Message VIRUS ALERT

Massylum -  
Bonjour à tous!

Depuis hier un message VIRUS ALERT! s'est incrusté dans la barre de mon horloge, plusieurs messages intenpestifs de spyware viennent s'afficher tout le temps, l'option fermer la session ne fonctionne plus,l'option ctrl+alt+suppr ne fonctionne plus(un message me disant que l'administrateur a desactiver cette option s'affiche), le menu tout les programmes n'est plus prèsent, mon volet d'exploration rapide de fichiers dans les dossiers n'est plus prèsent non plus et ma batterie se vide en moins de 20min...
Malgrès plusieurs scan via AVG rien n'est détecté.

Etant novice en informatique je vous demande votre aide...car je ne vois aucune solution.

En vous remerciant d'avance. Cordialement.
Configuration: Windows XP
Internet Explorer 7.0

14 réponses

  1. charle
    alors la ton ordi est soit foutu, ou soit tu va vite voir des professionels.
    0
    1. sherred
      peux tu faire ceci
      télecharge ici https://www.clubic.com/telecharger-fiche17891-hijackthis.html
      renomme hijackthis.exe en HjT.exe

      Lancez Hjt en double cliquant sur son icône puis cliquez sur le bouton Do a system scan only

      Le rapport est retranscrit aussitôt apres le scan dans une fenêtre de type Bloc-notes
      il vous suffit de realiser un copier/coller et de le poster dans le forum
      0
      1. Massylum Auteur
        PS désolé pour le manque de reactivité mais ce matin je n'étais pas sur mon ordi personnel et là je l'ai pris avec moi au boulot.
        0
        1. Massylum Auteur
          et voilà le rapport sous Smitfraudfix:

          SmitFraudFix v2.359

          Rapport fait à 17:29:55,06, 13/10/2008
          Executé à partir de C:\Documents and Settings\Administrateur.NOM-A3B76CFC09D\Bureau\SmitfraudFix\SmitfraudFix
          OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
          Le type du système de fichiers est NTFS
          Fix executé en mode sans echec

          »»»»»»»»»»»»»»»»»»»»»»»» Process

          C:\WINDOWS\System32\smss.exe
          C:\WINDOWS\system32\winlogon.exe
          C:\WINDOWS\system32\services.exe
          C:\WINDOWS\system32\lsass.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\Explorer.EXE
          C:\WINDOWS\system32\cmd.exe

          »»»»»»»»»»»»»»»»»»»»»»»» hosts

          »»»»»»»»»»»»»»»»»»»»»»»» C:\

          »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

          C:\WINDOWS\privacy_danger PRESENT !

          »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

          »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

          »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

          »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

          »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Administrateur.NOM-A3B76CFC09D

          »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Administrateur.NOM-A3B76CFC09D\Application Data

          »»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

          »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\ADMINI~1.NOM\Favoris

          »»»»»»»»»»»»»»»»»»»»»»»» Bureau

          »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

          »»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

          »»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

          [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
          "Source"="About:Home"
          "SubscribedURL"="About:Home"
          "FriendlyName"="Ma page d'accueil"

          »»»»»»»»»»»»»»»»»»»»»»»» o4Patch
          !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

          o4Patch
          Credits: Malware Analysis & Diagnostic
          Code: S!Ri

          »»»»»»»»»»»»»»»»»»»»»»»» IEDFix
          !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

          IEDFix
          Credits: Malware Analysis & Diagnostic
          Code: S!Ri

          »»»»»»»»»»»»»»»»»»»»»»»» VACFix
          !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

          VACFix
          Credits: Malware Analysis & Diagnostic
          Code: S!Ri

          »»»»»»»»»»»»»»»»»»»»»»»» 404Fix
          !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

          404Fix
          Credits: Malware Analysis & Diagnostic
          Code: S!Ri

          »»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix
          !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

          AntiXPVSTFix
          Credits: Malware Analysis & Diagnostic
          Code: S!Ri

          »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
          !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

          SrchSTS.exe by S!Ri
          Search SharedTaskScheduler's .dll

          »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
          !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
          "AppInit_DLLs"="C:\\PROGRA~1\\Google\\GOOGLE~1\\GOEC62~1.DLL"
          "LoadAppInit_DLLs"=dword:00000001

          »»»»»»»»»»»»»»»»»»»»»»»» Winlogon
          !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
          "Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
          "System"=""

          »»»»»»»»»»»»»»»»»»»»»»»» RK

          »»»»»»»»»»»»»»»»»»»»»»»» DNS

          HKLM\SYSTEM\CCS\Services\Tcpip\..\{0A2E372D-715A-4A4B-8073-EB98D3D72D1C}: NameServer=212.27.54.252,212.27.53.252
          HKLM\SYSTEM\CS1\Services\Tcpip\..\{0A2E372D-715A-4A4B-8073-EB98D3D72D1C}: NameServer=212.27.54.252,212.27.53.252
          HKLM\SYSTEM\CS2\Services\Tcpip\..\{0A2E372D-715A-4A4B-8073-EB98D3D72D1C}: NameServer=212.27.54.252,212.27.53.252
          HKLM\SYSTEM\CS3\Services\Tcpip\..\{0A2E372D-715A-4A4B-8073-EB98D3D72D1C}: NameServer=212.27.54.252,212.27.53.252

          »»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

          »»»»»»»»»»»»»»»»»»»»»»»» Fin
          0
          2. Massylum Auteur
            Logfile of Trend Micro HijackThis v2.0.2
            Scan saved at 15:58: VIRUS ALERT!, on 13/10/2008
            Platform: Windows XP SP2 (WinNT 5.01.2600)
            MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
            Boot mode: Normal

            Running processes:
            C:\WINDOWS\System32\smss.exe
            C:\WINDOWS\system32\winlogon.exe
            C:\WINDOWS\system32\services.exe
            C:\WINDOWS\system32\lsass.exe
            C:\WINDOWS\system32\svchost.exe
            C:\WINDOWS\System32\svchost.exe
            C:\WINDOWS\system32\svchost.exe
            C:\WINDOWS\system32\spoolsv.exe
            C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
            C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
            C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
            C:\WINDOWS\Explorer.EXE
            C:\Program Files\Bonjour\mDNSResponder.exe
            C:\Program Files\Digidesign\Drivers\MMERefresh.exe
            C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE
            C:\Program Files\AVC Finger-sensing Pad Driver\fspadsvr.exe
            C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
            C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
            C:\WINDOWS\system32\nvsvc32.exe
            C:\WINDOWS\system32\svchost.exe
            C:\WINDOWS\system32\atwtusb.exe
            C:\WINDOWS\system32\wscntfy.exe
            C:\WINDOWS\system32\WTMKM.exe
            C:\Program Files\Adobe\Adobe Photoshop Lightroom 1.1\apdproxy.exe
            C:\Program Files\Winamp\winampa.exe
            C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
            C:\Program Files\QuickTime\QTTask.exe
            C:\Program Files\iTunes\iTunesHelper.exe
            C:\WINDOWS\system32\ctfmon.exe
            C:\Program Files\iPod\bin\iPodService.exe
            C:\Program Files\Google\Google Updater\GoogleUpdater.exe
            C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

            R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2
            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
            R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
            R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/fuji/defaults/su/*https://fr.yahoo.com/?p=us
            R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
            O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
            O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
            O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
            O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
            O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
            O3 - Toolbar: Starware Screensavers Toolbar - {1962c5bc-e475-465b-823b-133e711bceb9} - C:\Program Files\Starware316\bin\Starware316.dll
            O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
            O3 - Toolbar: olnmraew - {B57C06B1-B493-4579-840D-0ED09B8BDDF6} - C:\WINDOWS\olnmraew.dll
            O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
            O4 - HKLM\..\Run: [MacrokeyManager] WTMKM.exe
            O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Adobe Photoshop Lightroom 1.1\apdproxy.exe"
            O4 - HKLM\..\Run: [DigidesignMMERefresh] C:\Program Files\Digidesign\Drivers\MMERefresh.exe
            O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
            O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
            O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
            O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
            O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
            O4 - HKLM\..\Run: [\YUR38.exe] C:\Windows\system32\YUR38.exe
            O4 - HKLM\..\Run: [\YUR39.exe] C:\Windows\system32\YUR39.exe
            O4 - HKLM\..\Run: [\YUR3A.exe] C:\Windows\system32\YUR3A.exe
            O4 - HKLM\..\Run: [\YUR3B.exe] C:\Windows\system32\YUR3B.exe
            O4 - HKLM\..\Run: [\YUR45.exe] C:\Windows\system32\YUR45.exe
            O4 - HKLM\..\Run: [\YUR1.exe] C:\Windows\system32\YUR1.exe
            O4 - HKLM\..\Run: [\YUR2.exe] C:\Windows\system32\YUR2.exe
            O4 - HKLM\..\Run: [\YUR3.exe] C:\Windows\system32\YUR3.exe
            O4 - HKLM\..\Run: [\YUR4.exe] C:\Windows\system32\YUR4.exe
            O4 - HKLM\..\Run: [\YURB.exe] C:\Windows\system32\YURB.exe
            O4 - HKLM\..\Run: [\YUR13.exe] C:\Windows\system32\YUR13.exe
            O4 - HKLM\..\Run: [\YUR23.exe] C:\Windows\system32\YUR23.exe
            O4 - HKLM\..\Run: [\YUR9.exe] C:\Windows\system32\YUR9.exe
            O4 - HKLM\..\Run: [\YUR7.exe] C:\Windows\system32\YUR7.exe
            O4 - HKLM\..\Run: [\YUR5.exe] C:\Windows\system32\YUR5.exe
            O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
            O4 - HKLM\..\Policies\Explorer\Run: [isamini.exe] C:\Program Files\Key Generator\isamonitor.exe
            O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
            O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'SERVICE LOCAL')
            O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
            O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
            O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
            O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
            O4 - Global Startup: Logo Calibration Loader.lnk = C:\Program Files\GretagMacbeth\i1\Eye-One Match 3\CalibrationLoader\CalibrationLoader.exe
            O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
            O4 - Global Startup: ProfileReminder.lnk = C:\Program Files\GretagMacbeth\i1\Eye-One Match 3\ProfileReminder.exe
            O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
            O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
            O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
            O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\npjpi160_03.dll
            O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\npjpi160_03.dll
            O9 - Extra button: Traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT98\promtie4\promtie5.htm
            O9 - Extra 'Tools' menuitem: Traduire - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT98\promtie4\promtie5.htm
            O9 - Extra button: (no name) - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT98\promtie4\options.htm
            O9 - Extra 'Tools' menuitem: Personnalisez traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT98\promtie4\options.htm
            O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
            O9 - Extra button: Organise-notes - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Researcher\EROPROJ.DLL
            O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll/206 (file missing)
            O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Dr Gonzo\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk (file missing)
            O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe (file missing)
            O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe (file missing)
            O9 - Extra button: @c:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\Program Files\Messenger\msmsgs.exe
            O9 - Extra 'Tools' menuitem: @c:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\Program Files\Messenger\msmsgs.exe
            O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
            O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
            O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su2/CTL_V02002/ocx/15031/CTPID.cab
            O17 - HKLM\System\CCS\Services\Tcpip\..\{0A2E372D-715A-4A4B-8073-EB98D3D72D1C}: NameServer = 212.27.54.252,212.27.53.252
            O17 - HKLM\System\CS1\Services\Tcpip\..\{0A2E372D-715A-4A4B-8073-EB98D3D72D1C}: NameServer = 212.27.54.252,212.27.53.252
            O17 - HKLM\System\CS2\Services\Tcpip\..\{0A2E372D-715A-4A4B-8073-EB98D3D72D1C}: NameServer = 212.27.54.252,212.27.53.252
            O17 - HKLM\System\CS3\Services\Tcpip\..\{0A2E372D-715A-4A4B-8073-EB98D3D72D1C}: NameServer = 212.27.54.252,212.27.53.252
            O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
            O21 - SSODL: carbinyl - {8d8c2387-7f80-4022-9be6-43630a969558} - (no file)
            O21 - SSODL: qmafxprs - {771DF2A2-C41E-4BC2-A564-B3FCE37C1D7C} - C:\WINDOWS\qmafxprs.dll
            O21 - SSODL: lfstbwvd - {F9FFEA24-F551-4BFA-859C-1A4E2098B621} - C:\WINDOWS\lfstbwvd.dll
            O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
            O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
            O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
            O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
            O23 - Service: Avid SDM Service (AvidSDMService) - Unknown owner - C:\WINDOWS\system32\AvidSDMService.exe (file missing)
            O23 - Service: Avid Startup (AvidStartup) - Unknown owner - C:\WINDOWS\system32\AvidStartup.exe
            O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
            O23 - Service: Digidesign MME Refresh Service (DigiRefresh) - Digidesign, A Division of Avid Technology, Inc. - C:\Program Files\Digidesign\Drivers\MMERefresh.exe
            O23 - Service: EPSON V3 Service4(01) (EPSON_PM_RPCV4_01) - SEIKO EPSON CORPORATION - C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE
            O23 - Service: FspadSvc - Unknown owner - C:\Program Files\AVC Finger-sensing Pad Driver\fspadsvr.exe
            O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
            O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
            O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
            O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
            O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
            O23 - Service: WTService - Unknown owner - C:\WINDOWS\system32\atwtusb.exe
            -1
            1. Massylum Auteur
              et voilà le rapport Smitfraudfix après l'étape 2:

              SmitFraudFix v2.359

              Rapport fait à 17:36:15,03, 13/10/2008
              Executé à partir de C:\Documents and Settings\Administrateur.NOM-A3B76CFC09D\Bureau\SmitfraudFix\SmitfraudFix
              OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
              Le type du système de fichiers est NTFS
              Fix executé en mode sans echec

              »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
              !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

              SrchSTS.exe by S!Ri
              Search SharedTaskScheduler's .dll

              »»»»»»»»»»»»»»»»»»»»»»»» Arret des processus

              »»»»»»»»»»»»»»»»»»»»»»»» hosts

              127.0.0.1 localhost
              127.0.0.1 bin.errorprotector.com ## added by CiD
              127.0.0.1 br.errorsafe.com ## added by CiD
              127.0.0.1 br.winantivirus.com ## added by CiD
              127.0.0.1 br.winfixer.com ## added by CiD
              127.0.0.1 cdn.drivecleaner.com ## added by CiD
              127.0.0.1 cdn.errorsafe.com ## added by CiD
              127.0.0.1 cdn.winsoftware.com ## added by CiD
              127.0.0.1 de.errorsafe.com ## added by CiD
              127.0.0.1 de.winantivirus.com ## added by CiD
              127.0.0.1 download.cdn.drivecleaner.com ## added by CiD
              127.0.0.1 download.cdn.errorsafe.com ## added by CiD
              127.0.0.1 download.cdn.winsoftware.com ## added by CiD
              127.0.0.1 download.errorsafe.com ## added by CiD
              127.0.0.1 download.systemdoctor.com ## added by CiD
              127.0.0.1 download.winantispyware.com ## added by CiD
              127.0.0.1 download.windrivecleaner.com ## added by CiD
              127.0.0.1 download.winfixer.com ## added by CiD
              127.0.0.1 drivecleaner.com ## added by CiD
              127.0.0.1 dynamique.drivecleaner.com ## added by CiD
              127.0.0.1 errorprotector.com ## added by CiD
              127.0.0.1 errorsafe.com ## added by CiD
              127.0.0.1 es.winantivirus.com ## added by CiD
              127.0.0.1 fr.winantivirus.com ## added by CiD
              127.0.0.1 fr.winfixer.com ## added by CiD
              127.0.0.1 go.drivecleaner.com ## added by CiD
              127.0.0.1 go.errorsafe.com ## added by CiD
              127.0.0.1 go.winantispyware.com ## added by CiD
              127.0.0.1 go.winantivirus.com ## added by CiD
              127.0.0.1 hk.winantivirus.com ## added by CiD
              127.0.0.1 instlog.errorsafe.com ## added by CiD
              127.0.0.1 instlog.winantivirus.com ## added by CiD
              127.0.0.1 instlog.winfixer.com ## added by CiD
              127.0.0.1 jsp.drivecleaner.com ## added by CiD
              127.0.0.1 kb.errorsafe.com ## added by CiD
              127.0.0.1 kb.winantivirus.com ## added by CiD
              127.0.0.1 nl.errorsafe.com ## added by CiD
              127.0.0.1 se.errorsafe.com ## added by CiD
              127.0.0.1 secure.drivecleaner.com ## added by CiD
              127.0.0.1 secure.errorsafe.com ## added by CiD
              127.0.0.1 secure.winantispam.com ## added by CiD
              127.0.0.1 secure.winantispy.com ## added by CiD
              127.0.0.1 secure.winantivirus.com ## added by CiD
              127.0.0.1 support.winantivirus.com ## added by CiD
              127.0.0.1 trial.updates.winsoftware.com ## added by CiD
              127.0.0.1 ulog.winantivirus.com ## added by CiD
              127.0.0.1 utils.errorsafe.com ## added by CiD
              127.0.0.1 utils.winantivirus.com ## added by CiD
              127.0.0.1 utils.winfixer.com ## added by CiD
              127.0.0.1 winantispyware.com ## added by CiD
              127.0.0.1 winantivirus.com ## added by CiD
              127.0.0.1 winfixer.com ## added by CiD
              127.0.0.1 winfixer2006.com ## added by CiD
              127.0.0.1 winsoftware.com ## added by CiD
              127.0.0.1 www.drivecleaner.com ## added by CiD
              127.0.0.1 www.errorprotector.com ## added by CiD
              127.0.0.1 www.errorsafe.com ## added by CiD
              127.0.0.1 www.systemdoctor.com ## added by CiD
              127.0.0.1 www.utils.winfixer.com ## added by CiD
              127.0.0.1 www.win-anti-virus-pro.com ## added by CiD
              127.0.0.1 www.win-virus-pro.com ## added by CiD
              127.0.0.1 www.winantispam.com ## added by CiD
              127.0.0.1 www.winantispy.com ## added by CiD
              127.0.0.1 www.winantispyware.com ## added by CiD
              127.0.0.1 www.winantivirus.com ## added by CiD
              127.0.0.1 www.winantiviruspro.com ## added by CiD
              127.0.0.1 www.windrivecleaner.com ## added by CiD
              127.0.0.1 www.windrivesafe.com ## added by CiD
              127.0.0.1 www.winfixer.com ## added by CiD
              127.0.0.1 www.winfixer2006.com ## added by CiD
              127.0.0.1 www.winsoftware.com ## added by CiD

              »»»»»»»»»»»»»»»»»»»»»»»» VACFix

              VACFix
              Credits: Malware Analysis & Diagnostic
              Code: S!Ri

              »»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

              S!Ri's WS2Fix: LSP not Found.

              »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

              GenericRenosFix by S!Ri

              »»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés

              Problème suppression C:\WINDOWS\privacy_danger

              »»»»»»»»»»»»»»»»»»»»»»»» IEDFix

              IEDFix
              Credits: Malware Analysis & Diagnostic
              Code: S!Ri

              »»»»»»»»»»»»»»»»»»»»»»»» 404Fix

              404Fix
              Credits: Malware Analysis & Diagnostic
              Code: S!Ri

              »»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix

              AntiXPVSTFix
              Credits: Malware Analysis & Diagnostic
              Code: S!Ri

              »»»»»»»»»»»»»»»»»»»»»»»» RK

              »»»»»»»»»»»»»»»»»»»»»»»» DNS

              HKLM\SYSTEM\CCS\Services\Tcpip\..\{0A2E372D-715A-4A4B-8073-EB98D3D72D1C}: NameServer=212.27.54.252,212.27.53.252
              HKLM\SYSTEM\CS1\Services\Tcpip\..\{0A2E372D-715A-4A4B-8073-EB98D3D72D1C}: NameServer=212.27.54.252,212.27.53.252
              HKLM\SYSTEM\CS2\Services\Tcpip\..\{0A2E372D-715A-4A4B-8073-EB98D3D72D1C}: NameServer=212.27.54.252,212.27.53.252
              HKLM\SYSTEM\CS3\Services\Tcpip\..\{0A2E372D-715A-4A4B-8073-EB98D3D72D1C}: NameServer=212.27.54.252,212.27.53.252

              »»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires

              »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
              !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

              [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
              "System"=""

              »»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre

              Nettoyage terminé.

              »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Après SmitFraudFix
              !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

              SrchSTS.exe by S!Ri
              Search SharedTaskScheduler's .dll

              »»»»»»»»»»»»»»»»»»»»»»»» Fin
              -1
              2. Massylum Auteur
                bonjour bonjour,
                je viens d'effectuer les opérations conseiller via MalwareBytes' Anti-Malware Il y avait 46 menaces...
                voici le rapport:

                Malwarebytes' Anti-Malware 1.28
                Version de la base de données: 1134
                Windows 5.1.2600 Service Pack 2

                14/10/2008 11:47:59
                mbam-log-2008-10-14 (11-47-59).txt

                Type de recherche: Examen complet (C:\|)
                Eléments examinés: 214760
                Temps écoulé: 58 minute(s), 58 second(s)

                Processus mémoire infecté(s): 0
                Module(s) mémoire infecté(s): 1
                Clé(s) du Registre infectée(s): 40
                Valeur(s) du Registre infectée(s): 14
                Elément(s) de données du Registre infecté(s): 3
                Dossier(s) infecté(s): 14
                Fichier(s) infecté(s): 72

                Processus mémoire infecté(s):
                (Aucun élément nuisible détecté)

                Module(s) mémoire infecté(s):
                C:\WINDOWS\system32\cbXPIAsQ.dll (Trojan.Vundo.H) -> Delete on reboot.

                Clé(s) du Registre infectée(s):
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6d07a4c5-885d-403e-9f43-86ffb2179d14} (Trojan.Vundo.H) -> Delete on reboot.
                HKEY_CLASSES_ROOT\CLSID\{6d07a4c5-885d-403e-9f43-86ffb2179d14} (Trojan.Vundo.H) -> Delete on reboot.
                HKEY_CLASSES_ROOT\hottvplayer.htplayer (Adware.EGDAccess) -> Quarantined and deleted successfully.
                HKEY_CLASSES_ROOT\hottvplayer.htplayer.1 (Adware.EGDAccess) -> Quarantined and deleted successfully.
                HKEY_CLASSES_ROOT\qaccess.tchongabho (Trojan.BHO) -> Quarantined and deleted successfully.
                HKEY_CLASSES_ROOT\CLSID\{a34fa88d-8437-4634-8a60-e913011ef2e5} (Trojan.BHO) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a34fa88d-8437-4634-8a60-e913011ef2e5} (Trojan.BHO) -> Quarantined and deleted successfully.
                HKEY_CLASSES_ROOT\sssinstaller.installer (Adware.Comet) -> Quarantined and deleted successfully.
                HKEY_CLASSES_ROOT\sssinstaller.installer.1 (Adware.Comet) -> Quarantined and deleted successfully.
                HKEY_CLASSES_ROOT\sssinstaller.sinstaller (Adware.Comet) -> Quarantined and deleted successfully.
                HKEY_CLASSES_ROOT\sssinstaller.sinstaller.1 (Adware.Comet) -> Quarantined and deleted successfully.
                HKEY_CLASSES_ROOT\Interface\{0fbc3efb-fc98-4b32-bf10-bde9aa4dea5a} (Adware.Comet) -> Quarantined and deleted successfully.
                HKEY_CLASSES_ROOT\Interface\{1f323594-30e9-4e1e-8262-ca7b4d0a65a1} (Adware.EGDAccess) -> Quarantined and deleted successfully.
                HKEY_CLASSES_ROOT\Interface\{6a4b7d17-1de9-4c14-8adf-eb4c07060519} (Adware.Comet) -> Quarantined and deleted successfully.
                HKEY_CLASSES_ROOT\Interface\{abf441b2-9b57-4838-96a0-34b1cecd4aa5} (Adware.Comet) -> Quarantined and deleted successfully.
                HKEY_CLASSES_ROOT\Interface\{c2ccbfaf-1474-4e53-8130-0cc12b31856b} (Adware.EGDAccess) -> Quarantined and deleted successfully.
                HKEY_CLASSES_ROOT\CLSID\{1962c5bc-e475-465b-823b-133e711bceb9} (Adware.Starware) -> Quarantined and deleted successfully.
                HKEY_CLASSES_ROOT\CLSID\{5f90c0e3-4c0a-4d54-a8ac-5afe6163a99e} (Adware.Starware) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5f90c0e3-4c0a-4d54-a8ac-5afe6163a99e} (Adware.Starware) -> Quarantined and deleted successfully.
                HKEY_CLASSES_ROOT\CLSID\{ab3dfa03-f743-4302-81dd-c370bffeca23} (Adware.Starware) -> Quarantined and deleted successfully.
                HKEY_CLASSES_ROOT\CLSID\{e550dc77-ef3b-474f-b59c-b3e2aa1fa6a5} (Adware.Starware) -> Quarantined and deleted successfully.
                HKEY_CLASSES_ROOT\CLSID\{a84e835e-1b9c-4fc0-980f-4b2da3c6a2a7} (Adware.Comet) -> Quarantined and deleted successfully.
                HKEY_CLASSES_ROOT\CLSID\{bf0a1ff4-bbaf-487f-bc85-a24ef8f443a8} (Adware.Comet) -> Quarantined and deleted successfully.
                HKEY_CLASSES_ROOT\CLSID\{fd31bf07-70e3-4b98-8f70-0970af614275} (Adware.EGDAccess) -> Quarantined and deleted successfully.
                HKEY_CLASSES_ROOT\Typelib\{74278296-0ec7-4f7a-ad55-eb7a2f35f311} (Adware.Comet) -> Quarantined and deleted successfully.
                HKEY_CLASSES_ROOT\Typelib\{95012afd-f4f1-4a96-bf3b-4f5d6c54d593} (Adware.EGDAccess) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{a84e835e-1b9c-4fc0-980f-4b2da3c6a2a7} (Adware.Comet) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{bf0a1ff4-bbaf-487f-bc85-a24ef8f443a8} (Adware.Comet) -> Quarantined and deleted successfully.
                HKEY_CLASSES_ROOT\CLSID\{71f9cd9f-afaa-47d0-9d30-e7b64c8e8ccb} (Trojan.Zlob) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\starware316 (Adware.Starware) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\internetgamebox (Adware.EGDAccess) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\PCPrivacyCleaner (Rogue.PCPrivacyCleaner) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VSPlugin (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\Screensavers.com (Adware.Comet) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SSSInstaller (Adware.Comet) -> Quarantined and deleted successfully.

                Valeur(s) du Registre infectée(s):
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0c6a16f2 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{1962c5bc-e475-465b-823b-133e711bceb9} (Adware.Starware) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\qrbgltos (Trojan.Zlob) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur38.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur39.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur3a.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur3b.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur45.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur1.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yurb.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur13.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur23.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur9.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lphcp6bj0el77 (Trojan.FakeAlert) -> Quarantined and deleted successfully.

                Elément(s) de données du Registre infecté(s):
                HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\cbxpiasq -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\cbxpiasq -> Delete on reboot.
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductId (Trojan.FakeAlert) -> Bad: (VIRUS ALERT!) Good: (76412-OEM-0011903-00117) -> Quarantined and deleted successfully.

                Dossier(s) infecté(s):
                C:\WINDOWS\privacy_danger (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                C:\WINDOWS\privacy_danger\images (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                C:\Program Files\Starware316 (Adware.Starware) -> Quarantined and deleted successfully.
                C:\Program Files\Starware316\bin (Adware.Starware) -> Quarantined and deleted successfully.
                C:\Program Files\Starware316\icons (Adware.Starware) -> Quarantined and deleted successfully.
                C:\Program Files\InternetGameBox (Adware.EGDAccess) -> Quarantined and deleted successfully.
                C:\Program Files\InternetGameBox\ressources (Adware.EGDAccess) -> Quarantined and deleted successfully.
                C:\Program Files\InternetGameBox\ressources\favoris (Adware.EGDAccess) -> Quarantined and deleted successfully.
                C:\Program Files\InternetGameBox\skins (Adware.EGDAccess) -> Quarantined and deleted successfully.
                C:\Documents and Settings\All Users\Application Data\Starware316 (Adware.Starware) -> Quarantined and deleted successfully.
                C:\Documents and Settings\All Users\Application Data\Starware316\buttons (Adware.Starware) -> Quarantined and deleted successfully.
                C:\Documents and Settings\All Users\Application Data\Starware316\contexts (Adware.Starware) -> Quarantined and deleted successfully.
                C:\Documents and Settings\All Users\Application Data\Starware316\images (Adware.Starware) -> Quarantined and deleted successfully.
                C:\Documents and Settings\All Users\Application Data\Starware316\SimpleUpdate (Adware.Starware) -> Quarantined and deleted successfully.

                Fichier(s) infecté(s):
                C:\WINDOWS\system32\cbXPIAsQ.dll (Trojan.Vundo.H) -> Delete on reboot.
                C:\WINDOWS\system32\QsAIPXbc.ini (Trojan.Vundo.H) -> Delete on reboot.
                C:\WINDOWS\system32\QsAIPXbc.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
                C:\WINDOWS\system32\gwqgdrhp.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
                C:\WINDOWS\system32\phrdgqwg.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
                C:\Documents and Settings\Dr Gonzo\Application Data\sp2\qaccess.dll (Trojan.BHO) -> Quarantined and deleted successfully.
                C:\Program Files\Starware316\bin\Starware316.dll (Adware.Starware) -> Quarantined and deleted successfully.
                C:\Program Files\Rapid Antivirus\Uninstall.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
                C:\WINDOWS\eemk.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                C:\WINDOWS\emsf.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                C:\WINDOWS\qrbgltos.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
                C:\WINDOWS\privacy_danger\index.htm (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                C:\WINDOWS\privacy_danger\images\body.gif (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                C:\WINDOWS\privacy_danger\images\capt.gif (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                C:\WINDOWS\privacy_danger\images\capt2.gif (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                C:\WINDOWS\privacy_danger\images\red.gif (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                C:\WINDOWS\privacy_danger\images\text.gif (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                C:\Program Files\Starware316\Starware316Config.xml (Adware.Starware) -> Quarantined and deleted successfully.
                C:\Program Files\Starware316\Starware316Uninstall.exe (Adware.Starware) -> Quarantined and deleted successfully.
                C:\Program Files\Starware316\icons\star_16.ico (Adware.Starware) -> Quarantined and deleted successfully.
                C:\Program Files\InternetGameBox\Conditions générales.url (Adware.EGDAccess) -> Quarantined and deleted successfully.
                C:\Program Files\InternetGameBox\Confidentialité.url (Adware.EGDAccess) -> Quarantined and deleted successfully.
                C:\Program Files\InternetGameBox\language (Adware.EGDAccess) -> Quarantined and deleted successfully.
                C:\Program Files\InternetGameBox\uninst.exe (Adware.EGDAccess) -> Quarantined and deleted successfully.
                C:\Program Files\InternetGameBox\Website.url (Adware.EGDAccess) -> Quarantined and deleted successfully.
                C:\Program Files\InternetGameBox\ressources\AttenteOff.html (Adware.EGDAccess) -> Quarantined and deleted successfully.
                C:\Program Files\InternetGameBox\ressources\AttenteOn.html (Adware.EGDAccess) -> Quarantined and deleted successfully.
                C:\Program Files\InternetGameBox\ressources\configv2_en.xml (Adware.EGDAccess) -> Quarantined and deleted successfully.
                C:\Program Files\InternetGameBox\ressources\configv2_es.xml (Adware.EGDAccess) -> Quarantined and deleted successfully.
                C:\Program Files\InternetGameBox\ressources\configv2_fr.xml (Adware.EGDAccess) -> Quarantined and deleted successfully.
                C:\Program Files\InternetGameBox\skins\skinv2.skn (Adware.EGDAccess) -> Quarantined and deleted successfully.
                C:\Documents and Settings\All Users\Application Data\Starware316\Tem10B.tmp (Adware.Starware) -> Quarantined and deleted successfully.
                C:\Documents and Settings\All Users\Application Data\Starware316\Tem1EF.tmp (Adware.Starware) -> Quarantined and deleted successfully.
                C:\Documents and Settings\All Users\Application Data\Starware316\Tem39A.tmp (Adware.Starware) -> Quarantined and deleted successfully.
                C:\Documents and Settings\All Users\Application Data\Starware316\buttons\775_button_1b_def.bmp (Adware.Starware) -> Quarantined and deleted successfully.
                C:\Documents and Settings\All Users\Application Data\Starware316\buttons\FindIt.bmp (Adware.Starware) -> Quarantined and deleted successfully.
                C:\Documents and Settings\All Users\Application Data\Starware316\buttons\FindItHot.bmp (Adware.Starware) -> Quarantined and deleted successfully.
                C:\Documents and Settings\All Users\Application Data\Starware316\buttons\findithotxp.png (Adware.Starware) -> Quarantined and deleted successfully.
                C:\Documents and Settings\All Users\Application Data\Starware316\buttons\finditxp.png (Adware.Starware) -> Quarantined and deleted successfully.
                C:\Documents and Settings\All Users\Application Data\Starware316\buttons\Free_Credit_Score0.bmp (Adware.Starware) -> Quarantined and deleted successfully.
                C:\Documents and Settings\All Users\Application Data\Starware316\buttons\Free_Music0.bmp (Adware.Starware) -> Quarantined and deleted successfully.
                C:\Documents and Settings\All Users\Application Data\Starware316\buttons\logo.bmp (Adware.Starware) -> Quarantined and deleted successfully.
                C:\Documents and Settings\All Users\Application Data\Starware316\buttons\logoxp.bmp (Adware.Starware) -> Quarantined and deleted successfully.
                C:\Documents and Settings\All Users\Application Data\Starware316\buttons\Reference.bmp (Adware.Starware) -> Quarantined and deleted successfully.
                C:\Documents and Settings\All Users\Application Data\Starware316\buttons\ReferenceHot.bmp (Adware.Starware) -> Quarantined and deleted successfully.
                C:\Documents and Settings\All Users\Application Data\Starware316\buttons\referencehotxp.png (Adware.Starware) -> Quarantined and deleted successfully.
                C:\Documents and Settings\All Users\Application Data\Starware316\buttons\referencexp.png (Adware.Starware) -> Quarantined and deleted successfully.
                C:\Documents and Settings\All Users\Application Data\Starware316\buttons\Ringtones0.bmp (Adware.Starware) -> Quarantined and deleted successfully.
                C:\Documents and Settings\All Users\Application Data\Starware316\buttons\Screensavers0.bmp (Adware.Starware) -> Quarantined and deleted successfully.
                C:\Documents and Settings\All Users\Application Data\Starware316\buttons\Weather.bmp (Adware.Starware) -> Quarantined and deleted successfully.
                C:\Documents and Settings\All Users\Application Data\Starware316\buttons\WeatherHot.bmp (Adware.Starware) -> Quarantined and deleted successfully.
                C:\Documents and Settings\All Users\Application Data\Starware316\buttons\weatherhotxp.png (Adware.Starware) -> Quarantined and deleted successfully.
                C:\Documents and Settings\All Users\Application Data\Starware316\buttons\weatherxp.png (Adware.Starware) -> Quarantined and deleted successfully.
                C:\Documents and Settings\All Users\Application Data\Starware316\contexts\error.xml (Adware.Starware) -> Quarantined and deleted successfully.
                C:\Documents and Settings\All Users\Application Data\Starware316\contexts\Related.xml (Adware.Starware) -> Quarantined and deleted successfully.
                C:\Documents and Settings\All Users\Application Data\Starware316\contexts\Travel.xml (Adware.Starware) -> Quarantined and deleted successfully.
                C:\Documents and Settings\All Users\Application Data\Starware316\images\walertXP.bmp (Adware.Starware) -> Quarantined and deleted successfully.
                C:\Documents and Settings\All Users\Application Data\Starware316\SimpleUpdate\ProductMessagingConfig.xml (Adware.Starware) -> Quarantined and deleted successfully.
                C:\Documents and Settings\All Users\Application Data\Starware316\SimpleUpdate\ProductMessagingConfig.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
                C:\Documents and Settings\All Users\Application Data\Starware316\SimpleUpdate\SimpleUpdateConfig.xml (Adware.Starware) -> Quarantined and deleted successfully.
                C:\Documents and Settings\All Users\Application Data\Starware316\SimpleUpdate\SimpleUpdateConfig.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
                C:\Documents and Settings\All Users\Application Data\Starware316\SimpleUpdate\TimerManagerConfig.xml (Adware.Starware) -> Quarantined and deleted successfully.
                C:\Documents and Settings\All Users\Application Data\Starware316\SimpleUpdate\TimerManagerConfig.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
                C:\WINDOWS\system32\blphcp6bj0el77.scr (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                C:\WINDOWS\system32\lphcp6bj0el77.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                C:\WINDOWS\system32\phcp6bj0el77.bmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                C:\x (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                C:\WINDOWS\Images of Chaos.scr (Backdoor.Bot) -> Quarantined and deleted successfully.
                C:\WINDOWS\system32\rvnefg_navps.dat (Adware.NaviPromo) -> Quarantined and deleted successfully.
                C:\WINDOWS\system32\suqsw_navps.dat (Adware.NaviPromo) -> Quarantined and deleted successfully.
                C:\WINDOWS\system32\rvnefg_nav.dat (Adware.NaviPromo) -> Quarantined and deleted successfully.
                C:\WINDOWS\system32\suqsw_nav.dat (Adware.NaviPromo) -> Quarantined and deleted successfully.
                -1
                1. sherred
                  he bien t'as la total, va faloir arreter de charger n'importe quoi
                  bon on continue

                  Télécharge Navilog1.exe http://il.mafioso.pagesperso-orange.fr/Navifix/Navilog1.exe?thread
                  Choisis Enregistrer sous.... et enregistre-le sur ton bureau.
                  Ensuite double clique sur navilog1.exe pour lancer l'installation.
                  Si, lors du téléchargement, ton Antivirus fais une alerte, ignore-là
                  c'est un faux positif, une fausse alerte..
                  Une fois l'installation terminée, le fix s'exécutera automatiquement.
                  Si ce n'est pas le cas, double-clique sur le raccourci Navilog1 présent sur le bureau
                  Au menu principal, choisis 1 et valide.
                  ne fais pas le choix 2,3 ou 4
                  Analyse Terminée
                  Appuie sur une touche , le bloc-note va s'ouvrir.
                  analyse le fichier ou Copie/colle l'intégralité du rapport
                  -1
                  1. Massylum Auteur
                    oui je vais etre beaucoup plus prudent à l'avenir...Dsl pour la lenteur mais l'ordi a planté deux fois pendant les scans.
                    voivi le scan de navilog1:

                    Search Navipromo version 3.6.6 commencé le 14/10/2008 à 14:56:18,89

                    !!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
                    !!! Postez ce rapport sur le forum pour le faire analyser !!!
                    !!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

                    Outil exécuté depuis C:\Program Files\navilog1
                    Session actuelle : "Administrateur"

                    Mise à jour le 29.09.2008 à 17h30 par IL-MAFIOSO

                    Microsoft Windows XP [version 5.1.2600]
                    Internet Explorer : 6.0.2900.2180
                    Système de fichiers : NTFS

                    Recherche executé en mode sans échec

                    *** Recherche Programmes installés ***

                    *** Recherche dossiers dans "C:\WINDOWS" ***

                    *** Recherche dossiers dans "C:\Program Files" ***

                    *** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" ***

                    *** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1" ***

                    *** Recherche dossiers dans "c:\docume~1\alluse~1\applic~1" ***

                    *** Recherche dossiers dans "C:\Documents and Settings\Administrateur.NOM-A3B76CFC09D\applic~1" ***

                    *** Recherche dossiers dans "C:\DOCUME~1\Julien\applic~1" ***

                    *** Recherche dossiers dans "C:\Documents and Settings\Administrateur.NOM-A3B76CFC09D\locals~1\applic~1" ***

                    *** Recherche dossiers dans "C:\DOCUME~1\Julien\locals~1\applic~1" ***

                    *** Recherche dossiers dans "C:\Documents and Settings\Administrateur.NOM-A3B76CFC09D\menudm~1\progra~1" ***

                    *** Recherche dossiers dans "C:\DOCUME~1\Julien\menudm~1\progra~1" ***

                    *** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
                    pour + d'infos : http://www.gmer.net

                    *** Recherche avec GenericNaviSearch ***
                    !!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
                    !!! A vérifier impérativement avant toute suppression manuelle !!!

                    * Recherche dans "C:\WINDOWS\system32" *

                    * Recherche dans "C:\Documents and Settings\Administrateur.NOM-A3B76CFC09D\locals~1\applic~1" *

                    * Recherche dans "C:\DOCUME~1\Julien\locals~1\applic~1" *

                    *** Recherche fichiers ***

                    C:\WINDOWS\pack.epk trouvé !

                    *** Recherche clés spécifiques dans le Registre ***

                    *** Module de Recherche complémentaire ***
                    (Recherche fichiers spécifiques)

                    1)Recherche nouveaux fichiers Instant Access :

                    2)Recherche Heuristique :

                    * Dans "C:\WINDOWS\system32" :

                    jhffcdspt_navfx.dat trouvé !
                    rvnefg.dat trouvé !
                    suqsw.dat trouvé !
                    suqsw.exe trouvé !
                    suqsw_navps.dat trouvé !
                    wkgqwoo_navfx.dat trouvé !

                    * Dans "C:\Documents and Settings\Administrateur.NOM-A3B76CFC09D\locals~1\applic~1" :

                    * Dans "C:\DOCUME~1\Julien\locals~1\applic~1" :

                    3)Recherche Certificats :

                    Certificat Egroup absent !
                    Certificat Electronic-Group absent !
                    Certificat Montorgueil absent !
                    Certificat OOO-Favorit absent !
                    Certificat Sunny-Day-Design-Ltd absent !

                    4)Recherche fichiers connus :

                    *** Analyse terminée le 14/10/2008 à 15:19:56,32 ***

                    Je vous remercie pour l'attention que vous porter à mon problème.
                    -1
                    1. sherred
                      decidement ya du monde

                      tu relance navilog1 option 2

                      -1
                  2. Massylum Auteur
                    voilà le rapport après avoir lancer l'option2:

                    Clean Navipromo version 3.6.6 commencé le 14/10/2008 à 17:54:03,26

                    Outil exécuté depuis C:\Program Files\navilog1
                    Session actuelle : "Administrateur"

                    Mise à jour le 29.09.2008 à 17h30 par IL-MAFIOSO

                    Microsoft Windows XP [version 5.1.2600]
                    Internet Explorer : 6.0.2900.2180
                    Système de fichiers : NTFS

                    Mode suppression automatique
                    avec prise en charge résultats Catchme et GNS

                    Nettoyage executé en mode sans échec

                    *** fsbl1.txt non trouvé ***
                    (Assurez-vous que Catchme n'avait rien trouvé lors de la recherche)

                    *** Suppression avec sauvegardes résultats GenericNaviSearch ***

                    * Suppression dans "C:\WINDOWS\System32" *

                    * Suppression dans "C:\Documents and Settings\Administrateur.NOM-A3B76CFC09D\locals~1\applic~1" *

                    *** Suppression dossiers dans "C:\WINDOWS" ***

                    *** Suppression dossiers dans "C:\Program Files" ***

                    *** Suppression dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" ***

                    *** Suppression dossiers dans "C:\Documents and Settings\All Users\menudm~1" ***

                    *** Suppression dossiers dans "c:\docume~1\alluse~1\applic~1" ***

                    *** Suppression dossiers dans "C:\Documents and Settings\Administrateur.NOM-A3B76CFC09D\applic~1" ***

                    *** Suppression dossiers dans "C:\Documents and Settings\Administrateur.NOM-A3B76CFC09D\locals~1\applic~1" ***

                    *** Suppression dossiers dans "C:\Documents and Settings\Administrateur.NOM-A3B76CFC09D\menudm~1\progra~1" ***

                    *** Suppression fichiers ***

                    C:\WINDOWS\pack.epk supprimé !

                    *** Suppression fichiers temporaires ***

                    Nettoyage contenu C:\WINDOWS\Temp effectué !
                    Nettoyage contenu C:\Documents and Settings\Administrateur.NOM-A3B76CFC09D\locals~1\Temp effectué !

                    *** Traitement Recherche complémentaire ***
                    (Recherche fichiers spécifiques)

                    1)Suppression avec sauvegardes nouveaux fichiers Instant Access :

                    2)Recherche, création sauvegardes et suppression Heuristique :

                    * Dans "C:\WINDOWS\system32" *

                    rvnefg.dat trouvé !
                    Copie rvnefg.dat réalisée avec succès !
                    rvnefg.dat supprimé !

                    suqsw.exe trouvé !
                    Copie suqsw.exe réalisée avec succès !
                    suqsw.exe supprimé !

                    suqsw.dat trouvé !
                    Copie suqsw.dat réalisée avec succès !
                    suqsw.dat supprimé !

                    suqsw_navps.dat trouvé !
                    Copie suqsw_navps.dat réalisée avec succès !
                    suqsw_navps.dat supprimé !

                    C:\WINDOWS\prefetch\suqsw*.pf trouvé !
                    Copie C:\WINDOWS\prefetch\suqsw*.pf réalisée avec succès !
                    C:\WINDOWS\prefetch\suqsw*.pf supprimé !

                    jhffcdspt_navfx.dat trouvé !
                    Copie jhffcdspt_navfx.dat réalisée avec succès !
                    jhffcdspt_navfx.dat supprimé !

                    wkgqwoo_navfx.dat trouvé !
                    Copie wkgqwoo_navfx.dat réalisée avec succès !
                    wkgqwoo_navfx.dat supprimé !

                    * Dans "C:\Documents and Settings\Administrateur.NOM-A3B76CFC09D\locals~1\applic~1" *

                    *** Sauvegarde du Registre vers dossier Safebackup ***

                    sauvegarde du Registre réalisée avec succès !

                    *** Nettoyage Registre ***

                    Nettoyage Registre Ok

                    *** Certificats ***

                    Certificat Egroup absent !
                    Certificat Electronic-Group absent !
                    Certificat Montorgueil absent !
                    Certificat OOO-Favorit absent !
                    Certificat Sunny-Day-Design-Ltdt absent !

                    *** Nettoyage terminé le 14/10/2008 à 17:56:56,71 ***
                    -1
                    1. sherred
                      refait un hijacThis et poste le

                      ton pc doit mieux se comporter non ?
                      -1
                  3. Massylum Auteur
                    bonjour,
                    je suis entrain de faire le scan. J'ai une petite question: est ce que celà a une importance si j'effectue toutes ces opérations depuis la session administrateur? Est ce que la réparation sera appliqué a mon autre session?
                    En vous remerciant.
                    -1
                    1. Massylum Auteur
                      voilà le rapport Hijackthis d'aujourd'hui:

                      Logfile of Trend Micro HijackThis v2.0.2
                      Scan saved at 14:58: VIRUS ALERT!, on 15/10/2008
                      Platform: Windows XP SP2 (WinNT 5.01.2600)
                      MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
                      Boot mode: Normal

                      Running processes:
                      C:\WINDOWS\System32\smss.exe
                      C:\WINDOWS\system32\winlogon.exe
                      C:\WINDOWS\system32\services.exe
                      C:\WINDOWS\system32\lsass.exe
                      C:\WINDOWS\system32\svchost.exe
                      C:\WINDOWS\System32\svchost.exe
                      C:\WINDOWS\system32\svchost.exe
                      C:\WINDOWS\system32\spoolsv.exe
                      C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                      C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
                      C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
                      C:\WINDOWS\Explorer.EXE
                      C:\Program Files\Bonjour\mDNSResponder.exe
                      C:\Program Files\Digidesign\Drivers\MMERefresh.exe
                      C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE
                      C:\Program Files\AVC Finger-sensing Pad Driver\fspadsvr.exe
                      C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                      C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
                      C:\WINDOWS\system32\nvsvc32.exe
                      C:\WINDOWS\system32\svchost.exe
                      C:\WINDOWS\system32\atwtusb.exe
                      C:\WINDOWS\system32\WTMKM.exe
                      C:\WINDOWS\system32\wscntfy.exe
                      C:\Program Files\Adobe\Adobe Photoshop Lightroom 1.1\apdproxy.exe
                      C:\Program Files\Winamp\winampa.exe
                      C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
                      C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
                      C:\Program Files\QuickTime\QTTask.exe
                      C:\Program Files\iTunes\iTunesHelper.exe
                      C:\WINDOWS\System32\WScript.exe
                      C:\WINDOWS\system32\rundll32.exe
                      C:\WINDOWS\system32\brastk.exe
                      C:\Program Files\Skype\Phone\Skype.exe
                      C:\Program Files\iPod\bin\iPodService.exe
                      C:\Program Files\Windows Live\Messenger\msnmsgr.exe
                      C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
                      C:\Program Files\Winamp Remote\bin\OrbTray.exe
                      C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe
                      C:\WINDOWS\system32\ctfmon.exe
                      C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
                      C:\WINDOWS\system32\fshyzwbm.exe
                      C:\Documents and Settings\Dr Gonzo\Application Data\Adobe\Player.exe
                      C:\Program Files\Google\Google Updater\GoogleUpdater.exe
                      C:\Program Files\MagicDisc\MagicDisc.exe
                      C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
                      C:\Program Files\PROMT98\INTEGRAL\pinmenu.exe
                      C:\Program Files\Winamp Remote\bin\Orb.exe

                      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Hacked by Godzilla
                      R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
                      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                      R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
                      O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                      O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
                      O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
                      O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
                      O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
                      O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
                      O3 - Toolbar: rosqxvmn - {E01D0ACE-25AC-4353-87EF-6CB2B368E3C7} - C:\WINDOWS\rosqxvmn.dll
                      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
                      O4 - HKLM\..\Run: [MacrokeyManager] WTMKM.exe
                      O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Adobe Photoshop Lightroom 1.1\apdproxy.exe"
                      O4 - HKLM\..\Run: [DigidesignMMERefresh] C:\Program Files\Digidesign\Drivers\MMERefresh.exe
                      O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
                      O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
                      O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
                      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
                      O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
                      O4 - HKLM\..\Run: [MS32DLL] C:\WINDOWS\MS32DLL.dll.vbs
                      O4 - HKLM\..\Run: [0c6a16f2] rundll32.exe "C:\WINDOWS\system32\pymlcixk.dll",b
                      O4 - HKLM\..\Run: [brastk] C:\WINDOWS\system32\brastk.exe
                      O4 - HKCU\..\Run: [fsc-reminder.exe] C:\WINDOWS\reminder\fsc-reminder.exe 2454035 14
                      O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
                      O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
                      O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
                      O4 - HKCU\..\Run: [Coal Two] C:\DOCUME~1\DRGONZ~1\APPLIC~1\THUNKP~1\tickbows.exe
                      O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
                      O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
                      O4 - HKCU\..\Run: [Creative Live! Cam Manager] "C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe"
                      O4 - HKCU\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe
                      O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                      O4 - HKCU\..\Run: [] C:\Documents and Settings\Dr Gonzo\Application Data\Adobe\Player.exe
                      O4 - HKCU\..\Run: [\YUR38.exe] C:\Windows\system32\YUR38.exe
                      O4 - HKCU\..\Run: [\YUR39.exe] C:\Windows\system32\YUR39.exe
                      O4 - HKCU\..\Run: [\YUR3A.exe] C:\Windows\system32\YUR3A.exe
                      O4 - HKCU\..\Run: [\YUR3B.exe] C:\Windows\system32\YUR3B.exe
                      O4 - HKCU\..\Run: [\YUR45.exe] C:\Windows\system32\YUR45.exe
                      O4 - HKCU\..\Run: [\YUR1.exe] C:\Windows\system32\YUR1.exe
                      O4 - HKCU\..\Run: [\YUR2.exe] C:\Windows\system32\YUR2.exe
                      O4 - HKCU\..\Run: [\YUR3.exe] C:\Windows\system32\YUR3.exe
                      O4 - HKCU\..\Run: [\YUR4.exe] C:\Windows\system32\YUR4.exe
                      O4 - HKCU\..\Run: [\YURB.exe] C:\Windows\system32\YURB.exe
                      O4 - HKCU\..\Run: [\YUR13.exe] C:\Windows\system32\YUR13.exe
                      O4 - HKCU\..\Run: [\YUR23.exe] C:\Windows\system32\YUR23.exe
                      O4 - HKCU\..\Run: [\YUR9.exe] C:\Windows\system32\YUR9.exe
                      O4 - HKCU\..\Run: [\YUR7.exe] C:\Windows\system32\YUR7.exe
                      O4 - HKCU\..\Run: [\YUR5.exe] C:\Windows\system32\YUR5.exe
                      O4 - HKCU\..\Run: [cfgsmart] C:\WINDOWS\system32\fshyzwbm.exe
                      O4 - HKCU\..\Run: [brastk] C:\WINDOWS\system32\brastk.exe
                      O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                      O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'SERVICE LOCAL')
                      O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                      O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                      O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                      O4 - Startup: Accélérateur PC.lnk = ?
                      O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
                      O4 - Startup: Intégrateur PROjectMT 98.lnk = C:\Program Files\PROMT98\INTEGRAL\PINSTART.EXE
                      O4 - Startup: MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe
                      O4 - Startup: Outil de détection de support Picture Motion Browser.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
                      O4 - Startup: Rapid Antivirus.lnk = C:\Program Files\Rapid Antivirus\Rapid Antivirus.exe
                      O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
                      O4 - Global Startup: Logo Calibration Loader.lnk = C:\Program Files\GretagMacbeth\i1\Eye-One Match 3\CalibrationLoader\CalibrationLoader.exe
                      O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
                      O4 - Global Startup: ProfileReminder.lnk = C:\Program Files\GretagMacbeth\i1\Eye-One Match 3\ProfileReminder.exe
                      O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
                      O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
                      O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
                      O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
                      O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
                      O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
                      O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
                      O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
                      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
                      O8 - Extra context menu item: Personnaliser - C:\Program Files\PROMT98\promtie4\options.htm
                      O8 - Extra context menu item: Rechercher sur Internet - C:\Program Files\PROMT98\promtie4\search.htm
                      O8 - Extra context menu item: Traduire - C:\Program Files\PROMT98\promtie4\translat.htm
                      O8 - Extra context menu item: Traduire dans WebView - C:\Program Files\PROMT98\promtie4\webview.htm
                      O8 - Extra context menu item: Traduire la page - C:\Program Files\PROMT98\promtie4\page.htm
                      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                      O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                      O9 - Extra button: Traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT98\promtie4\promtie5.htm
                      O9 - Extra 'Tools' menuitem: Traduire - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT98\promtie4\promtie5.htm
                      O9 - Extra button: (no name) - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT98\promtie4\options.htm
                      O9 - Extra 'Tools' menuitem: Personnalisez traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT98\promtie4\options.htm
                      O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
                      O9 - Extra button: Organise-notes - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Researcher\EROPROJ.DLL
                      O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll/206 (file missing)
                      O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Dr Gonzo\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk (file missing)
                      O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe (file missing)
                      O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe (file missing)
                      O9 - Extra button: @c:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\Program Files\Messenger\msmsgs.exe
                      O9 - Extra 'Tools' menuitem: @c:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\Program Files\Messenger\msmsgs.exe
                      O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
                      O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
                      O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su2/CTL_V02002/ocx/15031/CTPID.cab
                      O17 - HKLM\System\CCS\Services\Tcpip\..\{0A2E372D-715A-4A4B-8073-EB98D3D72D1C}: NameServer = 212.27.54.252,212.27.53.252
                      O17 - HKLM\System\CCS\Services\Tcpip\..\{287F046B-DA64-4D14-80DE-A4BA647711BC}: NameServer = 212.27.54.252,212.27.53.252
                      O17 - HKLM\System\CS1\Services\Tcpip\..\{0A2E372D-715A-4A4B-8073-EB98D3D72D1C}: NameServer = 212.27.54.252,212.27.53.252
                      O17 - HKLM\System\CS2\Services\Tcpip\..\{0A2E372D-715A-4A4B-8073-EB98D3D72D1C}: NameServer = 212.27.54.252,212.27.53.252
                      O17 - HKLM\System\CS3\Services\Tcpip\..\{0A2E372D-715A-4A4B-8073-EB98D3D72D1C}: NameServer = 212.27.54.252,212.27.53.252
                      O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL upmhrf.dll
                      O21 - SSODL: ngwstxfd - {D8CCDFC9-6152-4A50-900F-E44D118D653F} - C:\WINDOWS\ngwstxfd.dll
                      O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
                      O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                      O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
                      O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
                      O23 - Service: Avid SDM Service (AvidSDMService) - Unknown owner - C:\WINDOWS\system32\AvidSDMService.exe (file missing)
                      O23 - Service: Avid Startup (AvidStartup) - Unknown owner - C:\WINDOWS\system32\AvidStartup.exe
                      O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
                      O23 - Service: Digidesign MME Refresh Service (DigiRefresh) - Digidesign, A Division of Avid Technology, Inc. - C:\Program Files\Digidesign\Drivers\MMERefresh.exe
                      O23 - Service: EPSON V3 Service4(01) (EPSON_PM_RPCV4_01) - SEIKO EPSON CORPORATION - C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE
                      O23 - Service: FspadSvc - Unknown owner - C:\Program Files\AVC Finger-sensing Pad Driver\fspadsvr.exe
                      O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
                      O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
                      O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                      O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
                      O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
                      O23 - Service: WTService - Unknown owner - C:\WINDOWS\system32\atwtusb.exe
                      -1
                      1. sherred
                        oui bien sur
                        Télécharge http://download.bleepingcomputer.com/sUBs/ComboFix.exe sur ton Bureau.
                        tu va redemarrer ton pc en sans echec F8 au demarrage du pc
                        et tu refait un scan MalwareBytes' Anti-Malware en complet
                        puis
                        ComboFix
                        Double clique sur ComboFix.exe
                        Tape sur la touche Y pour démarrer le scan.
                        ComboFix redémarrera ton PC : suivre les instructions indiquées à l'écran.

                        0
                      2. Massylum Auteur
                        @sherredvoici le rapport Malwarebytes:

                        Malwarebytes' Anti-Malware 1.28
                        Database version: 1134
                        Windows 5.1.2600 Service Pack 2

                        2008-10-16 01:02:48
                        mbam-log-2008-10-16 (01-02-48).txt

                        Scan type: Full Scan (C:\|)
                        Objects scanned: 212624
                        Time elapsed: 1 hour(s), 32 minute(s), 52 second(s)

                        Memory Processes Infected: 0
                        Memory Modules Infected: 0
                        Registry Keys Infected: 4
                        Registry Values Infected: 18
                        Registry Data Items Infected: 0
                        Folders Infected: 0
                        Files Infected: 6

                        je posterais dès demain matin mon rapport Hijackthis.

                        Memory Processes Infected:
                        (No malicious items detected)

                        Memory Modules Infected:
                        (No malicious items detected)

                        Registry Keys Infected:
                        HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{ab3dfa03-f743-4302-81dd-c370bffeca23} (Adware.Starware) -> Quarantined and deleted successfully.
                        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.
                        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
                        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

                        Registry Values Infected:
                        HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cfgsmart (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.
                        HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur38.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                        HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur39.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                        HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur3a.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                        HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur3b.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                        HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur45.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                        HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur1.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                        HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur2.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                        HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur3.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                        HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur4.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                        HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yurb.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                        HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur13.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                        HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur23.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                        HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur9.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                        HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur7.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                        HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur5.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                        HKEY_CURRENT_USER\Control Panel\Desktop\originalwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
                        HKEY_CURRENT_USER\Control Panel\Desktop\convertedwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.

                        Registry Data Items Infected:
                        (No malicious items detected)

                        Folders Infected:
                        (No malicious items detected)

                        Files Infected:
                        C:\WINDOWS\system32\fshyzwbm.exe (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.
                        C:\System Volume Information\_restore{DF9F85A4-6F7D-4225-B331-ED321708564F}\RP593\A0227539.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
                        C:\System Volume Information\_restore{DF9F85A4-6F7D-4225-B331-ED321708564F}\RP593\A0227540.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                        C:\System Volume Information\_restore{DF9F85A4-6F7D-4225-B331-ED321708564F}\RP593\A0227541.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                        C:\System Volume Information\_restore{DF9F85A4-6F7D-4225-B331-ED321708564F}\RP593\A0227542.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
                        C:\Documents and Settings\Dr Gonzo\delself.bat (Malware.Trace) -> Quarantined and deleted successfully.
                        -1
                      3. sherred
                        @Massylumsi tu a fait combofix donne nous le rapport

                        sinon refait un hijacThis et un SmitFraudfix option 4 puis 1
                        -1
                      4. Massylum Auteur
                        @sherredvoilà le Hijackthis:

                        Logfile of Trend Micro HijackThis v2.0.2
                        Scan saved at 12:14, on 2008-10-16
                        Platform: Windows XP SP2 (WinNT 5.01.2600)
                        MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
                        Boot mode: Safe mode with network support

                        Running processes:
                        C:\WINDOWS\System32\smss.exe
                        C:\WINDOWS\system32\winlogon.exe
                        C:\WINDOWS\system32\services.exe
                        C:\WINDOWS\system32\lsass.exe
                        C:\WINDOWS\system32\svchost.exe
                        C:\WINDOWS\system32\svchost.exe
                        C:\WINDOWS\Explorer.EXE
                        C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

                        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
                        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
                        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                        R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
                        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                        R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
                        O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                        O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
                        O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
                        O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
                        O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
                        O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
                        O3 - Toolbar: rosqxvmn - {E01D0ACE-25AC-4353-87EF-6CB2B368E3C7} - C:\WINDOWS\rosqxvmn.dll (file missing)
                        O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
                        O4 - HKLM\..\Run: [MacrokeyManager] WTMKM.exe
                        O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Adobe Photoshop Lightroom 1.1\apdproxy.exe"
                        O4 - HKLM\..\Run: [DigidesignMMERefresh] C:\Program Files\Digidesign\Drivers\MMERefresh.exe
                        O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
                        O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
                        O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
                        O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
                        O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
                        O4 - HKCU\..\Run: [fsc-reminder.exe] C:\WINDOWS\reminder\fsc-reminder.exe 2454035 14
                        O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
                        O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
                        O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
                        O4 - HKCU\..\Run: [Coal Two] C:\DOCUME~1\DRGONZ~1\APPLIC~1\THUNKP~1\tickbows.exe
                        O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
                        O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
                        O4 - HKCU\..\Run: [Creative Live! Cam Manager] "C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe"
                        O4 - HKCU\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe
                        O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                        O4 - HKCU\..\Run: [brastk] C:\WINDOWS\system32\brastk.exe
                        O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                        O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'SERVICE LOCAL')
                        O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                        O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                        O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                        O4 - Startup: Accélérateur PC.lnk = ?
                        O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
                        O4 - Startup: Intégrateur PROjectMT 98.lnk = C:\Program Files\PROMT98\INTEGRAL\PINSTART.EXE
                        O4 - Startup: MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe
                        O4 - Startup: Outil de détection de support Picture Motion Browser.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
                        O4 - Startup: Rapid Antivirus.lnk = C:\Program Files\Rapid Antivirus\Rapid Antivirus.exe
                        O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
                        O4 - Global Startup: Logo Calibration Loader.lnk = C:\Program Files\GretagMacbeth\i1\Eye-One Match 3\CalibrationLoader\CalibrationLoader.exe
                        O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
                        O4 - Global Startup: ProfileReminder.lnk = C:\Program Files\GretagMacbeth\i1\Eye-One Match 3\ProfileReminder.exe
                        O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
                        O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
                        O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
                        O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
                        O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
                        O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
                        O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
                        O8 - Extra context menu item: Personnaliser - C:\Program Files\PROMT98\promtie4\options.htm
                        O8 - Extra context menu item: Rechercher sur Internet - C:\Program Files\PROMT98\promtie4\search.htm
                        O8 - Extra context menu item: Traduire - C:\Program Files\PROMT98\promtie4\translat.htm
                        O8 - Extra context menu item: Traduire dans WebView - C:\Program Files\PROMT98\promtie4\webview.htm
                        O8 - Extra context menu item: Traduire la page - C:\Program Files\PROMT98\promtie4\page.htm
                        O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                        O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                        O9 - Extra button: Traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT98\promtie4\promtie5.htm
                        O9 - Extra 'Tools' menuitem: Traduire - {7A2EFD41-E6B3-11D2-89E3-00E0292EE574} - C:\Program Files\PROMT98\promtie4\promtie5.htm
                        O9 - Extra button: (no name) - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT98\promtie4\options.htm
                        O9 - Extra 'Tools' menuitem: Personnalisez traduction - {7A2EFD41-E6B3-11D2-89E3-00E0292EE575} - C:\Program Files\PROMT98\promtie4\options.htm
                        O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
                        O9 - Extra button: Organise-notes - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Researcher\EROPROJ.DLL
                        O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll/206 (file missing)
                        O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Dr Gonzo\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk (file missing)
                        O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe (file missing)
                        O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe (file missing)
                        O9 - Extra button: @c:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\Program Files\Messenger\msmsgs.exe
                        O9 - Extra 'Tools' menuitem: @c:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\Program Files\Messenger\msmsgs.exe
                        O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
                        O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
                        O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su2/CTL_V02002/ocx/15031/CTPID.cab
                        O17 - HKLM\System\CCS\Services\Tcpip\..\{0A2E372D-715A-4A4B-8073-EB98D3D72D1C}: NameServer = 212.27.54.252,212.27.53.252
                        O17 - HKLM\System\CCS\Services\Tcpip\..\{287F046B-DA64-4D14-80DE-A4BA647711BC}: NameServer = 212.27.54.252,212.27.53.252
                        O17 - HKLM\System\CS1\Services\Tcpip\..\{0A2E372D-715A-4A4B-8073-EB98D3D72D1C}: NameServer = 212.27.54.252,212.27.53.252
                        O17 - HKLM\System\CS2\Services\Tcpip\..\{0A2E372D-715A-4A4B-8073-EB98D3D72D1C}: NameServer = 212.27.54.252,212.27.53.252
                        O17 - HKLM\System\CS3\Services\Tcpip\..\{0A2E372D-715A-4A4B-8073-EB98D3D72D1C}: NameServer = 212.27.54.252,212.27.53.252
                        O21 - SSODL: ngwstxfd - {D8CCDFC9-6152-4A50-900F-E44D118D653F} - C:\WINDOWS\ngwstxfd.dll (file missing)
                        O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
                        O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                        O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
                        O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
                        O23 - Service: Avid SDM Service (AvidSDMService) - Unknown owner - C:\WINDOWS\system32\AvidSDMService.exe (file missing)
                        O23 - Service: Avid Startup (AvidStartup) - Unknown owner - C:\WINDOWS\system32\AvidStartup.exe
                        O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
                        O23 - Service: Digidesign MME Refresh Service (DigiRefresh) - Digidesign, A Division of Avid Technology, Inc. - C:\Program Files\Digidesign\Drivers\MMERefresh.exe
                        O23 - Service: EPSON V3 Service4(01) (EPSON_PM_RPCV4_01) - SEIKO EPSON CORPORATION - C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE
                        O23 - Service: FspadSvc - Unknown owner - C:\Program Files\AVC Finger-sensing Pad Driver\fspadsvr.exe
                        O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
                        O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
                        O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                        O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
                        O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
                        O23 - Service: WTService - Unknown owner - C:\WINDOWS\system32\atwtusb.exe
                        -1
                      5. Massylum Auteur
                        @Massylumvoila le rapport Smitfraudfix:

                        SmitFraudFix v2.361

                        Rapport fait à 12:31:51.28, 2008-10-16
                        Executé à partir de C:\Documents and Settings\Dr Gonzo\Bureau\VIRUS ALERT\SmitfraudFix
                        OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
                        Le type du système de fichiers est NTFS
                        Fix executé en mode sans echec

                        »»»»»»»»»»»»»»»»»»»»»»»» Process

                        C:\WINDOWS\System32\smss.exe
                        C:\WINDOWS\system32\winlogon.exe
                        C:\WINDOWS\system32\services.exe
                        C:\WINDOWS\system32\lsass.exe
                        C:\WINDOWS\system32\svchost.exe
                        C:\WINDOWS\system32\svchost.exe
                        C:\WINDOWS\Explorer.EXE
                        C:\Program Files\Mozilla Firefox\firefox.exe
                        C:\WINDOWS\system32\cmd.exe

                        »»»»»»»»»»»»»»»»»»»»»»»» hosts

                        »»»»»»»»»»»»»»»»»»»»»»»» C:\

                        »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

                        C:\WINDOWS\lomxeqsn.exe PRESENT !

                        »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

                        »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

                        »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

                        »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

                        »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Dr Gonzo

                        »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Dr Gonzo\Application Data

                        »»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

                        »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\DRGONZ~1\Favoris

                        »»»»»»»»»»»»»»»»»»»»»»»» Bureau

                        »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

                        »»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

                        »»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

                        [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
                        "Source"="About:Home"
                        "SubscribedURL"="About:Home"
                        "FriendlyName"="Ma page d'accueil"

                        »»»»»»»»»»»»»»»»»»»»»»»» o4Patch
                        !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                        o4Patch
                        Credits: Malware Analysis & Diagnostic
                        Code: S!Ri

                        »»»»»»»»»»»»»»»»»»»»»»»» IEDFix
                        !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                        IEDFix
                        Credits: Malware Analysis & Diagnostic
                        Code: S!Ri

                        »»»»»»»»»»»»»»»»»»»»»»»» VACFix
                        !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                        VACFix
                        Credits: Malware Analysis & Diagnostic
                        Code: S!Ri

                        »»»»»»»»»»»»»»»»»»»»»»»» 404Fix
                        !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                        404Fix
                        Credits: Malware Analysis & Diagnostic
                        Code: S!Ri

                        »»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix
                        !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                        AntiXPVSTFix
                        Credits: Malware Analysis & Diagnostic
                        Code: S!Ri

                        »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
                        !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                        SrchSTS.exe by S!Ri
                        Search SharedTaskScheduler's .dll

                        »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
                        !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                        »»»»»»»»»»»»»»»»»»»»»»»» Winlogon
                        !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
                        "Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
                        "System"=""

                        »»»»»»»»»»»»»»»»»»»»»»»» RK

                        »»»»»»»»»»»»»»»»»»»»»»»» DNS

                        Description: Fujitsu Siemens Computers WLAN 802.11b/g (SiS163u) - Miniport d'ordonnancement de paquets
                        DNS Server Search Order: 212.27.54.252
                        DNS Server Search Order: 212.27.53.252

                        Description: Fujitsu Siemens Computers WLAN 802.11b/g (SiS163u) - Miniport d'ordonnancement de paquets
                        DNS Server Search Order: 212.27.54.252
                        DNS Server Search Order: 212.27.53.252

                        HKLM\SYSTEM\CCS\Services\Tcpip\..\{0A2E372D-715A-4A4B-8073-EB98D3D72D1C}: NameServer=212.27.54.252,212.27.53.252
                        HKLM\SYSTEM\CCS\Services\Tcpip\..\{287F046B-DA64-4D14-80DE-A4BA647711BC}: NameServer=212.27.54.252,212.27.53.252
                        HKLM\SYSTEM\CS1\Services\Tcpip\..\{0A2E372D-715A-4A4B-8073-EB98D3D72D1C}: NameServer=212.27.54.252,212.27.53.252
                        HKLM\SYSTEM\CS2\Services\Tcpip\..\{0A2E372D-715A-4A4B-8073-EB98D3D72D1C}: NameServer=212.27.54.252,212.27.53.252
                        HKLM\SYSTEM\CS2\Services\Tcpip\..\{287F046B-DA64-4D14-80DE-A4BA647711BC}: NameServer=212.27.54.252,212.27.53.252
                        HKLM\SYSTEM\CS3\Services\Tcpip\..\{0A2E372D-715A-4A4B-8073-EB98D3D72D1C}: NameServer=212.27.54.252,212.27.53.252
                        HKLM\SYSTEM\CS3\Services\Tcpip\..\{287F046B-DA64-4D14-80DE-A4BA647711BC}: NameServer=212.27.54.252,212.27.53.252

                        »»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

                        »»»»»»»»»»»»»»»»»»»»»»»» Fin
                        -1
                    2. Utilisateur anonyme
                      Tu es encore infecter,
                      Télécharge combofix de sUBs ici : http://download.bleepingcomputer.com/sUBs/ComboFix.exe lance le et poste le rapport
                      -1

                      Discussions similaires

                      SMS message vocal arnaque ?
                      kikidefer

                      10 réponses
                      Non envoyé. Appuyez pour réessayer. Problème d'envoi SMS pour un seul contact.
                      emembi

                      5 réponses
                      Signification de ^^
                      takataka26

                      13 réponses
                      se debarasser de fausses alerte virus
                      Evka

                      1 réponse
                      Message "SMS Non envoyé"
                      El-Gallego

                      1 réponse