le rapport
      - Suppression des éléments détectés --> clique sur Supprimer la sélection
      - S'il t'es demandé de redémarrer, clique sur Yes

      @ +
    2. siroderab
      @Sloubi76Bonjour Sloubi76,

      merci de t'intéresser à mon cas. Je vais faire ça en revenant de mon travail ce soir.
      Y'aura t-il un rapport à te soumettre après Malwarebyte's Anti-Malware?

      À plus tard,
      Siroderab
    3. Sloubi76
      @siroderabBonsoir Siroderab,

      après Malware tu peux poster un nouveau rapport hitjack, mais le rapport MAM devrait donner une piste sérieuse

      @ +
    4. siroderab
      @Sloubi76Bonsoir Sloubi76,

      Le mode sans échec ne veut pas passer. J'obtient l'écran noir avec Mode sans échec dans les 4 coins plus la descripyio de mon système d'opération en haut et c'est tout. Ça ne bouge plus.

      Je fais quoi alors?
  2. siroderab
    Ah! j'ai réussi à ouvrir en mode sans échec. Je te reviens après le rapport MAM!
    1. siroderab
      voici le rapport mbam

      Malwarebytes' Anti-Malware 1.28
      Version de la base de données: 1200
      Windows 5.1.2600 Service Pack 3

      2008-09-23 20:57:29
      mbam-log-2008-09-23 (20-57-29).txt

      Type de recherche: Examen complet (C:\|G:\|)
      Eléments examinés: 188517
      Temps écoulé: 54 minute(s), 47 second(s)

      Processus mémoire infecté(s): 0
      Module(s) mémoire infecté(s): 3
      Clé(s) du Registre infectée(s): 18
      Valeur(s) du Registre infectée(s): 2
      Elément(s) de données du Registre infecté(s): 2
      Dossier(s) infecté(s): 0
      Fichier(s) infecté(s): 42

      Processus mémoire infecté(s):
      (Aucun élément nuisible détecté)

      Module(s) mémoire infecté(s):
      C:\WINDOWS\system32\pmnkJaXN.dll (Trojan.Vundo.H) -> Delete on reboot.
      C:\WINDOWS\system32\gnxwyo.dll (Trojan.Vundo) -> Delete on reboot.
      C:\WINDOWS\system32\qoMgfCuv.dll (Trojan.Vundo.H) -> Delete on reboot.

      Clé(s) du Registre infectée(s):
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5f6e5bdb-1442-45b7-b0c9-e927035a7415} (Trojan.Vundo.H) -> Delete on reboot.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\qomgfcuv (Trojan.Vundo.H) -> Delete on reboot.
      HKEY_CLASSES_ROOT\CLSID\{5f6e5bdb-1442-45b7-b0c9-e927035a7415} (Trojan.Vundo.H) -> Delete on reboot.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e0a1d4fc-511f-40c1-b633-4e674dab7bc9} (Trojan.Vundo.H) -> Delete on reboot.
      HKEY_CLASSES_ROOT\CLSID\{e0a1d4fc-511f-40c1-b633-4e674dab7bc9} (Trojan.Vundo.H) -> Delete on reboot.
      HKEY_CLASSES_ROOT\CLSID\{811a2ea5-6922-47be-ae9e-2dae03473ebc} (Trojan.Vundo) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\bambanner (Adware.Adrotator) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata (Trojan.Agent) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\tdss (Trojan.Agent) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\WR (Malware.Trace) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IProxyProvider (Trojan.Vundo) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR (Trojan.DNSChanger) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDSERVICE (Trojan.Downloader) -> Quarantined and deleted successfully.

      Valeur(s) du Registre infectée(s):
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{5f6e5bdb-1442-45b7-b0c9-e927035a7415} (Trojan.Vundo.H) -> Delete on reboot.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bm4735dd61 (Trojan.Agent) -> Quarantined and deleted successfully.

      Elément(s) de données du Registre infecté(s):
      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\pmnkjaxn -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\pmnkjaxn -> Delete on reboot.

      Dossier(s) infecté(s):
      (Aucun élément nuisible détecté)

      Fichier(s) infecté(s):
      C:\WINDOWS\system32\qoMgfCuv.dll (Trojan.Vundo.H) -> Delete on reboot.
      C:\WINDOWS\system32\pmnkJaXN.dll (Trojan.Vundo.H) -> Delete on reboot.
      C:\WINDOWS\system32\NXaJknmp.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\NXaJknmp.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\byXQGvwu.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\uwvGQXyb.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\hlkhfkcy.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\yckfhklh.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\pmnLcCvs.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\svCcLnmp.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
      C:\Documents and Settings\Dom\Local Settings\Temporary Internet Files\Content.IE5\18SN9HHV\nd82m0[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
      C:\Documents and Settings\Sylvie\Local Settings\Temporary Internet Files\Content.IE5\BQ16AGD7\nd82m0[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
      C:\Documents and Settings\Sylvie\Local Settings\Temporary Internet Files\Content.IE5\F5VZMFIB\upd105320[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\ahzxni.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\dhtfalpv.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\efcAPiFu.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\efgowbrx.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\gnxwyo.dll (Trojan.Vundo) -> Delete on reboot.
      C:\WINDOWS\system32\iojwey.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\mlJBTLFX.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\pmhljr.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\pupgibvj.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\rruiravkhlubv.exe (Adware.Adrotator) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\tiodqlcw.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\urqNfFur.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\urqNFxxY.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\wubandtl.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\yayAsqpq.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\yncsga.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\utc\eTRA130t.exe (Adware.Webhancer) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\xaz\Jvb21N15.exe (Trojan.Agent) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\tdssadw.dll (Trojan.Agent) -> Delete on reboot.
      C:\WINDOWS\system32\tdssl.dll (Trojan.Agent) -> Delete on reboot.
      C:\WINDOWS\system32\tdssserf.dll (Trojan.Agent) -> Delete on reboot.
      C:\WINDOWS\system32\tdssmain.dll (Trojan.Agent) -> Delete on reboot.
      C:\WINDOWS\system32\tdssinit.dll (Trojan.Agent) -> Delete on reboot.
      C:\WINDOWS\system32\tdsslog.dll (Trojan.Agent) -> Delete on reboot.
      C:\WINDOWS\system32\tdssservers.dat (Trojan.Agent) -> Delete on reboot.
      C:\WINDOWS\system32\drivers\tdssserv.sys (Trojan.Agent) -> Delete on reboot.
      C:\WINDOWS\system32\pac.txt (Malware.Trace) -> Quarantined and deleted successfully.
      C:\WINDOWS\BM4735dd61.xml (Trojan.Vundo) -> Quarantined and deleted successfully.
      C:\WINDOWS\BM4735dd61.txt (Trojan.Vundo) -> Quarantined and deleted successfully.
      1. siroderab
        Bonjour Sloubi76,

        Voici le rapport de Hijackthis. Tout semble fonctionner parfaitement.
        mais j'attend de voir si tu me conseille autre chose.

        Merci énormément,

        siroderab

        Logfile of HijackThis v1.99.1
        Scan saved at 22:36:13, on 2008-09-23
        Platform: Windows XP SP3 (WinNT 5.01.2600)
        MSIE: Internet Explorer v7.00 (7.00.6000.16705)

        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\System32\WLTRYSVC.EXE
        C:\WINDOWS\System32\bcmwltry.exe
        C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
        C:\WINDOWS\ATKKBService.exe
        C:\Program Files\Bonjour\mDNSResponder.exe
        C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
        C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE
        C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
        C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
        C:\WINDOWS\System32\svchost.exe
        C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe
        C:\Program Files\McAfee\Common Framework\FrameworkService.exe
        C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
        C:\WINDOWS\system32\java.exe
        C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
        C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
        C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
        C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
        C:\WINDOWS\System32\nvsvc32.exe
        C:\WINDOWS\System32\svchost.exe
        C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
        C:\Program Files\Fichiers communs\Pure Networks Shared\Platform\nmsrvc.exe
        C:\Program Files\iPod\bin\iPodService.exe
        C:\WINDOWS\system32\spoolsv.exe
        C:\WINDOWS\Explorer.EXE
        C:\Program Files\Microsoft IntelliPoint\point32.exe
        C:\WINDOWS\system32\WLTRAY.exe
        C:\Program Files\iTunes\iTunesHelper.exe
        C:\Program Files\McAfee\Common Framework\UdaterUI.exe
        C:\WINDOWS\system32\ctfmon.exe
        C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
        C:\Program Files\Windows Media Player\WMPNSCFG.exe
        C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
        C:\Program Files\McAfee\Common Framework\McTray.exe
        C:\Program Files\BOINC\boincmgr.exe
        C:\PROGRA~1\Webshots\webshots.scr
        C:\Program Files\BOINC\boinc.exe
        C:\Program Files\BOINC\projects\setiathome.berkeley.edu\astropulse_4.35_windows_intelx86.exe
        G:\Dezippeur\HijackThis.exe

        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.lapresse.ca
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
        R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
        R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
        O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
        O2 - BHO: (no name) - {5F6E5BDB-1442-45B7-B0C9-E927035A7415} - (no file)
        O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
        O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
        O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
        O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
        O2 - BHO: (no name) - {B282C2C5-A193-4577-B332-76D0758C49C3} - (no file)
        O2 - BHO: (no name) - {d35bbab8-36dd-2aab-dcf6-ea2b2879825c} - (no file)
        O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
        O2 - BHO: (no name) - {F674977C-D461-463B-9835-4DC8E2260A13} - (no file)
        O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
        O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
        O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
        O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
        O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
        O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
        O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
        O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
        O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
        O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
        O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
        O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
        O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
        O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
        O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
        O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
        O4 - Startup: BOINC Manager.lnk = C:\Program Files\BOINC\boincmgr.exe
        O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
        O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
        O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
        O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
        O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
        O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
        O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
        O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
        O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
        O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
        O11 - Options group: [INTERNATIONAL] International*
        O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} (asusTek_sysctrl Class) - http://support.asus.com/common/asusTek_sys_ctrl.cab
        O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
        O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
        O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
        O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
        O18 - Protocol: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Fichiers communs\Pure Networks Shared\Platform\puresp4.dll
        O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
        O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll
        O20 - AppInit_DLLs: gnxwyo.dll
        O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
        O20 - Winlogon Notify: qoMgfCuv - C:\WINDOWS\
        O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
        O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
        O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
        O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
        O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
        O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
        O23 - Service: EPSON V3 Service4(01) (EPSON_PM_RPCV4_01) - SEIKO EPSON CORPORATION - C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE
        O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
        O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing)
        O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
        O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
        O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
        O23 - Service: Linksys Updater (LinksysUpdater) - Unknown owner - C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe" -s "C:\Program Files\Linksys\Linksys Updater\conf\wrapper.conf (file missing)
        O23 - Service: McAfee Framework Service (McAfeeFramework) - Unknown owner - C:\Program Files\McAfee\Common Framework\FrameworkService.exe" /ServiceStart (file missing)
        O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
        O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
        O23 - Service: Pure Networks Platform Service (nmservice) - Pure Networks, Inc. - C:\Program Files\Fichiers communs\Pure Networks Shared\Platform\nmsrvc.exe
        O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
        O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
        O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
        O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

        Je vais me coucher...:0)
        1. Sloubi76
          Siroderab

          Redémarre ta machine,
          Relance Malware, onglet Quarantaine, supprime tout,

          à l´aide de hijack this coches les cases de ces lignes :

          O2 - BHO: (no name) - {5F6E5BDB-1442-45B7-B0C9-E927035A7415} - (no file)
          O2 - BHO: (no name) - {B282C2C5-A193-4577-B332-76D0758C49C3} - (no file)
          O2 - BHO: (no name) - {d35bbab8-36dd-2aab-dcf6-ea2b2879825c} - (no file)
          O2 - BHO: (no name) - {F674977C-D461-463B-9835-4DC8E2260A13} - (no file)
          O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
          O23 - Service: Linksys Updater (LinksysUpdater) - Unknown owner - C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe" -s "C:\Program Files\Linksys\Linksys Updater\conf\wrapper.conf (file missing)

          Puis clique sur Fixchecked

          comment fixer :
          Tutoriel d´utilisation (video) : (Merci a Balltrap34 pour cette réalisation)
          -> http://perso.orange.fr/rginformatique/section%20virus/demohi­jack.htm

          Ensuite,
          Télécharge combofix.exe (par sUBs) sur ton Bureau.

          -> http://download.bleepingcomputer.com/sUBs/ComboFix.exe

          -> Double clique combofix.exe.
          -> Tape sur la touche 1 (Yes) pour démarrer le scan.
          -> Lorsque le scan sera complété, un rapport apparaitra. Copie/colle ce rapport dans ta prochaine réponse.

          NOTE : Le rapport se trouve également ici : C:\Combofix.txt

          Avant d'utiliser ComboFix :

          -> Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours.

          -> Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent géner fortement la procédure de recherche et de nettoyage de l'outil.

          Une fois fait, sur ton bureau double-clic sur Combofix.exe.

          - Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc.

          /!\ Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes.

          - En fin de scan il est possible que ComboFix ait besoin de redémarrer le pc pour finaliser la désinfection\recherche, laisses-le faire.

          - Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt

          -> Réactive la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet.

          -> Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.

          -> Tutoriel https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

          Post également un nouveau rapport hijack this

          @ +
      3. siroderab
        Voilà,

        j'avais oublié d'arrêter l'antivirus, j'espère que c'est quand même OK.

        ComboFix 08-09-22.06 - Dom 2008-09-24 7:01:22.1 - NTFSx86
        Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.516 [GMT -4:00]
        Lancé depuis: C:\Documents and Settings\Dom\Bureau\ComboFix.exe
        * Un nouveau point de restauration a été créé
        * Resident AV is active

        [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
        .

        (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
        .

        C:\Temp\1cb
        C:\Temp\1cb\syscheck.log
        C:\WINDOWS\Fonts\a.zip
        C:\WINDOWS\system32\ljJARLeC.dll
        C:\WINDOWS\system32\MSINET.oca
        C:\WINDOWS\system32\urqOEuTM.dll
        C:\WINDOWS\Temp\tmp3.tmp

        .
        ((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
        .

        -------\Legacy_TDSSSERV
        -------\Service_TDSSserv

        ((((((((((((((((((((((((((((( Fichiers créés du 2008-08-24 au 2008-09-24 ))))))))))))))))))))))))))))))))))))
        .

        2008-09-23 21:37 . 2008-09-23 21:37 <REP> d-------- C:\Documents and Settings\Sylvie\Application Data\Microsoft Web Folders
        2008-09-23 19:52 . 2008-09-23 19:52 95 --a------ C:\WINDOWS\wininit.ini
        2008-09-23 18:58 . 2008-09-23 18:58 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
        2008-09-23 18:58 . 2008-09-23 18:58 <REP> d-------- C:\Documents and Settings\Dom\Application Data\Malwarebytes
        2008-09-23 18:58 . 2008-09-23 18:58 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
        2008-09-23 18:58 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
        2008-09-23 18:58 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
        2008-09-20 16:19 . 2008-09-20 16:22 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
        2008-09-20 16:19 . 2008-09-23 21:43 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
        2008-09-20 16:02 . 2008-09-21 20:22 988,061 ---hs---- C:\WINDOWS\system32\cfOrutwa.ini
        2008-09-18 21:50 . 2008-09-24 07:02 <REP> d-------- C:\QUARANTINE
        2008-09-18 19:51 . 2008-09-18 20:06 988,060 ---hs---- C:\WINDOWS\system32\SsBeOXyb.ini
        2008-09-17 22:39 . 2008-09-17 22:39 <REP> d-------- C:\Program Files\McAfee
        2008-09-17 22:39 . 2008-09-17 22:39 <REP> d-------- C:\Program Files\Fichiers communs\McAfee
        2008-09-17 22:39 . 2008-09-17 22:40 <REP> d-------- C:\Documents and Settings\All Users\Application Data\McAfee
        2008-09-17 22:39 . 2007-02-22 20:50 170,408 --a------ C:\WINDOWS\system32\drivers\mfehidk.sys
        2008-09-17 22:39 . 2006-11-30 08:50 72,264 --a------ C:\WINDOWS\system32\drivers\mfeavfk.sys
        2008-09-17 22:39 . 2006-11-30 08:50 64,360 --a------ C:\WINDOWS\system32\drivers\mfeapfk.sys
        2008-09-17 22:39 . 2006-11-30 08:50 52,136 --a------ C:\WINDOWS\system32\drivers\mfetdik.sys
        2008-09-17 22:39 . 2006-11-30 08:50 34,152 --a------ C:\WINDOWS\system32\drivers\mfebopk.sys
        2008-09-17 22:39 . 2006-12-19 15:06 280 --a------ C:\WINDOWS\system32\epoPGPsdk.dll.sig
        2008-09-17 21:53 . 2008-09-20 18:00 <REP> d-------- C:\Program Files\Enigma Software Group
        2008-09-17 18:47 . 2008-09-17 18:47 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
        2008-09-17 18:37 . 2006-12-19 15:06 1,495,552 --a------ C:\WINDOWS\system32\epoPGPsdk.dll
        2008-09-16 11:32 . 2008-09-16 22:51 2,006,348 ---hs---- C:\WINDOWS\system32\tbcdssjw.ini
        2008-09-16 08:26 . 2008-09-16 08:26 1,014,892 ---hs---- C:\WINDOWS\system32\reblmuve.ini
        2008-09-16 08:14 . 2008-09-23 20:57 <REP> d-------- C:\WINDOWS\system32\xaz
        2008-09-16 08:14 . 2008-09-23 20:57 <REP> d-------- C:\WINDOWS\system32\utc
        2008-09-16 08:14 . 2008-09-19 18:11 <REP> d-------- C:\WINDOWS\system32\mC02
        2008-09-16 08:14 . 2008-09-17 21:18 <REP> d-------- C:\WINDOWS\system32\gd2
        2008-09-16 08:14 . 2008-09-16 08:14 <REP> d-------- C:\Temp\mtc2
        2008-09-16 08:14 . 2008-09-24 07:04 <REP> d-------- C:\Temp
        2008-09-16 08:14 . 2008-09-16 08:14 355 --a------ C:\969.bat
        2008-09-14 14:36 . 2008-09-14 14:36 147,456 --a------ C:\WINDOWS\system32\vbzip10.dll
        2008-09-13 18:09 . 2008-09-13 18:09 <REP> d-------- C:\Program Files\iTunes
        2008-09-13 18:09 . 2008-09-13 18:09 <REP> d-------- C:\Program Files\iPod
        2008-09-13 18:09 . 2008-09-13 18:09 <REP> d-------- C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
        2008-09-13 18:08 . 2008-09-13 18:08 <REP> d-------- C:\Program Files\Bonjour
        2008-09-13 18:07 . 2008-09-13 18:08 <REP> d-------- C:\Program Files\QuickTime
        2008-09-07 18:11 . 2008-09-09 19:40 <REP> d-------- C:\Documents and Settings\Dom\Application Data\SPORE Creature Creator
        2008-09-07 18:10 . 2008-09-07 18:10 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll
        2008-09-07 18:05 . 2008-09-07 18:05 <REP> d-------- C:\ProgramData
        2008-09-07 18:04 . 2008-09-07 18:11 2,016 --a------ C:\WINDOWS\system32\ealregsnapshot1.reg
        2008-09-07 18:01 . 2008-09-07 18:05 <REP> d-------- C:\Program Files\Electronic Arts
        2008-09-07 15:38 . 2008-09-07 15:39 6,884 --a------ C:\WINDOWS\bcmBC.tmp
        2008-09-07 14:49 . 2008-05-16 06:10 23,992 --a------ C:\WINDOWS\system32\drivers\pnarp.sys
        2008-09-07 14:48 . 2008-09-07 14:48 <REP> d-------- C:\Program Files\Fichiers communs\Pure Networks Shared
        2008-09-07 14:48 . 2008-05-16 06:10 25,272 --a------ C:\WINDOWS\system32\drivers\purendis.sys
        2008-09-07 14:39 . 2008-09-07 14:39 <REP> dr------- C:\Documents and Settings\LocalService\Favoris
        2008-09-06 15:09 . 2008-09-06 15:09 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
        2008-09-06 15:09 . 2008-09-06 15:09 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts
        2008-09-05 07:03 . 2008-09-05 07:03 <REP> d-------- C:\Program Files\MSBuild
        2008-09-05 07:00 . 2008-09-05 07:00 <REP> d-------- C:\WINDOWS\system32\XPSViewer
        2008-09-05 07:00 . 2008-09-05 07:00 <REP> d-------- C:\Program Files\Reference Assemblies
        2008-09-05 06:59 . 2006-06-29 13:07 14,048 --------- C:\WINDOWS\system32\spmsg2.dll
        2008-09-05 06:56 . 2008-09-05 06:56 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Linksys
        2008-09-05 06:55 . 2008-09-05 06:55 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Pure Networks
        2008-09-05 06:54 . 2008-09-07 14:47 <REP> d-------- C:\Program Files\Linksys
        2008-09-04 22:36 . 2006-04-24 23:51 543,104 --a------ C:\WINDOWS\system32\drivers\BCMWL5.SYS
        2008-09-04 21:43 . 2008-09-04 21:43 <REP> d-------- C:\Program Files\Broadcom
        2008-09-04 21:42 . 2008-09-04 21:42 <REP> d-------- C:\Program Files\Wireless-N PCI Adapter
        2008-09-04 21:42 . 2006-04-24 23:51 676,864 --a------ C:\WINDOWS\system32\bcmwl564.sys
        2008-09-04 21:42 . 2006-04-24 23:51 543,104 --a------ C:\WINDOWS\system32\bcmwl5.sys
        2008-09-04 21:42 . 2003-10-13 15:30 94,208 --------- C:\WINDOWS\system32\GTW32N50.dll
        2008-09-04 21:42 . 2003-09-25 23:28 31,930 --------- C:\WINDOWS\system32\GTNDIS3.VXD
        2008-09-04 21:42 . 2003-09-25 22:15 15,872 --------- C:\WINDOWS\system32\GTNDIS5.sys
        2008-09-04 21:42 . 2008-09-04 21:42 766 --a------ C:\WINDOWS\system32\WLAN.INI
        2008-09-02 11:29 . 2008-09-02 11:29 <REP> d--h----- C:\WINDOWS\PIF
        2008-08-29 10:18 . 2008-08-29 10:18 87,336 --a------ C:\WINDOWS\system32\dns-sd.exe
        2008-08-29 09:53 . 2008-08-29 09:53 61,440 --a------ C:\WINDOWS\system32\dnssd.dll
        2008-08-24 20:33 . 2008-08-24 20:33 <REP> d-------- C:\Documents and Settings\LocalService\Mes documents

        .
        (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
        .
        2008-09-24 11:08 --------- d-----w C:\Program Files\BOINC
        2008-09-23 23:08 --------- d-----w C:\Program Files\Microsoft IntelliPoint
        2008-09-22 22:45 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
        2008-09-19 00:48 --------- d-----w C:\Documents and Settings\Dom\Application Data\LimeWire
        2008-09-18 02:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Network Associates
        2008-09-17 23:47 --------- d-----w C:\Documents and Settings\Dom\Application Data\U3
        2008-09-17 22:36 --------- d-----w C:\Program Files\Fichiers communs\Network Associates
        2008-09-14 19:22 --------- d-----w C:\Program Files\LimeWire
        2008-09-11 03:40 --------- d-----w C:\Documents and Settings\Dom\Application Data\Skype
        2008-09-07 22:05 --------- d--h--w C:\Program Files\InstallShield Installation Information
        2008-09-05 10:56 --------- d-----w C:\Program Files\Java
        2008-08-30 18:41 --------- d-----w C:\Documents and Settings\Dom\Application Data\ArcSoft
        2008-08-29 20:16 --------- d-----w C:\Documents and Settings\Maude\Application Data\Apple Computer
        2008-08-22 03:16 --------- d-----w C:\Program Files\Windows Live Toolbar
        2008-08-22 03:12 --------- d-----w C:\Program Files\Windows Live
        2008-08-21 15:18 --------- d-----w C:\Program Files\MSN Messenger
        2008-08-21 15:18 --------- d-----w C:\Program Files\Microsoft SQL Server Compact Edition
        2008-08-21 15:18 --------- d-----w C:\Documents and Settings\All Users\Application Data\Messenger Plus!
        2008-08-21 15:16 --------- dcsh--w C:\Program Files\Fichiers communs\WindowsLiveInstaller
        2008-08-21 15:15 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
        2008-08-21 15:12 --------- d-----w C:\Program Files\Messenger Plus! Live
        2008-08-06 02:13 --------- d-----w C:\Program Files\Apple Software Update
        2008-08-04 13:10 --------- d-----w C:\Documents and Settings\Dom\Application Data\Apple Computer
        2008-08-04 12:59 --------- d-----w C:\Program Files\Safari
        2008-07-31 18:01 --------- d-----w C:\Documents and Settings\Maude\Application Data\MSN6
        2008-07-31 18:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\MSN6
        2008-07-30 00:43 --------- d-----w C:\Program Files\Fichiers communs\Adobe
        2008-07-18 18:39 587,264 ----a-w C:\WINDOWS\WLXPGSS.SCR
        2008-07-11 02:50 63,489,320 ----a-w C:\iTunesSetup.exe
        2008-07-10 01:18 60,416 ----a-w C:\WINDOWS\ALCFDRTM.EXE
        2008-07-10 01:14 77,824 ----a-w C:\WINDOWS\SOUNDMAN.EXE
        2008-07-10 01:13 294,912 ------w C:\WINDOWS\alcupd.exe
        2008-07-10 01:13 200,704 ------w C:\WINDOWS\alcrmv.exe
        2008-07-09 01:43 774,144 ----a-w C:\Program Files\RngInterstitial.dll
        2008-07-08 15:01 92 ----a-w C:\WINDOWSdun.bat
        .

        ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
        .
        .
        *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
        REGEDIT4

        [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 22:33 15360]
        "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-07-08 13:34 68856]
        "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-03 09:59 204288]
        "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-08-18 18:41 1832272]

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2006-02-13 09:05 86016]
        "IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\point32.exe" [2004-06-03 01:50 204800]
        "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 02:38 34672]
        "Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY.exe" [2006-04-24 23:51 1273856]
        "AppleSyncNotifier"="C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-09-03 20:12 111936]
        "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-09-10 17:40 289576]
        "ShStatEXE"="C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" [2007-02-22 20:50 112216]
        "McAfeeUpdaterUI"="C:\Program Files\McAfee\Common Framework\UdaterUI.exe" [2006-12-19 11:27 136768]
        "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-02-13 09:05 7557120]
        "nwiz"="nwiz.exe" [2006-02-13 09:05 1519616 C:\WINDOWS\system32\nwiz.exe]

        [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
        "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2008-04-13 22:33 15360]

        C:\Documents and Settings\Maude\Menu D‚marrer\Programmes\D‚marrage\
        Webshots.lnk - C:\Program Files\Webshots\Launcher.exe [2008-07-08 21:51:47 157008]

        C:\Documents and Settings\Sylvie\Menu D‚marrer\Programmes\D‚marrage\
        Webshots.lnk - C:\Program Files\Webshots\Launcher.exe [2008-07-08 21:51:47 157008]

        C:\Documents and Settings\Dom\Menu D‚marrer\Programmes\D‚marrage\
        BOINC Manager.lnk - C:\Program Files\BOINC\boincmgr.exe [2008-03-04 14:00:20 4150016]
        Webshots.lnk - C:\Program Files\Webshots\Launcher.exe [2008-07-08 21:51:47 157008]

        [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
        "AppInit_DLLs"=gnxwyo.dll

        [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Cisco Systems VPN Client.lnk]
        path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Cisco Systems VPN Client.lnk
        backup=C:\WINDOWS\pss\Cisco Systems VPN Client.lnkCommon Startup

        [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Reader.lnk]
        path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Lancement rapide d'Adobe Reader.lnk
        backup=C:\WINDOWS\pss\Lancement rapide d'Adobe Reader.lnkCommon Startup

        [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk]
        path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk
        backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
        --a------ 2008-09-10 17:40 289576 C:\Program Files\iTunes\iTunesHelper.exe

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nTrayFw]
        --a------ 2005-04-29 18:22 266240 C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Profiler]
        --a------ 2004-01-28 09:19 159744 C:\Program Files\Saitek\Software\Profiler.exe

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
        --a------ 2008-07-08 13:34 68856 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
        --a------ 2008-07-09 21:14 77824 C:\WINDOWS\SOUNDMAN.EXE

        [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
        "NvCplDaemon"=RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
        "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime
        "4406eefd"=rundll32.exe "C:\WINDOWS\system32\byXQGvwu.dll",b
        "BM4735dd61"=Rundll32.exe "C:\WINDOWS\system32\thacaroe.dll",s

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
        "%windir%\\system32\\sessmgr.exe"=

        R2 LinksysUpdater;Linksys Updater;C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe [2008-06-26 12:52 204800]
        R3 SaiH0464;SaiH0464;C:\WINDOWS\system32\DRIVERS\SaiH0464.sys [2004-01-30 09:29 55808]
        .
        Contenu du dossier 'Tâches planifiées'
        .
        - - - - ORPHELINS SUPPRIMES - - - -

        Notify-qoMgfCuv - (no file)

        .
        ------- Examen supplémentaire -------
        .
        FireFox -: Profile - C:\Documents and Settings\Dom\Application Data\Mozilla\Firefox\Profiles\7rsygigz.default\
        FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
        FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.cyberpresse.ca/
        FF -: plugin - C:\Program Files\Google\Google Updater\2.2.1273.1045\npCIDetect12.dll
        FF -: plugin - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
        FF -: plugin - C:\Program Files\Real\RealArcade\Plugins\Mozilla\npracplug.dll
        .

        Logfile of HijackThis v1.99.1
        Scan saved at 07:18, on 2008-09-24
        Platform: Windows XP SP3 (WinNT 5.01.2600)
        MSIE: Internet Explorer v7.00 (7.00.6000.16705)

        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\System32\WLTRYSVC.EXE
        C:\WINDOWS\System32\bcmwltry.exe
        C:\WINDOWS\system32\spoolsv.exe
        C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
        C:\WINDOWS\ATKKBService.exe
        C:\Program Files\Bonjour\mDNSResponder.exe
        C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
        C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE
        C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
        C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
        C:\WINDOWS\System32\svchost.exe
        C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe
        C:\Program Files\McAfee\Common Framework\FrameworkService.exe
        C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
        C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
        C:\WINDOWS\system32\java.exe
        C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
        C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
        C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
        C:\WINDOWS\System32\nvsvc32.exe
        C:\WINDOWS\System32\svchost.exe
        C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
        C:\Program Files\Fichiers communs\Pure Networks Shared\Platform\nmsrvc.exe
        C:\WINDOWS\Explorer.EXE
        C:\Program Files\Microsoft IntelliPoint\point32.exe
        C:\WINDOWS\system32\WLTRAY.exe
        C:\Program Files\iTunes\iTunesHelper.exe
        C:\Program Files\McAfee\Common Framework\UdaterUI.exe
        C:\WINDOWS\system32\ctfmon.exe
        C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
        C:\Program Files\Windows Media Player\WMPNSCFG.exe
        C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
        C:\Program Files\McAfee\Common Framework\McTray.exe
        C:\Program Files\BOINC\boincmgr.exe
        C:\PROGRA~1\Webshots\webshots.scr
        C:\Program Files\BOINC\boinc.exe
        C:\Program Files\BOINC\projects\setiathome.berkeley.edu\setiathome_6.03_windows_intelx86.exe
        C:\Program Files\iPod\bin\iPodService.exe
        C:\WINDOWS\system32\wuauclt.exe
        C:\Program Files\Internet Explorer\iexplore.exe
        C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
        C:\WINDOWS\system32\NOTEPAD.EXE
        G:\HiJackThis\HijackThis.exe

        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.lapresse.ca
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
        R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
        R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
        O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
        O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
        O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
        O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
        O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
        O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
        O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
        O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
        O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
        O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
        O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
        O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
        O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
        O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
        O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
        O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
        O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
        O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
        O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
        O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
        O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
        O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
        O4 - Startup: BOINC Manager.lnk = C:\Program Files\BOINC\boincmgr.exe
        O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
        O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
        O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
        O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
        O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
        O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
        O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
        O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
        O11 - Options group: [INTERNATIONAL] International*
        O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} (asusTek_sysctrl Class) - http://support.asus.com/common/asusTek_sys_ctrl.cab
        O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
        O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
        O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
        O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
        O18 - Protocol: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Fichiers communs\Pure Networks Shared\Platform\puresp4.dll
        O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
        O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll
        O20 - Winlogon Notify: qoMgfCuv - C:\WINDOWS\
        O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
        O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
        O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
        O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
        O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
        O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
        O23 - Service: EPSON V3 Service4(01) (EPSON_PM_RPCV4_01) - SEIKO EPSON CORPORATION - C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE
        O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
        O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing)
        O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
        O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
        O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
        O23 - Service: Linksys Updater (LinksysUpdater) - Unknown owner - C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe" -s "C:\Program Files\Linksys\Linksys Updater\conf\wrapper.conf (file missing)
        O23 - Service: McAfee Framework Service (McAfeeFramework) - Unknown owner - C:\Program Files\McAfee\Common Framework\FrameworkService.exe" /ServiceStart (file missing)
        O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
        O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
        O23 - Service: Pure Networks Platform Service (nmservice) - Pure Networks, Inc. - C:\Program Files\Fichiers communs\Pure Networks Shared\Platform\nmsrvc.exe
        O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
        O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
        O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
        O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
        1. Sloubi76
          Bonsoir Siroderab,

          Sans l'antivirus stp

          @ +
      4. siroderab
        Revoila le tout!

        ComboFix 08-09-22.06 - Dom 2008-09-24 18:25:46.5 - NTFSx86
        Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.589 [GMT -4:00]
        Lancé depuis: C:\Documents and Settings\Dom\Bureau\ComboFix.exe

        [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
        .

        ((((((((((((((((((((((((((((( Fichiers créés du 2008-08-24 au 2008-09-24 ))))))))))))))))))))))))))))))))))))
        .

        2008-09-23 21:37 . 2008-09-23 21:37 <REP> d-------- C:\Documents and Settings\Sylvie\Application Data\Microsoft Web Folders
        2008-09-23 19:52 . 2008-09-23 19:52 95 --a------ C:\WINDOWS\wininit.ini
        2008-09-23 18:58 . 2008-09-23 18:58 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
        2008-09-23 18:58 . 2008-09-23 18:58 <REP> d-------- C:\Documents and Settings\Dom\Application Data\Malwarebytes
        2008-09-23 18:58 . 2008-09-23 18:58 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
        2008-09-23 18:58 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
        2008-09-23 18:58 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
        2008-09-20 16:19 . 2008-09-20 16:22 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
        2008-09-20 16:19 . 2008-09-23 21:43 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
        2008-09-20 16:02 . 2008-09-21 20:22 988,061 ---hs---- C:\WINDOWS\system32\cfOrutwa.ini
        2008-09-18 21:50 . 2008-09-24 07:02 <REP> d-------- C:\QUARANTINE
        2008-09-18 19:51 . 2008-09-18 20:06 988,060 ---hs---- C:\WINDOWS\system32\SsBeOXyb.ini
        2008-09-17 22:39 . 2008-09-17 22:39 <REP> d-------- C:\Program Files\McAfee
        2008-09-17 22:39 . 2008-09-17 22:39 <REP> d-------- C:\Program Files\Fichiers communs\McAfee
        2008-09-17 22:39 . 2008-09-17 22:40 <REP> d-------- C:\Documents and Settings\All Users\Application Data\McAfee
        2008-09-17 22:39 . 2007-02-22 20:50 170,408 --a------ C:\WINDOWS\system32\drivers\mfehidk.sys
        2008-09-17 22:39 . 2006-11-30 08:50 72,264 --a------ C:\WINDOWS\system32\drivers\mfeavfk.sys
        2008-09-17 22:39 . 2006-11-30 08:50 64,360 --a------ C:\WINDOWS\system32\drivers\mfeapfk.sys
        2008-09-17 22:39 . 2006-11-30 08:50 52,136 --a------ C:\WINDOWS\system32\drivers\mfetdik.sys
        2008-09-17 22:39 . 2006-11-30 08:50 34,152 --a------ C:\WINDOWS\system32\drivers\mfebopk.sys
        2008-09-17 22:39 . 2006-12-19 15:06 280 --a------ C:\WINDOWS\system32\epoPGPsdk.dll.sig
        2008-09-17 21:53 . 2008-09-20 18:00 <REP> d-------- C:\Program Files\Enigma Software Group
        2008-09-17 18:47 . 2008-09-17 18:47 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
        2008-09-17 18:37 . 2006-12-19 15:06 1,495,552 --a------ C:\WINDOWS\system32\epoPGPsdk.dll
        2008-09-16 11:32 . 2008-09-16 22:51 2,006,348 ---hs---- C:\WINDOWS\system32\tbcdssjw.ini
        2008-09-16 08:26 . 2008-09-16 08:26 1,014,892 ---hs---- C:\WINDOWS\system32\reblmuve.ini
        2008-09-16 08:14 . 2008-09-23 20:57 <REP> d-------- C:\WINDOWS\system32\xaz
        2008-09-16 08:14 . 2008-09-23 20:57 <REP> d-------- C:\WINDOWS\system32\utc
        2008-09-16 08:14 . 2008-09-19 18:11 <REP> d-------- C:\WINDOWS\system32\mC02
        2008-09-16 08:14 . 2008-09-17 21:18 <REP> d-------- C:\WINDOWS\system32\gd2
        2008-09-16 08:14 . 2008-09-16 08:14 <REP> d-------- C:\Temp\mtc2
        2008-09-16 08:14 . 2008-09-24 07:04 <REP> d-------- C:\Temp
        2008-09-16 08:14 . 2008-09-16 08:14 355 --a------ C:\969.bat
        2008-09-14 14:36 . 2008-09-14 14:36 147,456 --a------ C:\WINDOWS\system32\vbzip10.dll
        2008-09-13 18:09 . 2008-09-13 18:09 <REP> d-------- C:\Program Files\iTunes
        2008-09-13 18:09 . 2008-09-13 18:09 <REP> d-------- C:\Program Files\iPod
        2008-09-13 18:09 . 2008-09-13 18:09 <REP> d-------- C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
        2008-09-13 18:08 . 2008-09-13 18:08 <REP> d-------- C:\Program Files\Bonjour
        2008-09-13 18:07 . 2008-09-13 18:08 <REP> d-------- C:\Program Files\QuickTime
        2008-09-07 18:11 . 2008-09-09 19:40 <REP> d-------- C:\Documents and Settings\Dom\Application Data\SPORE Creature Creator
        2008-09-07 18:10 . 2008-09-07 18:10 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll
        2008-09-07 18:05 . 2008-09-07 18:05 <REP> d-------- C:\ProgramData
        2008-09-07 18:04 . 2008-09-07 18:11 2,016 --a------ C:\WINDOWS\system32\ealregsnapshot1.reg
        2008-09-07 18:01 . 2008-09-07 18:05 <REP> d-------- C:\Program Files\Electronic Arts
        2008-09-07 15:38 . 2008-09-07 15:39 6,884 --a------ C:\WINDOWS\bcmBC.tmp
        2008-09-07 14:49 . 2008-05-16 06:10 23,992 --a------ C:\WINDOWS\system32\drivers\pnarp.sys
        2008-09-07 14:48 . 2008-09-07 14:48 <REP> d-------- C:\Program Files\Fichiers communs\Pure Networks Shared
        2008-09-07 14:48 . 2008-05-16 06:10 25,272 --a------ C:\WINDOWS\system32\drivers\purendis.sys
        2008-09-07 14:39 . 2008-09-07 14:39 <REP> dr------- C:\Documents and Settings\LocalService\Favoris
        2008-09-06 15:09 . 2008-09-06 15:09 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
        2008-09-06 15:09 . 2008-09-06 15:09 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts
        2008-09-05 07:03 . 2008-09-05 07:03 <REP> d-------- C:\Program Files\MSBuild
        2008-09-05 07:00 . 2008-09-05 07:00 <REP> d-------- C:\WINDOWS\system32\XPSViewer
        2008-09-05 07:00 . 2008-09-05 07:00 <REP> d-------- C:\Program Files\Reference Assemblies
        2008-09-05 06:59 . 2006-06-29 13:07 14,048 --------- C:\WINDOWS\system32\spmsg2.dll
        2008-09-05 06:56 . 2008-09-05 06:56 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Linksys
        2008-09-05 06:55 . 2008-09-05 06:55 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Pure Networks
        2008-09-05 06:54 . 2008-09-07 14:47 <REP> d-------- C:\Program Files\Linksys
        2008-09-04 22:36 . 2006-04-24 23:51 543,104 --a------ C:\WINDOWS\system32\drivers\BCMWL5.SYS
        2008-09-04 21:43 . 2008-09-04 21:43 <REP> d-------- C:\Program Files\Broadcom
        2008-09-04 21:42 . 2008-09-04 21:42 <REP> d-------- C:\Program Files\Wireless-N PCI Adapter
        2008-09-04 21:42 . 2006-04-24 23:51 676,864 --a------ C:\WINDOWS\system32\bcmwl564.sys
        2008-09-04 21:42 . 2006-04-24 23:51 543,104 --a------ C:\WINDOWS\system32\bcmwl5.sys
        2008-09-04 21:42 . 2003-10-13 15:30 94,208 --------- C:\WINDOWS\system32\GTW32N50.dll
        2008-09-04 21:42 . 2003-09-25 23:28 31,930 --------- C:\WINDOWS\system32\GTNDIS3.VXD
        2008-09-04 21:42 . 2003-09-25 22:15 15,872 --------- C:\WINDOWS\system32\GTNDIS5.sys
        2008-09-04 21:42 . 2008-09-04 21:42 766 --a------ C:\WINDOWS\system32\WLAN.INI
        2008-09-02 11:29 . 2008-09-02 11:29 <REP> d--h----- C:\WINDOWS\PIF
        2008-08-29 10:18 . 2008-08-29 10:18 87,336 --a------ C:\WINDOWS\system32\dns-sd.exe
        2008-08-29 09:53 . 2008-08-29 09:53 61,440 --a------ C:\WINDOWS\system32\dnssd.dll
        2008-08-24 20:33 . 2008-08-24 20:33 <REP> d-------- C:\Documents and Settings\LocalService\Mes documents

        .
        (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
        .
        2008-09-24 21:58 --------- d-----w C:\Program Files\BOINC
        2008-09-23 23:08 --------- d-----w C:\Program Files\Microsoft IntelliPoint
        2008-09-22 22:45 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
        2008-09-19 00:48 --------- d-----w C:\Documents and Settings\Dom\Application Data\LimeWire
        2008-09-18 02:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Network Associates
        2008-09-17 23:47 --------- d-----w C:\Documents and Settings\Dom\Application Data\U3
        2008-09-17 22:36 --------- d-----w C:\Program Files\Fichiers communs\Network Associates
        2008-09-14 19:22 --------- d-----w C:\Program Files\LimeWire
        2008-09-11 03:40 --------- d-----w C:\Documents and Settings\Dom\Application Data\Skype
        2008-09-07 22:05 --------- d--h--w C:\Program Files\InstallShield Installation Information
        2008-09-05 10:56 --------- d-----w C:\Program Files\Java
        2008-08-30 18:41 --------- d-----w C:\Documents and Settings\Dom\Application Data\ArcSoft
        2008-08-29 20:16 --------- d-----w C:\Documents and Settings\Maude\Application Data\Apple Computer
        2008-08-22 03:16 --------- d-----w C:\Program Files\Windows Live Toolbar
        2008-08-22 03:12 --------- d-----w C:\Program Files\Windows Live
        2008-08-21 15:18 --------- d-----w C:\Program Files\MSN Messenger
        2008-08-21 15:18 --------- d-----w C:\Program Files\Microsoft SQL Server Compact Edition
        2008-08-21 15:18 --------- d-----w C:\Documents and Settings\All Users\Application Data\Messenger Plus!
        2008-08-21 15:16 --------- dcsh--w C:\Program Files\Fichiers communs\WindowsLiveInstaller
        2008-08-21 15:15 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
        2008-08-21 15:12 --------- d-----w C:\Program Files\Messenger Plus! Live
        2008-08-06 02:13 --------- d-----w C:\Program Files\Apple Software Update
        2008-08-04 13:10 --------- d-----w C:\Documents and Settings\Dom\Application Data\Apple Computer
        2008-08-04 12:59 --------- d-----w C:\Program Files\Safari
        2008-07-31 18:01 --------- d-----w C:\Documents and Settings\Maude\Application Data\MSN6
        2008-07-31 18:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\MSN6
        2008-07-30 00:43 --------- d-----w C:\Program Files\Fichiers communs\Adobe
        2008-07-19 02:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
        2008-07-19 02:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
        2008-07-19 02:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
        2008-07-19 02:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
        2008-07-19 02:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
        2008-07-19 02:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
        2008-07-19 02:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
        2008-07-19 02:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
        2008-07-19 02:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll
        2008-07-19 02:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
        2008-07-18 18:39 587,264 ----a-w C:\WINDOWS\WLXPGSS.SCR
        2008-07-11 02:50 63,489,320 ----a-w C:\iTunesSetup.exe
        2008-07-10 01:18 60,416 ----a-w C:\WINDOWS\ALCFDRTM.EXE
        2008-07-10 01:14 9,294,336 ----a-w C:\WINDOWS\system32\RTLCPL.EXE
        2008-07-10 01:14 77,824 ----a-w C:\WINDOWS\SOUNDMAN.EXE
        2008-07-10 01:13 40,960 ------w C:\WINDOWS\system32\ChCfg.exe
        2008-07-10 01:13 294,912 ------w C:\WINDOWS\alcupd.exe
        2008-07-10 01:13 200,704 ------w C:\WINDOWS\alcrmv.exe
        2008-07-10 01:13 156,672 ----a-w C:\WINDOWS\system32\RTLCPAPI.dll
        2008-07-09 01:43 774,144 ----a-w C:\Program Files\RngInterstitial.dll
        2008-07-08 15:01 92 ----a-w C:\WINDOWSdun.bat
        2008-07-07 20:28 253,952 ----a-w C:\WINDOWS\system32\es.dll
        2008-06-24 22:12 295,936 ------w C:\WINDOWS\system32\wmpeffects.dll
        2008-06-24 16:44 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
        .

        ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
        .
        .
        *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
        REGEDIT4

        [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 15360]
        "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-07-08 68856]
        "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-03 204288]

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2006-02-13 86016]
        "IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\point32.exe" [2004-06-03 204800]
        "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
        "Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY.exe" [2006-04-24 1273856]
        "AppleSyncNotifier"="C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-09-03 111936]
        "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-09-10 289576]
        "ShStatEXE"="C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" [2007-02-22 112216]
        "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-02-13 7557120]
        "nwiz"="nwiz.exe" [2006-02-13 C:\WINDOWS\system32\nwiz.exe]

        [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
        "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2008-04-13 15360]

        C:\Documents and Settings\Maude\Menu D‚marrer\Programmes\D‚marrage\
        Webshots.lnk - C:\Program Files\Webshots\Launcher.exe [2008-07-08 157008]

        C:\Documents and Settings\Sylvie\Menu D‚marrer\Programmes\D‚marrage\
        Webshots.lnk - C:\Program Files\Webshots\Launcher.exe [2008-07-08 157008]

        [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\qoMgfCuv]
        [BU]

        [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
        "AppInit_DLLs"=gnxwyo.dll

        [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Cisco Systems VPN Client.lnk]
        path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Cisco Systems VPN Client.lnk
        backup=C:\WINDOWS\pss\Cisco Systems VPN Client.lnkCommon Startup

        [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Reader.lnk]
        path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Lancement rapide d'Adobe Reader.lnk
        backup=C:\WINDOWS\pss\Lancement rapide d'Adobe Reader.lnkCommon Startup

        [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk]
        path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk
        backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

        [HKLM\~\startupfolder\C:^Documents and Settings^Dom^Menu Démarrer^Programmes^Démarrage^BOINC Manager.lnk]
        path=C:\Documents and Settings\Dom\Menu Démarrer\Programmes\Démarrage\BOINC Manager.lnk
        backup=C:\WINDOWS\pss\BOINC Manager.lnkStartup

        [HKLM\~\startupfolder\C:^Documents and Settings^Dom^Menu Démarrer^Programmes^Démarrage^Webshots.lnk]
        path=C:\Documents and Settings\Dom\Menu Démarrer\Programmes\Démarrage\Webshots.lnk
        backup=C:\WINDOWS\pss\Webshots.lnkStartup

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
        --a------ 2008-09-10 17:40 289576 C:\Program Files\iTunes\iTunesHelper.exe

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\McAfeeUpdaterUI]
        --a------ 2006-12-19 11:27 136768 C:\Program Files\McAfee\Common Framework\UdaterUI.exe

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nTrayFw]
        --a------ 2005-04-29 18:22 266240 C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Profiler]
        --a------ 2004-01-28 09:19 159744 C:\Program Files\Saitek\Software\Profiler.exe

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
        -rahs---- 2008-08-18 18:41 1832272 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
        --a------ 2008-07-08 13:34 68856 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

        [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
        --a------ 2008-07-09 21:14 77824 C:\WINDOWS\SOUNDMAN.EXE

        [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
        "NvCplDaemon"=RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
        "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime
        "4406eefd"=rundll32.exe "C:\WINDOWS\system32\byXQGvwu.dll",b
        "BM4735dd61"=Rundll32.exe "C:\WINDOWS\system32\thacaroe.dll",s

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
        "EnableFirewall"= 0 (0x0)

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
        "%windir%\\system32\\sessmgr.exe"=

        R2 LinksysUpdater;Linksys Updater;C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe [2008-06-26 204800]
        R3 SaiH0464;SaiH0464;C:\WINDOWS\system32\DRIVERS\SaiH0464.sys [2004-01-30 55808]
        .
        Contenu du dossier 'Tâches planifiées'
        .
        .
        ------- Examen supplémentaire -------
        .
        FireFox -: Profile - C:\Documents and Settings\Dom\Application Data\Mozilla\Firefox\Profiles\7rsygigz.default\
        FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
        FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.cyberpresse.ca/
        FF -: plugin - C:\Program Files\Google\Google Updater\2.2.1273.1045\npCIDetect12.dll
        FF -: plugin - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
        FF -: plugin - C:\Program Files\Real\RealArcade\Plugins\Mozilla\npracplug.dll
        .

        **************************************************************************

        catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
        Rootkit scan 2008-09-24 18:26:27
        Windows 5.1.2600 Service Pack 3 NTFS

        Recherche de processus cachés ...

        Recherche d'éléments en démarrage automatique cachés ...

        Recherche de fichiers cachés ...

        Scan terminé avec succès
        Fichiers cachés: 0

        **************************************************************************
        .
        Heure de fin: 2008-09-24 18:26:57
        ComboFix-quarantined-files.txt 2008-09-24 22:26:54
        ComboFix2.txt 2008-09-24 22:14:32
        ComboFix3.txt 2008-09-24 22:10:30
        ComboFix4.txt 2008-09-24 21:56:19

        Avant-CF: 52ÿ510ÿ179ÿ328 octets libres
        Après-CF: 52,494,368,768 octets libres

        233 --- E O F --- 2008-09-10 00:08:17

        Logfile of HijackThis v1.99.1
        Scan saved at 18:28:45, on 2008-09-24
        Platform: Windows XP SP3 (WinNT 5.01.2600)
        MSIE: Internet Explorer v7.00 (7.00.6000.16705)

        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\System32\WLTRYSVC.EXE
        C:\WINDOWS\System32\bcmwltry.exe
        C:\WINDOWS\system32\spoolsv.exe
        C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
        C:\WINDOWS\ATKKBService.exe
        C:\Program Files\Bonjour\mDNSResponder.exe
        C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
        C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE
        C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
        C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
        C:\WINDOWS\System32\svchost.exe
        C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe
        C:\Program Files\McAfee\Common Framework\FrameworkService.exe
        C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
        C:\WINDOWS\system32\java.exe
        C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
        C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
        C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
        C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
        C:\WINDOWS\System32\nvsvc32.exe
        C:\WINDOWS\System32\svchost.exe
        C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
        C:\Program Files\Fichiers communs\Pure Networks Shared\Platform\nmsrvc.exe
        C:\Program Files\Microsoft IntelliPoint\point32.exe
        C:\WINDOWS\system32\WLTRAY.exe
        C:\Program Files\iTunes\iTunesHelper.exe
        C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE
        C:\WINDOWS\system32\ctfmon.exe
        C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
        C:\Program Files\Windows Media Player\WMPNSCFG.exe
        C:\WINDOWS\system32\wscntfy.exe
        C:\Program Files\iPod\bin\iPodService.exe
        C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
        C:\WINDOWS\system32\imapi.exe
        C:\WINDOWS\explorer.exe
        G:\HiJackThis\HijackThis.exe

        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.lapresse.ca
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
        R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
        R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
        O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
        O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
        O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptcl.dll
        O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
        O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
        O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
        O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
        O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
        O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
        O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
        O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
        O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
        O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
        O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
        O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
        O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
        O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
        O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
        O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
        O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
        O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
        O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
        O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
        O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
        O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
        O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
        O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
        O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
        O11 - Options group: [INTERNATIONAL] International*
        O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} (asusTek_sysctrl Class) - http://support.asus.com/common/asusTek_sys_ctrl.cab
        O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
        O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
        O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
        O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
        O18 - Protocol: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Fichiers communs\Pure Networks Shared\Platform\puresp4.dll
        O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
        O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll
        O20 - AppInit_DLLs: gnxwyo.dll
        O20 - Winlogon Notify: qoMgfCuv - C:\WINDOWS\
        O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
        O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
        O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
        O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
        O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
        O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
        O23 - Service: EPSON V3 Service4(01) (EPSON_PM_RPCV4_01) - SEIKO EPSON CORPORATION - C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE
        O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
        O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing)
        O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
        O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
        O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
        O23 - Service: Linksys Updater (LinksysUpdater) - Unknown owner - C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe" -s "C:\Program Files\Linksys\Linksys Updater\conf\wrapper.conf (file missing)
        O23 - Service: McAfee Framework Service (McAfeeFramework) - Unknown owner - C:\Program Files\McAfee\Common Framework\FrameworkService.exe" /ServiceStart (file missing)
        O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
        O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
        O23 - Service: Pure Networks Platform Service (nmservice) - Pure Networks, Inc. - C:\Program Files\Fichiers communs\Pure Networks Shared\Platform\nmsrvc.exe
        O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
        O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
        O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
        O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

        Merci!
        1. Sloubi76
          Siroderab,

          Télécharge Spybot sur ton bureau,
          http://www.commentcamarche.net/telecharger/telecharger 122 spybot

          Suis les consignes d'installation.
          Ne change pas les composants à installer,
          Dans les tâches supplémentaires décoche :
          - Utiliser le protocole pour Internet Explorer
          - Utiliser la protection des paramêtres système

          - Accepte la sauvegarde du registre,
          - Accepte la vaccination,

          Lance Search and destroy

          et post un nouveau rapport Hitjack

          @ +
        2. siroderab
          @Sloubi76OK pour SpyBot et voilà HijackThis

          Logfile of HijackThis v1.99.1
          Scan saved at 07:18:13, on 2008-09-25
          Platform: Windows XP SP3 (WinNT 5.01.2600)
          MSIE: Internet Explorer v7.00 (7.00.6000.16705)

          Running processes:
          C:\WINDOWS\System32\smss.exe
          C:\WINDOWS\system32\winlogon.exe
          C:\WINDOWS\system32\services.exe
          C:\WINDOWS\system32\lsass.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\System32\svchost.exe
          C:\WINDOWS\System32\WLTRYSVC.EXE
          C:\WINDOWS\System32\bcmwltry.exe
          C:\WINDOWS\system32\spoolsv.exe
          C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
          C:\WINDOWS\ATKKBService.exe
          C:\Program Files\Bonjour\mDNSResponder.exe
          C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
          C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE
          C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
          C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
          C:\WINDOWS\System32\svchost.exe
          C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe
          C:\Program Files\McAfee\Common Framework\FrameworkService.exe
          C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
          C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
          C:\WINDOWS\system32\java.exe
          C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
          C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
          C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
          C:\WINDOWS\System32\nvsvc32.exe
          C:\WINDOWS\System32\svchost.exe
          C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
          C:\Program Files\Fichiers communs\Pure Networks Shared\Platform\nmsrvc.exe
          C:\WINDOWS\Explorer.EXE
          C:\Program Files\Microsoft IntelliPoint\point32.exe
          C:\WINDOWS\system32\WLTRAY.exe
          C:\Program Files\iTunes\iTunesHelper.exe
          C:\Program Files\McAfee\Common Framework\UdaterUI.exe
          C:\WINDOWS\system32\ctfmon.exe
          C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
          C:\Program Files\Windows Media Player\WMPNSCFG.exe
          C:\Program Files\McAfee\Common Framework\McTray.exe
          C:\Program Files\BOINC\boincmgr.exe
          C:\Program Files\BOINC\boinc.exe
          C:\PROGRA~1\Webshots\webshots.scr
          C:\Program Files\iPod\bin\iPodService.exe
          C:\Program Files\BOINC\projects\setiathome.berkeley.edu\setiathome_6.03_windows_intelx86.exe
          C:\Program Files\Internet Explorer\iexplore.exe
          C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
          G:\HiJackThis\HijackThis.exe

          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.lapresse.ca
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
          R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
          R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
          O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
          O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
          O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptcl.dll
          O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
          O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
          O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
          O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
          O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
          O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
          O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
          O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
          O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
          O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
          O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
          O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
          O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
          O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
          O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
          O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
          O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
          O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
          O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
          O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
          O4 - Startup: BOINC Manager.lnk = C:\Program Files\BOINC\boincmgr.exe
          O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
          O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
          O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
          O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
          O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
          O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
          O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
          O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
          O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
          O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
          O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
          O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
          O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
          O11 - Options group: [INTERNATIONAL] International*
          O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} (asusTek_sysctrl Class) - http://support.asus.com/common/asusTek_sys_ctrl.cab
          O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
          O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
          O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
          O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
          O18 - Protocol: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Fichiers communs\Pure Networks Shared\Platform\puresp4.dll
          O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
          O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll
          O20 - AppInit_DLLs: gnxwyo.dll
          O20 - Winlogon Notify: qoMgfCuv - C:\WINDOWS\
          O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
          O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
          O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
          O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
          O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
          O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
          O23 - Service: EPSON V3 Service4(01) (EPSON_PM_RPCV4_01) - SEIKO EPSON CORPORATION - C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE
          O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
          O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing)
          O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
          O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
          O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
          O23 - Service: Linksys Updater (LinksysUpdater) - Unknown owner - C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe" -s "C:\Program Files\Linksys\Linksys Updater\conf\wrapper.conf (file missing)
          O23 - Service: McAfee Framework Service (McAfeeFramework) - Unknown owner - C:\Program Files\McAfee\Common Framework\FrameworkService.exe" /ServiceStart (file missing)
          O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
          O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
          O23 - Service: Pure Networks Platform Service (nmservice) - Pure Networks, Inc. - C:\Program Files\Fichiers communs\Pure Networks Shared\Platform\nmsrvc.exe
          O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
          O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
          O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
          O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
      5. Sloubi76
        Siroderab,

        comment se porte ta machine après cette vague de désinfection?

        Télécharger CCleaner
        https://filehippo.com/download_ccleaner/

        Exécute le fichier chargé,
        Décoche la case installer la barre d'outils Yahoo! Cleaner
        Dans l'onglet nettoyeur (à gauche) décoche Avancé
        Le principe: tu lance l'analyse et tu nettoie.

        Dans registre laisse tout coché.
        Le principe: tu lance l'analyse et tu nettoie.

        @ +
        1. siroderab
          Salut Sloubi76,

          Ça fait tellement du bien d'avoir à nouveau le plein contrôle de mon ordi!

          Tout fonctionne parfaitement. J'utilisais déjà Ccleaner. Actuellement J'ai MacAfee et SpyBot. Est-ce Ok où bien tu me recommandes autre chose?

          En tous cas, mille mercis de ton aide, j'étais à deux doigts de formater...

          Je trouve ça incroyable que des gens comme toi preniez le temps d'aider bénévolement des inconnus, c'est très apprécié, crois-moi.

          Donc merci encore,

          Un gars de Montréal au Québec qui te salut bien bas, :0)

          siroderab
          1. Sloubi76
            Bonsoir Siroderab,

            Concernant SpyBot prends connaissance de ceci : https://www.safer-networking.org/
            Tu peux le remplacer par AVG regarde ceci:
            http://www.commentcamarche.net/telecharger/telecharger 118 avg antivirus free edition
            Version gratuite, à charge pour toi de faire les mises à jour.

            Macafee si tu faits régulièrement les mises à jour.

            Pour ce qui est de l'aide apportée, il n'y a rien de plus normal. J'ai été comme toi confronté à des difficultés et ai bénéficié de l'aide de Helpeurs. En retour je fais profiter de mes quelques connaissances.
            On ne grandit que par ce qu'on donne.

            Pour terminer en beauté met ton post en résolu (la communauté CCM te remercira)

            @ +, peut être un jour à la cabane à sucre ;-)
        2. siroderab
          D'accord Sloubi76 et je vais prendre une bonne bière à ta santé,

          siroderab
          1. Sloubi76
            A la tienne,

            http://www.damienanfroy.net/saveur-biere-livraison/2007/06/19/

            @ +
        3. mermo
          moi aussi j'ai eu cette saloperie mais j'ai eu - de chance que toi résultat chez l'informatitien mais oui un bonne biere pour certain ne fais pas de mal mais moi en ce moment ca fera mal.
          1.  Sloubi76
            Bonsoir Mermo,

            Alors je te propose http://www.chocolat.tv/photos/displayimage-12-3.html

            @ +

        Discussions similaires

        Softonic,est-ce un virus ?
        techmel1

        6 réponses
        Chrome://newtab
        Nova

        14 réponses
        Désinstaller Softonic
        Diguimette

        5 réponses
        Supprimer New Tab
        tysaozon

        8 réponses
        Bouton pause/break
        frans003

        3 réponses