TROJAN VIRTUMONDE

Résolu
Help-me-=) -  
Bonjour,
Ou Bonsoir ,

Depuiis Quelques jours ou quelques semaines Mon ordinateur est infectés d'un trojan : VIRTUMONDE

Apres Plusieurs Analyse et plusieurs tentatives de désinfections Rien est venu a bout

Il est toujours là ou il sont toujours la ,, puisque j'en ai trois :s

Aidez Moi S'il vous Plait !

D'après se que j'ai déchifrée [ en anglais ] par le logiciels search & destroy je ne pourait l'éliminer Quand enlever ma connection internet ! est-ce vrai ??
Configuration: Windows Vista
Internet Explorer 7.0

27 réponses

Résumé de la discussion

Une infection par le Trojan Virtumonde persiste sur un ordinateur sous Windows Vista malgré plusieurs analyses et tentatives de désinfection. La meilleure approche préconisée consiste à désactiver le contrôle des comptes utilisateurs puis exécuter ComboFix en mode sans connexion et en langue française, en enfermant la machine hors réseau jusqu’à la fin du scan. Après le scan, il est recommandé de réactiver immédiatement la protection antivirale et antispyware et de poster le contenu du rapport généré par ComboFix pour poursuivre le nettoyage. Des éléments suspects relevés dans les journaux incluent des modules publicitaires et des extensions associées à Dealio, Live Search et à des composants Orange, suggérant une infection qui peut s’étendre par des programmes résidents.

Bobot (l’IA à votre service)
  1. MoKo
    Il existe Vundofix il me semble pour cette infection, mais si tu cherches bien sur le net, il en faut d'autres. Il y a plusieurs tutos de dispo pour regler ce prob. Google est ton ami :)
    1. Help-me-=) Auteur
      Merci Je vais Essayer pour se qui est de vundofix ,, mais il me semble que google est déjà mon meilleur ami

      à+
      1. Help-me-=) Auteur
        Voilà J'ai Essayer Mais le trojan Est en Mode Masquer Vundofix Ne le Detecte Pas
        :s
        1. Help-me-=) Auteur
          Aidez Moii S'il vous Plait :

          Peut être que sa peut aider :

          Logfile of Trend Micro HijackThis v2.0.2
          Scan saved at 20:38:56, on 29/10/2008
          Platform: Windows Vista SP1 (WinNT 6.00.1905)
          MSIE: Internet Explorer v7.00 (7.00.6001.18000)
          Boot mode: Normal

          Running processes:
          C:\Windows\system32\taskeng.exe
          C:\Windows\system32\Dwm.exe
          C:\Windows\Explorer.EXE
          C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE
          C:\Program Files\TomTom HOME\TomTomHOME.exe
          C:\Program Files\iTunes\iTunesHelper.exe
          C:\Program Files\Orange\AntivirusFirewall\FSGUI\fsguidll.exe
          C:\Program Files\Defenza\pcd-as.exe
          C:\Program Files\Windows Sidebar\sidebar.exe
          C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
          C:\Program Files\FinePixViewer\QuickDCF2.exe
          C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
          C:\Windows\system32\conime.exe
          C:\Users\Anne-laure\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
          C:\Users\Anne-laure\AppData\Roaming\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
          C:\Program Files\OrangeHSS\systray\systrayapp.exe
          C:\Windows\system32\taskeng.exe
          C:\Program Files\Windows Live\Messenger\msnmsgr.exe
          C:\Program Files\Internet Explorer\ieuser.exe
          C:\Program Files\Internet Explorer\iexplore.exe
          C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
          C:\Windows\system32\SearchFilterHost.exe
          C:\Users\Anne-laure\HiJackThis.exe
          C:\Windows\system32\Macromed\Flash\FlashUtil9f.exe

          R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/...
          R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/...
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
          R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/...
          R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
          R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
          R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\OrangeHSS\SearchURLHook\SearchPageURL.dll
          O1 - Hosts: ::1 localhost
          O1 - Hosts: 92.48.81.32 iHabbixReloaded
          O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
          O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
          O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (file missing)
          O2 - BHO: DealioBHO Class - {6A87B991-A31F-4130-AE72-6D0C294BF082} - C:\Program Files\Dealio\kb127\Dealio.dll
          O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
          O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
          O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
          O3 - Toolbar: Dealio - {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - C:\Program Files\Dealio\kb127\Dealio.dll
          O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
          O4 - HKLM\..\Run: [au] C:\Program Files\Dealio\DealioAU.exe
          O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\OrangeHSS\SessionManager\SessionManager.exe
          O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE" /splash
          O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Orange\AntivirusFirewall\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
          O4 - HKLM\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME\TomTomHOME.exe" -s
          O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
          O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
          O4 - HKLM\..\Run: [PCDAS] C:\Program Files\Defenza\pcd-as.exe /10003
          O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
          O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
          O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
          O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
          O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
          O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
          O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
          O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
          O4 - HKUS\S-1-5-21-1358859215-3497976692-2764473087-1005\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun (User 'vero')
          O4 - HKUS\S-1-5-21-1358859215-3497976692-2764473087-1005\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'vero')
          O4 - HKUS\S-1-5-21-1358859215-3497976692-2764473087-1005\..\Run: [EPSON Stylus D92 Series] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIBZE.EXE /FU "C:\Windows\TEMP\E_SC4E5.tmp" /EF "HKCU" (User 'vero')
          O4 - Startup: Outil de notification Live Search.lnk = Anne-laure\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
          O4 - Global Startup: ExifLauncher2.lnk = C:\Program Files\FinePixViewer\QuickDCF2.exe
          O8 - Extra context menu item: Compare Prices with &Dealio - C:\Users\Anne-laure\AppData\LocalLow\Dealio\kb127\res\DealioSearch.html
          O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
          O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
          O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
          O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
          O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
          O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
          O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
          O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
          O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Users\Véronique\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IMVU\Run IMVU.lnk
          O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
          O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
          O9 - Extra button: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb127\Dealio.dll
          O9 - Extra 'Tools' menuitem: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb127\Dealio.dll
          O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
          O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
          O13 - Gopher Prefix:
          O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
          O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
          O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
          O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsgk32st.exe
          O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsaua.exe
          O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\FWES\Program\fsdfwd.exe
          O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\Common\FSMA32.EXE
          O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
          O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
          O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
          O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
          O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
          O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
          O23 - Service: RoxMediaDB9 - Sonic Solutions - c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
          O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
          1. archet9
            bonsoir,

            apres une analyse rapide de ton rapport hijack:

            virtumonde effectivement...(des pub ?)
            + pas mal d autres d autres infections...(trojans)
            + eorezo (vecteur d infections pubs)
            +2 antivirus (f-secure +norton)

            y a du boulot.....

            veux-tu mettre de l ordre ds tout ca?

            A+.

        3. Help-me-=) Auteur
          Oui , Je voudrais

          Merci . Comment je faiis?
          1. archet9
            --bonjour

            Désactive le contrôle des comptes utilisateurs (tu le réactiveras après ta désinfection):

            - Va dans démarrer puis panneau de configuration
            - Double Clique sur l'icône "Comptes d'utilisateurs"
            - Clique ensuite sur désactiver et valide.

            ensuite fais ceci:

            ---> Télécharge ComboFix.exe de sUBs sur ton Bureau :
            http://download.bleepingcomputer.com/sUBs/ComboFix.exe

            /!\ Déconnecte-toi du net et ferme toutes les applications, antivirus et antispyware y compris /!\

            ---> Double-clique sur Combofix.exe
            Un "pop-up" va apparaître qui dit que "ComboFix est utilisé à vos risques et avec aucune garantie...".
            Accepte en cliquant sur "Oui"

            ---> Mets-le en langue française F
            Tape sur la touche 1 (Yes) pour démarrer le scan.

            /!\ Ne touche à rien tant que le scan n'est pas terminé. /!\

            En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.

            Une fois le scan achevé, un rapport va s'afficher : Poste son contenu

            /!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\

            Note : Le rapport se trouve également là : C:\ComboFix.txt

            a+
            Antonio Giacomo Stradivari, souvent appelé Stradivarius (Crémone, 1644 - Crémone, 18 décembre 1737 
            Le Soil (1714), considéré par beaucoup comme le meilleur instrument du monde.
            peu de temps avant sa mort il cherchait encore... 
        4. Help-me-=) Auteur
          Voilà J'ai fais Exactement Se Que Vous Avez Dit , J'éspere que ça à marcher , voilà le rapport :

          ComboFix 08-10-30.04 - Anne-laure 2008-10-30 9:58:32.1 - NTFSx86
          Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.1222 [GMT 1:00]
          Lancé depuis: C:\Users\Anne-laure\Desktop\ComboFix.exe
          .

          (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
          .

          C:\Program Files\FBrowserAdvisor
          C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PlayMP3z
          C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PlayMP3z\Run PlayMP3z.lnk
          C:\Users\Véronique\AppData\Roaming\inst.exe

          .
          ((((((((((((((((((((((((((((( Fichiers créés du 2008-09-28 au 2008-10-30 ))))))))))))))))))))))))))))))))))))
          .

          2008-10-29 20:37 . 2008-10-29 20:37 401,720 --a------ C:\Users\Anne-laure\HiJackThis.exe
          2008-10-29 19:52 . 2008-10-29 19:52 <REP> d-------- C:\Program Files\Trend Micro
          2008-10-29 18:04 . 2008-10-29 18:04 <REP> d-------- C:\VundoFix Backups
          2008-10-29 15:48 . 2008-10-29 15:55 <REP> d-------- C:\Users\Anne-laure\DoctorWeb
          2008-10-29 13:09 . 2008-10-29 13:51 <REP> d-------- C:\Users\All Users\Spybot - Search & Destroy
          2008-10-29 13:09 . 2008-10-29 13:51 <REP> d-------- C:\ProgramData\Spybot - Search & Destroy
          2008-10-29 13:09 . 2008-10-29 13:22 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
          2008-10-29 11:00 . 2008-10-29 11:00 <REP> d-------- C:\Program Files\Defenza
          2008-10-29 11:00 . 1996-08-20 20:37 15,840 --a------ C:\WINDOWS\System32\Machnm1.exe
          2008-10-29 11:00 . 2005-09-25 16:37 5,632 --a------ C:\WINDOWS\System32\Machnm64.sys
          2008-10-29 11:00 . 2008-10-29 11:00 3,120 --a------ C:\WINDOWS\System32\118290.54
          2008-10-29 11:00 . 2008-10-29 11:00 3,120 --a------ C:\WINDOWS\118294.78
          2008-10-29 11:00 . 2003-08-13 00:27 2,304 --a------ C:\WINDOWS\System32\Machnm32.sys
          2008-10-29 08:38 . 2008-08-12 04:39 443,392 --a------ C:\WINDOWS\System32\win32spl.dll
          2008-10-29 08:38 . 2008-09-18 05:56 147,456 --a------ C:\WINDOWS\System32\Faultrep.dll
          2008-10-29 08:38 . 2008-09-18 05:56 125,952 --a------ C:\WINDOWS\System32\wersvc.dll
          2008-10-28 09:31 . 2008-10-28 09:32 <REP> d-------- C:\Program Files\Photo Story 3 for Windows
          2008-10-26 19:53 . 2008-10-28 20:35 <REP> d-------- C:\Program Files\Messenger Plus! Live
          2008-10-26 10:28 . 2008-10-26 10:28 <REP> d-------- C:\Program Files\The Cleaner Demo
          2008-10-26 10:12 . 2008-10-26 10:57 <REP> d-------- C:\Program Files\Trojan Remover
          2008-10-23 20:34 . 2008-10-23 20:34 <REP> d-------- C:\Users\All Users\UDL
          2008-10-23 20:34 . 2008-10-23 20:34 <REP> d-------- C:\ProgramData\UDL
          2008-10-23 20:24 . 2006-12-08 03:04 76,800 --a------ C:\WINDOWS\System32\E_FLBBZE.DLL
          2008-10-23 20:24 . 2006-04-19 03:00 62,976 --a------ C:\WINDOWS\System32\E_FD4BBZE.DLL
          2008-10-23 20:24 . 2004-09-10 21:12 49,152 --a------ C:\WINDOWS\System32\E_DCINST.DLL
          2008-10-23 20:23 . 2008-10-23 20:29 <REP> d-------- C:\Users\All Users\EPSON
          2008-10-23 20:23 . 2008-10-23 20:29 <REP> d-------- C:\ProgramData\EPSON
          2008-10-23 20:23 . 2008-10-23 20:32 <REP> d-------- C:\Program Files\EPSON
          2008-10-23 20:22 . 2008-10-23 20:22 25 --a------ C:\WINDOWS\CDED92Euro.ini
          2008-10-23 07:55 . 2008-08-05 10:49 428,544 --a------ C:\WINDOWS\System32\EncDec.dll
          2008-10-23 07:55 . 2008-08-05 10:49 293,376 --a------ C:\WINDOWS\System32\psisdecd.dll
          2008-10-23 07:55 . 2008-08-05 10:48 217,088 --a------ C:\WINDOWS\System32\psisrndr.ax
          2008-10-23 07:55 . 2008-08-05 10:48 177,664 --a------ C:\WINDOWS\System32\mpg2splt.ax
          2008-10-23 07:55 . 2008-08-05 10:48 80,896 --a------ C:\WINDOWS\System32\MSNP.ax
          2008-10-18 19:12 . 2008-10-26 10:23 <REP> d-------- C:\Users\Anne-laure\AppData\Roaming\Hamachi
          2008-10-18 19:11 . 2008-10-18 19:11 25,280 --a------ C:\WINDOWS\System32\drivers\hamachi.sys
          2008-10-18 17:10 . 2008-10-18 17:55 <REP> d-------- C:\Program Files\Dofus
          2008-10-15 10:11 . 2008-10-15 10:11 <REP> d-------- C:\Users\Anne-laure\AppData\Roaming\Media Player Classic
          2008-10-15 07:40 . 2008-09-18 06:09 3,601,464 --a------ C:\WINDOWS\System32\ntkrnlpa.exe
          2008-10-15 07:40 . 2008-09-18 06:09 3,549,240 --a------ C:\WINDOWS\System32\ntoskrnl.exe
          2008-10-15 07:40 . 2008-09-18 03:16 2,032,640 --a------ C:\WINDOWS\System32\win32k.sys
          2008-10-15 07:40 . 2008-10-02 04:49 827,392 --a------ C:\WINDOWS\System32\wininet.dll
          2008-10-15 07:40 . 2008-09-03 04:59 468,992 --a------ C:\WINDOWS\System32\newdev.dll
          2008-10-15 07:40 . 2008-08-27 02:06 288,768 --a------ C:\WINDOWS\System32\drivers\srv.sys
          2008-10-15 07:40 . 2008-09-03 04:58 74,752 --a------ C:\WINDOWS\System32\newdev.exe
          2008-10-15 07:39 . 2008-10-02 02:32 1,383,424 --a------ C:\WINDOWS\System32\mshtml.tlb
          2008-10-14 18:21 . 2008-10-14 18:21 <REP> d-------- C:\Program Files\Audacity
          2008-10-14 18:16 . 2008-10-14 18:16 <REP> d-------- C:\Program Files\Common Files\DVDVIDEOSOFT
          2008-10-14 18:16 . 2002-01-05 14:37 344,064 --a------ C:\WINDOWS\System32\msvcr70.dll
          2008-10-14 17:42 . 2008-03-21 21:30 3,596,288 --a------ C:\WINDOWS\System32\qt-dx331.dll
          2008-10-14 17:42 . 2008-01-10 13:15 755,027 --a------ C:\WINDOWS\System32\xvidcore.dll
          2008-10-14 17:42 . 2008-03-31 22:25 682,496 --a------ C:\WINDOWS\System32\divx.dll
          2008-10-14 17:42 . 2006-09-24 16:11 389,120 --a------ C:\WINDOWS\System32\lameACM.acm
          2008-10-14 17:42 . 2004-01-25 17:18 217,088 --a------ C:\WINDOWS\System32\yv12vfw.dll
          2008-10-14 17:42 . 2007-09-04 17:56 164,352 --a------ C:\WINDOWS\System32\unrar.dll
          2008-10-14 17:42 . 2008-01-10 13:16 159,839 --a------ C:\WINDOWS\System32\xvidvfw.dll
          2008-10-14 17:42 . 2007-09-21 01:52 118,784 --a------ C:\WINDOWS\System32\ac3acm.acm
          2008-10-14 17:42 . 2008-03-21 21:28 81,920 --a------ C:\WINDOWS\System32\dpl100.dll
          2008-10-14 17:42 . 2007-10-03 16:03 414 --a------ C:\WINDOWS\System32\lame_acm.xml
          2008-10-14 17:41 . 2008-10-14 17:42 <REP> d-------- C:\Program Files\K-Lite Codec Pack
          2008-10-14 17:41 . 2008-03-28 18:41 7,680 --a------ C:\WINDOWS\System32\ff_vfw.dll
          2008-10-14 17:41 . 2007-07-10 17:10 547 --a------ C:\WINDOWS\System32\ff_vfw.dll.manifest
          2008-10-12 20:24 . 2008-10-28 13:14 <REP> d-------- C:\Users\Anne-laure\AppData\Roaming\LimeWire
          2008-10-11 21:56 . 2008-10-26 10:48 <REP> d-------- C:\Program Files\Windows Live Toolbar
          2008-10-11 21:56 . 2008-10-11 21:56 <REP> d-------- C:\Program Files\Microsoft SQL Server Compact Edition
          2008-10-11 21:20 . 2006-11-29 12:06 3,426,072 --a------ C:\WINDOWS\System32\d3dx9_32.dll
          2008-10-11 21:17 . 2008-06-26 04:21 712,704 --a------ C:\WINDOWS\System32\WindowsCodecs.dll
          2008-10-11 21:17 . 2008-06-26 04:21 347,648 --a------ C:\WINDOWS\System32\WindowsCodecsExt.dll
          2008-10-11 21:14 . 2008-10-11 21:14 <REP> d-------- C:\Program Files\Microsoft
          2008-10-11 21:10 . 2008-10-11 21:10 <REP> d-------- C:\Program Files\Common Files\Windows Live
          2008-10-11 21:07 . 2008-10-23 20:44 <REP> d-------- C:\Program Files\Microsoft Silverlight
          2008-10-11 17:17 . 2008-10-11 17:19 <REP> d-------- C:\Users\Anne-laure\AppData\Roaming\SecondLife
          2008-10-10 11:38 . 2008-04-17 12:12 107,368 --a------ C:\WINDOWS\System32\GEARAspi.dll
          2008-10-10 11:38 . 2008-04-17 12:12 15,464 --a------ C:\WINDOWS\System32\drivers\GEARAspiWDM.sys
          2008-10-10 11:37 . 2008-10-10 11:38 <REP> d-------- C:\Users\All Users\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
          2008-10-10 11:37 . 2008-10-10 11:38 <REP> d-------- C:\ProgramData\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
          2008-10-10 11:37 . 2008-10-10 11:38 <REP> d-------- C:\Program Files\iTunes
          2008-10-10 11:37 . 2008-10-10 11:37 <REP> d-------- C:\Program Files\iPod
          2008-10-10 11:36 . 2008-10-10 11:36 <REP> d-------- C:\Program Files\Bonjour
          2008-10-10 11:28 . 2008-10-10 11:28 <REP> d-------- C:\Program Files\Apple Software Update
          2008-10-09 19:49 . 2008-10-09 19:49 <REP> d-------- C:\Program Files\Conjugaison
          2008-10-09 19:24 . 2008-10-29 08:32 <REP> d-------- C:\Users\vero\AppData\Roaming\F-Secure
          2008-10-09 18:26 . 2008-10-09 18:26 <REP> d-------- C:\Users\All Users\TomTom
          2008-10-09 18:26 . 2008-10-09 18:26 <REP> d-------- C:\ProgramData\TomTom
          2008-10-09 18:26 . 2008-10-30 09:53 <REP> d-------- C:\Program Files\TomTom HOME
          2008-10-09 18:25 . 2008-10-09 18:25 <REP> d-------- C:\Users\vero\AppData\Roaming\TomTom
          2008-10-09 18:25 . 2008-10-09 18:25 <REP> d-------- C:\Users\vero\AppData\Roaming\InstallShield
          2008-10-09 18:24 . 2008-10-09 18:24 <REP> d-------- C:\Program Files\TomTom HOME 2
          2008-10-09 18:23 . 2008-10-09 18:23 <REP> d-------- C:\Program Files\TomTom DesktopSuite
          2008-10-08 12:24 . 2008-10-08 12:24 <REP> d-------- C:\Users\Anne-laure\AppData\Roaming\InstallShield
          2008-10-08 11:24 . 2008-10-08 11:24 <REP> d-------- C:\Users\vero\AppData\Roaming\Apple Computer
          2008-10-07 02:10 . 2008-07-16 02:32 2,048 --a------ C:\WINDOWS\System32\tzres.dll
          2008-10-06 16:35 . 2008-10-29 10:49 <REP> d-------- C:\Users\Anne-laure\AppData\Roaming\F-Secure
          2008-10-06 16:25 . 2008-04-23 17:15 572,512 --a------ C:\WINDOWS\System32\msvcp50.dll
          2008-10-06 16:25 . 2008-10-29 10:36 60,064 --a------ C:\WINDOWS\System32\drivers\fsdfw.sys
          2008-10-06 16:25 . 2008-04-23 17:11 34,752 --a------ C:\WINDOWS\System32\drivers\fses.sys
          2008-10-06 16:24 . 2008-10-06 16:24 <REP> d-------- C:\Users\All Users\F-Secure
          2008-10-06 16:24 . 2008-10-06 16:24 <REP> d-------- C:\ProgramData\F-Secure
          2008-10-06 16:22 . 2008-10-06 16:22 <REP> d-------- C:\Program Files\Orange
          2008-10-06 16:18 . 2008-10-14 09:04 <REP> d-------- C:\Users\All Users\fssg
          2008-10-06 16:18 . 2008-10-14 09:04 <REP> d-------- C:\ProgramData\fssg
          2008-10-06 15:08 . 2008-06-26 02:45 12,240,896 --a------ C:\WINDOWS\System32\NlsLexicons0007.dll
          2008-10-06 15:08 . 2008-06-26 02:45 2,644,480 --a------ C:\WINDOWS\System32\NlsLexicons0009.dll
          2008-10-06 15:07 . 2008-06-26 04:29 801,280 --a------ C:\WINDOWS\System32\NaturalLanguage6.dll
          2008-10-06 15:05 . 2008-07-31 02:13 4,240,384 --a------ C:\WINDOWS\System32\GameUXLegacyGDFs.dll
          2008-10-06 15:05 . 2008-04-26 09:26 891,448 --a------ C:\WINDOWS\System32\drivers\tcpip.sys
          2008-10-06 15:05 . 2008-04-12 04:32 784,896 --a------ C:\WINDOWS\System32\rpcrt4.dll
          2008-10-06 15:05 . 2008-06-19 04:31 361,984 --a------ C:\WINDOWS\System32\IPSECSVC.DLL
          2008-10-06 15:05 . 2008-04-05 02:21 72,192 --a------ C:\WINDOWS\System32\drivers\pacer.sys
          2008-10-06 15:05 . 2008-07-31 04:32 28,160 --a------ C:\WINDOWS\System32\Apphlpdm.dll
          2008-10-06 15:05 . 2008-04-05 04:34 15,360 --a------ C:\WINDOWS\System32\pacerprf.dll
          2008-10-06 14:41 . 2008-07-19 06:09 1,811,656 --a------ C:\WINDOWS\System32\wuaueng.dll
          2008-10-06 14:41 . 2008-07-19 04:44 1,524,736 --a------ C:\WINDOWS\System32\wucltux.dll
          2008-10-06 14:41 . 2008-07-19 06:09 563,912 --a------ C:\WINDOWS\System32\wuapi.dll
          2008-10-06 14:41 . 2008-07-19 04:44 83,456 --a------ C:\WINDOWS\System32\wudriver.dll
          2008-10-06 14:41 . 2008-07-19 06:10 53,448 --a------ C:\WINDOWS\System32\wuauclt.exe
          2008-10-06 14:41 . 2008-07-19 06:10 45,768 --a------ C:\WINDOWS\System32\wups2.dll
          2008-10-06 14:41 . 2008-07-19 06:10 36,552 --a------ C:\WINDOWS\System32\wups.dll
          2008-10-06 14:40 . 2008-07-18 21:08 163,904 --a------ C:\WINDOWS\System32\wuwebv.dll
          2008-10-06 14:40 . 2008-07-18 19:44 31,232 --a------ C:\WINDOWS\System32\wuapp.exe
          2008-10-06 14:24 . 2008-10-06 14:24 <REP> d-------- C:\Program Files\Securitoo
          2008-10-06 14:24 . 2006-11-28 19:46 28,224 --a------ C:\WINDOWS\System32\drivers\PCAMp50.sys
          2008-10-06 14:24 . 2006-11-28 19:46 27,072 --a------ C:\WINDOWS\System32\drivers\PCASp50.sys
          2008-10-06 14:22 . 2008-10-06 14:49 <REP> d-------- C:\Program Files\OrangeHSS
          2008-10-06 14:22 . 2007-12-11 19:22 65,536 --a------ C:\WINDOWS\System32\Autodial2000.dll

          .
          (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
          .
          2008-10-30 08:58 1,310,720 --sha-w C:\Users\Véronique\NTUSER.DAT
          2008-10-30 08:58 1,310,720 --sha-w C:\Users\Véronique\NTUSER.DAT
          2008-10-30 08:58 1,310,720 --sha-w C:\Users\Invité\NTUSER.DAT
          2008-10-30 08:58 1,310,720 --sha-w C:\Users\Invité\NTUSER.DAT
          2008-10-29 09:59 --------- d--h--w C:\Program Files\InstallShield Installation Information
          2008-10-26 09:38 --------- d-----w C:\Program Files\Hamachi
          2008-10-23 19:36 --------- d-----w C:\Program Files\Common Files\InstallShield
          2008-10-20 10:28 --------- d-----w C:\Program Files\Windows Live
          2008-10-16 01:13 --------- d-----w C:\Program Files\Windows Mail
          2008-10-16 01:04 --------- d-----w C:\ProgramData\Microsoft Help
          2008-10-12 19:24 --------- d-----w C:\Program Files\LimeWire
          2008-10-11 20:50 --------- d-----w C:\ProgramData\WLInstaller
          2008-10-10 10:36 --------- d-----w C:\Program Files\QuickTime
          2008-10-10 10:35 --------- d-----w C:\Program Files\Common Files\Apple
          2008-10-08 11:31 --------- d-----w C:\Program Files\FinePixViewer
          2008-10-08 11:27 --------- d-----w C:\Users\Anne-laure\AppData\Roaming\FUJIFILM
          2008-10-08 11:23 --------- d-----w C:\Users\Véronique\AppData\Roaming\FUJIFILM
          2008-08-29 08:18 87,336 ----a-w C:\Windows\System32\dns-sd.exe
          2008-08-29 07:53 61,440 ----a-w C:\Windows\System32\dnssd.dll
          2008-08-02 03:26 36,864 ----a-w C:\Windows\System32\cdd.dll
          2008-07-31 03:32 460,288 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
          2008-07-31 03:32 2,154,496 ----a-w C:\Windows\AppPatch\AcGenral.dll
          2008-07-31 03:32 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
          2008-06-20 17:38 1,435,224 ----a-w C:\Users\nanou\TMPGEnc-2.524.63.181-Free.zip
          2008-06-20 17:05 1,665,325 ----a-w C:\Users\nanou\agfreesetup.exe
          2008-06-20 16:31 1,579,972 ----a-w C:\Users\nanou\dvdaudioextractor.exe
          2008-06-10 19:38 20,019 ----a-w C:\Users\nanou\unfreez.zip
          2008-05-31 19:45 3,115,008 ----a-w C:\Users\nanou\AudioVideo_To_Exe(English).exe
          2008-05-28 09:46 47,360 ----a-w C:\Users\Véronique\AppData\Roaming\pcouffin.sys
          2008-05-26 13:09 605 ----a-w C:\Users\Véronique\.FCMaeUserData.dat
          2008-05-26 13:09 605 ----a-w C:\Users\Véronique\.FCMaeUserData.dat
          2008-04-28 01:45 174 --sha-w C:\Program Files\desktop.ini
          2008-04-27 07:45 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
          2008-04-27 07:45 32,768 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
          2008-04-27 07:45 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
          .

          ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
          .
          .
          *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
          REGEDIT4

          [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
          "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
          "msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
          "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 2156368]
          "WindowsWelcomeCenter"="oobefldr.dll" [2008-01-19 C:\WINDOWS\System32\oobefldr.dll]

          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
          "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
          "au"="C:\Program Files\Dealio\DealioAU.exe" [2008-04-16 591200]
          "ORAHSSSessionManager"="C:\Program Files\OrangeHSS\SessionManager\SessionManager.exe" [2007-12-12 107248]
          "F-Secure Manager"="C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE" [2008-04-23 182936]
          "F-Secure TNB"="C:\Program Files\Orange\AntivirusFirewall\FSGUI\TNBUtil.exe" [2008-04-23 744032]
          "TomTomHOME.exe"="C:\Program Files\TomTom HOME\TomTomHOME.exe" [2007-03-14 3770024]
          "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-09-06 413696]
          "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-10-01 289576]
          "PCDAS"="C:\Program Files\Defenza\pcd-as.exe" [2006-12-15 1359872]

          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
          "Launcher"="C:\Windows\SMINST\launcher.exe" [2007-03-07 44168]

          C:\Users\Anne-laure\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
          Outil de notification Live Search.lnk - C:\Users\Anne-laure\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe [2008-10-20 143360]

          C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
          ExifLauncher2.lnk - C:\Program Files\FinePixViewer\QuickDCF2.exe [2008-06-15 303104]

          [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
          "EnableLUA"= 0 (0x0)
          "EnableUIADesktopToggle"= 0 (0x0)

          [HKEY_LOCAL_MACHINE\software\microsoft\security center]
          "UacDisableNotify"=dword:00000001
          "InternetSettingsDisableNotify"=dword:00000001
          "AutoUpdateDisableNotify"=dword:00000001

          [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
          "DisableMonitoring"=dword:00000001

          [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
          "DisableMonitoring"=dword:00000001

          [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
          "DisableMonitoring"=dword:00000001

          [HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
          "EnableFirewall"= 0 (0x0)

          [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
          "{2BF1B30A-E70B-40C0-A49B-E32E0357E594}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
          "{5DE2C203-A710-4888-A4A0-B03BC6F9F7EE}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
          "{AB26A2BA-3E21-4EDC-BA86-74252A1E9B60}"= UDP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
          "{0F718442-4349-481B-B9BE-0434243B45CC}"= TCP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
          "{2584FB02-825A-4197-BCA8-5DEFEA1D7FC3}"= UDP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
          "{7D89EE86-9CF5-4C71-B679-C896786B9327}"= TCP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
          "{23CCE833-C21A-4284-942A-1E2BDC544952}"= UDP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
          "{158F0404-1BBA-48A7-B105-4CFF6C637FA8}"= TCP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
          "TCP Query User{E4240EF3-695C-4EAC-834B-580750BF9B6A}C:\\program files\\emule\\emule.exe"= UDP:C:\program files\emule\emule.exe:eMule
          "UDP Query User{BA578043-7B5F-4C14-A5F0-DD1203936051}C:\\program files\\emule\\emule.exe"= TCP:C:\program files\emule\emule.exe:eMule
          "TCP Query User{FB00228A-A7BB-43F6-A5BF-73A7D28205CB}C:\\programdata\\kaspersky lab setup files\\kaspersky internet security 7.0.1.325\\french\\setup.exe"= UDP:C:\programdata\kaspersky lab setup files\kaspersky internet security 7.0.1.325\french\setup.exe:Programme d'installation de Kaspersky Internet Security 7.0
          "UDP Query User{440986FF-83C0-400D-93B1-ECA44E786697}C:\\programdata\\kaspersky lab setup files\\kaspersky internet security 7.0.1.325\\french\\setup.exe"= TCP:C:\programdata\kaspersky lab setup files\kaspersky internet security 7.0.1.325\french\setup.exe:Programme d'installation de Kaspersky Internet Security 7.0
          "TCP Query User{AECC5E9E-BAE8-4888-9F67-6301045DAADA}C:\\program files\\hamachi\\hamachi.exe"= UDP:C:\program files\hamachi\hamachi.exe:Hamachi Client
          "UDP Query User{23AB184E-67A6-4A61-8C12-79AEB04D7169}C:\\program files\\hamachi\\hamachi.exe"= TCP:C:\program files\hamachi\hamachi.exe:Hamachi Client
          "TCP Query User{E3F29125-A2B2-4113-8259-25657DFDBDB6}C:\\program files\\utorrent\\utorrent.exe"= UDP:C:\program files\utorrent\utorrent.exe:uTorrent
          "UDP Query User{9E030592-428F-49C6-A9A2-23D22441CF1A}C:\\program files\\utorrent\\utorrent.exe"= TCP:C:\program files\utorrent\utorrent.exe:uTorrent
          "{63C96D9E-C7A9-44CE-88BE-0C515539437C}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
          "{2192EAE9-5368-4EE8-8CD3-9C66A8912293}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
          "{6D454281-F9A4-42A7-86FC-C5AE502DEEBA}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
          "{A03C0C98-1D14-4B69-8834-7AF18EE7CBC7}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
          "{AD2F44F6-5754-4B64-A8A8-4F6C6A2FA4BF}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
          "{112DB924-3F00-438F-ACB8-1C1D58D9EBA6}"= UDP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
          "{48480C3F-4276-4B3B-9D8B-488BD0F40DEA}"= TCP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire

          [HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
          "EnableFirewall"= 0 (0x0)

          [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
          "EnableFirewall"= 0 (0x0)

          [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
          "C:\\Program Files\\OrangeHSS\\Connectivity\\ConnectivityManager.exe"= C:\Program Files\OrangeHSS\Connectivity\ConnectivityManager.exe:*:enabled:CSS

          R1 F-Secure HIPS;F-Secure HIPS;C:\Program Files\Orange\AntivirusFirewall\HIPS\fshs.sys [2008-10-29 41184]
          R1 FSES;F-Secure Email Scanning Driver;C:\Windows\system32\drivers\fses.sys [2008-04-23 34752]
          R1 FSFW;F-Secure Firewall Driver;C:\Windows\system32\drivers\fsdfw.sys [2008-10-29 60064]
          R1 fsvista;F-Secure Vista Support Driver;C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\minifilter\fsvista.sys [2008-04-23 12896]
          R3 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\minifilter\fsgk.sys [2008-04-23 62048]
          S3 Brndis;External USB Cable Modem;C:\Windows\system32\DRIVERS\Brndis.sys [2004-02-06 16512]
          S3 PCAMp50;PCAMp50 NDIS Protocol Driver;C:\Windows\system32\Drivers\PCAMp50.sys [2006-11-28 28224]
          S3 PCASp50;PCASp50 NDIS Protocol Driver;C:\Windows\system32\Drivers\PCASp50.sys [2006-11-28 27072]
          S4 F-Secure Filter;F-Secure File System Filter;C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\Win2K\FSfilter.sys [2008-04-23 39776]
          S4 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\Win2K\FSrec.sys [2008-04-23 25184]

          [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6f5f6184-012e-11dd-8acc-806e6f6e6963}]
          \shell\AutoRun\command - E:\EPSETUP.EXE

          [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{990fee76-9538-11dd-9d90-001bb97e2318}]
          \shell\AutoRun\command - J:\InstallTomTomHOME.exe

          [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e9f1fc82-990f-11dd-bed9-001bb97e2318}]
          \shell\AutoRun\command - K:\start.exe

          *Newly Created Service* - CATCHME
          *Newly Created Service* - PROCEXP90
          .
          Contenu du dossier 'Tâches planifiées'

          2008-10-30 C:\Windows\Tasks\User_Feed_Synchronization-{2D2B0467-6BFE-4217-82E0-E7D63BCEFB92}.job
          - C:\Windows\system32\msfeedssync.exe [2008-01-19 08:33]

          2008-10-30 C:\Windows\Tasks\User_Feed_Synchronization-{A3BD8618-9E38-4205-94E6-90329DCC055B}.job
          - C:\Windows\system32\msfeedssync.exe [2008-01-19 08:33]
          .
          - - - - ORPHELINS SUPPRIMES - - - -

          WebBrowser-{21FA44EF-376D-4D53-9B0F-8A89D3229068} - (no file)

          .
          ------- Examen supplémentaire -------
          .
          FireFox -: Profile - C:\Users\Anne-laure\AppData\Roaming\Mozilla\Firefox\Profiles\leichzot.default\
          FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
          FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.msn.fr/
          .

          **************************************************************************

          catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
          Rootkit scan 2008-10-30 10:04:59
          Windows 6.0.6001 Service Pack 1 NTFS

          Recherche de processus cachés ...

          Recherche d'éléments en démarrage automatique cachés ...

          Recherche de fichiers cachés ...

          Scan terminé avec succès
          Fichiers cachés: 0
          1. Help-me-=) Auteur
            Voilà J'ai fais Exactement Se Que Vous Avez Dit , J'éspere que ça à marcher , voilà le rapport :

            ComboFix 08-10-30.04 - Anne-laure 2008-10-30 9:58:32.1 - NTFSx86
            Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.1222 [GMT 1:00]
            Lancé depuis: C:\Users\Anne-laure\Desktop\ComboFix.exe
            .

            (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
            .

            C:\Program Files\FBrowserAdvisor
            C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PlayMP3z
            C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PlayMP3z\Run PlayMP3z.lnk
            C:\Users\Véronique\AppData\Roaming\inst.exe

            .
            ((((((((((((((((((((((((((((( Fichiers créés du 2008-09-28 au 2008-10-30 ))))))))))))))))))))))))))))))))))))
            .

            2008-10-29 20:37 . 2008-10-29 20:37 401,720 --a------ C:\Users\Anne-laure\HiJackThis.exe
            2008-10-29 19:52 . 2008-10-29 19:52 <REP> d-------- C:\Program Files\Trend Micro
            2008-10-29 18:04 . 2008-10-29 18:04 <REP> d-------- C:\VundoFix Backups
            2008-10-29 15:48 . 2008-10-29 15:55 <REP> d-------- C:\Users\Anne-laure\DoctorWeb
            2008-10-29 13:09 . 2008-10-29 13:51 <REP> d-------- C:\Users\All Users\Spybot - Search & Destroy
            2008-10-29 13:09 . 2008-10-29 13:51 <REP> d-------- C:\ProgramData\Spybot - Search & Destroy
            2008-10-29 13:09 . 2008-10-29 13:22 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
            2008-10-29 11:00 . 2008-10-29 11:00 <REP> d-------- C:\Program Files\Defenza
            2008-10-29 11:00 . 1996-08-20 20:37 15,840 --a------ C:\WINDOWS\System32\Machnm1.exe
            2008-10-29 11:00 . 2005-09-25 16:37 5,632 --a------ C:\WINDOWS\System32\Machnm64.sys
            2008-10-29 11:00 . 2008-10-29 11:00 3,120 --a------ C:\WINDOWS\System32\118290.54
            2008-10-29 11:00 . 2008-10-29 11:00 3,120 --a------ C:\WINDOWS\118294.78
            2008-10-29 11:00 . 2003-08-13 00:27 2,304 --a------ C:\WINDOWS\System32\Machnm32.sys
            2008-10-29 08:38 . 2008-08-12 04:39 443,392 --a------ C:\WINDOWS\System32\win32spl.dll
            2008-10-29 08:38 . 2008-09-18 05:56 147,456 --a------ C:\WINDOWS\System32\Faultrep.dll
            2008-10-29 08:38 . 2008-09-18 05:56 125,952 --a------ C:\WINDOWS\System32\wersvc.dll
            2008-10-28 09:31 . 2008-10-28 09:32 <REP> d-------- C:\Program Files\Photo Story 3 for Windows
            2008-10-26 19:53 . 2008-10-28 20:35 <REP> d-------- C:\Program Files\Messenger Plus! Live
            2008-10-26 10:28 . 2008-10-26 10:28 <REP> d-------- C:\Program Files\The Cleaner Demo
            2008-10-26 10:12 . 2008-10-26 10:57 <REP> d-------- C:\Program Files\Trojan Remover
            2008-10-23 20:34 . 2008-10-23 20:34 <REP> d-------- C:\Users\All Users\UDL
            2008-10-23 20:34 . 2008-10-23 20:34 <REP> d-------- C:\ProgramData\UDL
            2008-10-23 20:24 . 2006-12-08 03:04 76,800 --a------ C:\WINDOWS\System32\E_FLBBZE.DLL
            2008-10-23 20:24 . 2006-04-19 03:00 62,976 --a------ C:\WINDOWS\System32\E_FD4BBZE.DLL
            2008-10-23 20:24 . 2004-09-10 21:12 49,152 --a------ C:\WINDOWS\System32\E_DCINST.DLL
            2008-10-23 20:23 . 2008-10-23 20:29 <REP> d-------- C:\Users\All Users\EPSON
            2008-10-23 20:23 . 2008-10-23 20:29 <REP> d-------- C:\ProgramData\EPSON
            2008-10-23 20:23 . 2008-10-23 20:32 <REP> d-------- C:\Program Files\EPSON
            2008-10-23 20:22 . 2008-10-23 20:22 25 --a------ C:\WINDOWS\CDED92Euro.ini
            2008-10-23 07:55 . 2008-08-05 10:49 428,544 --a------ C:\WINDOWS\System32\EncDec.dll
            2008-10-23 07:55 . 2008-08-05 10:49 293,376 --a------ C:\WINDOWS\System32\psisdecd.dll
            2008-10-23 07:55 . 2008-08-05 10:48 217,088 --a------ C:\WINDOWS\System32\psisrndr.ax
            2008-10-23 07:55 . 2008-08-05 10:48 177,664 --a------ C:\WINDOWS\System32\mpg2splt.ax
            2008-10-23 07:55 . 2008-08-05 10:48 80,896 --a------ C:\WINDOWS\System32\MSNP.ax
            2008-10-18 19:12 . 2008-10-26 10:23 <REP> d-------- C:\Users\Anne-laure\AppData\Roaming\Hamachi
            2008-10-18 19:11 . 2008-10-18 19:11 25,280 --a------ C:\WINDOWS\System32\drivers\hamachi.sys
            2008-10-18 17:10 . 2008-10-18 17:55 <REP> d-------- C:\Program Files\Dofus
            2008-10-15 10:11 . 2008-10-15 10:11 <REP> d-------- C:\Users\Anne-laure\AppData\Roaming\Media Player Classic
            2008-10-15 07:40 . 2008-09-18 06:09 3,601,464 --a------ C:\WINDOWS\System32\ntkrnlpa.exe
            2008-10-15 07:40 . 2008-09-18 06:09 3,549,240 --a------ C:\WINDOWS\System32\ntoskrnl.exe
            2008-10-15 07:40 . 2008-09-18 03:16 2,032,640 --a------ C:\WINDOWS\System32\win32k.sys
            2008-10-15 07:40 . 2008-10-02 04:49 827,392 --a------ C:\WINDOWS\System32\wininet.dll
            2008-10-15 07:40 . 2008-09-03 04:59 468,992 --a------ C:\WINDOWS\System32\newdev.dll
            2008-10-15 07:40 . 2008-08-27 02:06 288,768 --a------ C:\WINDOWS\System32\drivers\srv.sys
            2008-10-15 07:40 . 2008-09-03 04:58 74,752 --a------ C:\WINDOWS\System32\newdev.exe
            2008-10-15 07:39 . 2008-10-02 02:32 1,383,424 --a------ C:\WINDOWS\System32\mshtml.tlb
            2008-10-14 18:21 . 2008-10-14 18:21 <REP> d-------- C:\Program Files\Audacity
            2008-10-14 18:16 . 2008-10-14 18:16 <REP> d-------- C:\Program Files\Common Files\DVDVIDEOSOFT
            2008-10-14 18:16 . 2002-01-05 14:37 344,064 --a------ C:\WINDOWS\System32\msvcr70.dll
            2008-10-14 17:42 . 2008-03-21 21:30 3,596,288 --a------ C:\WINDOWS\System32\qt-dx331.dll
            2008-10-14 17:42 . 2008-01-10 13:15 755,027 --a------ C:\WINDOWS\System32\xvidcore.dll
            2008-10-14 17:42 . 2008-03-31 22:25 682,496 --a------ C:\WINDOWS\System32\divx.dll
            2008-10-14 17:42 . 2006-09-24 16:11 389,120 --a------ C:\WINDOWS\System32\lameACM.acm
            2008-10-14 17:42 . 2004-01-25 17:18 217,088 --a------ C:\WINDOWS\System32\yv12vfw.dll
            2008-10-14 17:42 . 2007-09-04 17:56 164,352 --a------ C:\WINDOWS\System32\unrar.dll
            2008-10-14 17:42 . 2008-01-10 13:16 159,839 --a------ C:\WINDOWS\System32\xvidvfw.dll
            2008-10-14 17:42 . 2007-09-21 01:52 118,784 --a------ C:\WINDOWS\System32\ac3acm.acm
            2008-10-14 17:42 . 2008-03-21 21:28 81,920 --a------ C:\WINDOWS\System32\dpl100.dll
            2008-10-14 17:42 . 2007-10-03 16:03 414 --a------ C:\WINDOWS\System32\lame_acm.xml
            2008-10-14 17:41 . 2008-10-14 17:42 <REP> d-------- C:\Program Files\K-Lite Codec Pack
            2008-10-14 17:41 . 2008-03-28 18:41 7,680 --a------ C:\WINDOWS\System32\ff_vfw.dll
            2008-10-14 17:41 . 2007-07-10 17:10 547 --a------ C:\WINDOWS\System32\ff_vfw.dll.manifest
            2008-10-12 20:24 . 2008-10-28 13:14 <REP> d-------- C:\Users\Anne-laure\AppData\Roaming\LimeWire
            2008-10-11 21:56 . 2008-10-26 10:48 <REP> d-------- C:\Program Files\Windows Live Toolbar
            2008-10-11 21:56 . 2008-10-11 21:56 <REP> d-------- C:\Program Files\Microsoft SQL Server Compact Edition
            2008-10-11 21:20 . 2006-11-29 12:06 3,426,072 --a------ C:\WINDOWS\System32\d3dx9_32.dll
            2008-10-11 21:17 . 2008-06-26 04:21 712,704 --a------ C:\WINDOWS\System32\WindowsCodecs.dll
            2008-10-11 21:17 . 2008-06-26 04:21 347,648 --a------ C:\WINDOWS\System32\WindowsCodecsExt.dll
            2008-10-11 21:14 . 2008-10-11 21:14 <REP> d-------- C:\Program Files\Microsoft
            2008-10-11 21:10 . 2008-10-11 21:10 <REP> d-------- C:\Program Files\Common Files\Windows Live
            2008-10-11 21:07 . 2008-10-23 20:44 <REP> d-------- C:\Program Files\Microsoft Silverlight
            2008-10-11 17:17 . 2008-10-11 17:19 <REP> d-------- C:\Users\Anne-laure\AppData\Roaming\SecondLife
            2008-10-10 11:38 . 2008-04-17 12:12 107,368 --a------ C:\WINDOWS\System32\GEARAspi.dll
            2008-10-10 11:38 . 2008-04-17 12:12 15,464 --a------ C:\WINDOWS\System32\drivers\GEARAspiWDM.sys
            2008-10-10 11:37 . 2008-10-10 11:38 <REP> d-------- C:\Users\All Users\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
            2008-10-10 11:37 . 2008-10-10 11:38 <REP> d-------- C:\ProgramData\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
            2008-10-10 11:37 . 2008-10-10 11:38 <REP> d-------- C:\Program Files\iTunes
            2008-10-10 11:37 . 2008-10-10 11:37 <REP> d-------- C:\Program Files\iPod
            2008-10-10 11:36 . 2008-10-10 11:36 <REP> d-------- C:\Program Files\Bonjour
            2008-10-10 11:28 . 2008-10-10 11:28 <REP> d-------- C:\Program Files\Apple Software Update
            2008-10-09 19:49 . 2008-10-09 19:49 <REP> d-------- C:\Program Files\Conjugaison
            2008-10-09 19:24 . 2008-10-29 08:32 <REP> d-------- C:\Users\vero\AppData\Roaming\F-Secure
            2008-10-09 18:26 . 2008-10-09 18:26 <REP> d-------- C:\Users\All Users\TomTom
            2008-10-09 18:26 . 2008-10-09 18:26 <REP> d-------- C:\ProgramData\TomTom
            2008-10-09 18:26 . 2008-10-30 09:53 <REP> d-------- C:\Program Files\TomTom HOME
            2008-10-09 18:25 . 2008-10-09 18:25 <REP> d-------- C:\Users\vero\AppData\Roaming\TomTom
            2008-10-09 18:25 . 2008-10-09 18:25 <REP> d-------- C:\Users\vero\AppData\Roaming\InstallShield
            2008-10-09 18:24 . 2008-10-09 18:24 <REP> d-------- C:\Program Files\TomTom HOME 2
            2008-10-09 18:23 . 2008-10-09 18:23 <REP> d-------- C:\Program Files\TomTom DesktopSuite
            2008-10-08 12:24 . 2008-10-08 12:24 <REP> d-------- C:\Users\Anne-laure\AppData\Roaming\InstallShield
            2008-10-08 11:24 . 2008-10-08 11:24 <REP> d-------- C:\Users\vero\AppData\Roaming\Apple Computer
            2008-10-07 02:10 . 2008-07-16 02:32 2,048 --a------ C:\WINDOWS\System32\tzres.dll
            2008-10-06 16:35 . 2008-10-29 10:49 <REP> d-------- C:\Users\Anne-laure\AppData\Roaming\F-Secure
            2008-10-06 16:25 . 2008-04-23 17:15 572,512 --a------ C:\WINDOWS\System32\msvcp50.dll
            2008-10-06 16:25 . 2008-10-29 10:36 60,064 --a------ C:\WINDOWS\System32\drivers\fsdfw.sys
            2008-10-06 16:25 . 2008-04-23 17:11 34,752 --a------ C:\WINDOWS\System32\drivers\fses.sys
            2008-10-06 16:24 . 2008-10-06 16:24 <REP> d-------- C:\Users\All Users\F-Secure
            2008-10-06 16:24 . 2008-10-06 16:24 <REP> d-------- C:\ProgramData\F-Secure
            2008-10-06 16:22 . 2008-10-06 16:22 <REP> d-------- C:\Program Files\Orange
            2008-10-06 16:18 . 2008-10-14 09:04 <REP> d-------- C:\Users\All Users\fssg
            2008-10-06 16:18 . 2008-10-14 09:04 <REP> d-------- C:\ProgramData\fssg
            2008-10-06 15:08 . 2008-06-26 02:45 12,240,896 --a------ C:\WINDOWS\System32\NlsLexicons0007.dll
            2008-10-06 15:08 . 2008-06-26 02:45 2,644,480 --a------ C:\WINDOWS\System32\NlsLexicons0009.dll
            2008-10-06 15:07 . 2008-06-26 04:29 801,280 --a------ C:\WINDOWS\System32\NaturalLanguage6.dll
            2008-10-06 15:05 . 2008-07-31 02:13 4,240,384 --a------ C:\WINDOWS\System32\GameUXLegacyGDFs.dll
            2008-10-06 15:05 . 2008-04-26 09:26 891,448 --a------ C:\WINDOWS\System32\drivers\tcpip.sys
            2008-10-06 15:05 . 2008-04-12 04:32 784,896 --a------ C:\WINDOWS\System32\rpcrt4.dll
            2008-10-06 15:05 . 2008-06-19 04:31 361,984 --a------ C:\WINDOWS\System32\IPSECSVC.DLL
            2008-10-06 15:05 . 2008-04-05 02:21 72,192 --a------ C:\WINDOWS\System32\drivers\pacer.sys
            2008-10-06 15:05 . 2008-07-31 04:32 28,160 --a------ C:\WINDOWS\System32\Apphlpdm.dll
            2008-10-06 15:05 . 2008-04-05 04:34 15,360 --a------ C:\WINDOWS\System32\pacerprf.dll
            2008-10-06 14:41 . 2008-07-19 06:09 1,811,656 --a------ C:\WINDOWS\System32\wuaueng.dll
            2008-10-06 14:41 . 2008-07-19 04:44 1,524,736 --a------ C:\WINDOWS\System32\wucltux.dll
            2008-10-06 14:41 . 2008-07-19 06:09 563,912 --a------ C:\WINDOWS\System32\wuapi.dll
            2008-10-06 14:41 . 2008-07-19 04:44 83,456 --a------ C:\WINDOWS\System32\wudriver.dll
            2008-10-06 14:41 . 2008-07-19 06:10 53,448 --a------ C:\WINDOWS\System32\wuauclt.exe
            2008-10-06 14:41 . 2008-07-19 06:10 45,768 --a------ C:\WINDOWS\System32\wups2.dll
            2008-10-06 14:41 . 2008-07-19 06:10 36,552 --a------ C:\WINDOWS\System32\wups.dll
            2008-10-06 14:40 . 2008-07-18 21:08 163,904 --a------ C:\WINDOWS\System32\wuwebv.dll
            2008-10-06 14:40 . 2008-07-18 19:44 31,232 --a------ C:\WINDOWS\System32\wuapp.exe
            2008-10-06 14:24 . 2008-10-06 14:24 <REP> d-------- C:\Program Files\Securitoo
            2008-10-06 14:24 . 2006-11-28 19:46 28,224 --a------ C:\WINDOWS\System32\drivers\PCAMp50.sys
            2008-10-06 14:24 . 2006-11-28 19:46 27,072 --a------ C:\WINDOWS\System32\drivers\PCASp50.sys
            2008-10-06 14:22 . 2008-10-06 14:49 <REP> d-------- C:\Program Files\OrangeHSS
            2008-10-06 14:22 . 2007-12-11 19:22 65,536 --a------ C:\WINDOWS\System32\Autodial2000.dll

            .
            (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
            .
            2008-10-30 08:58 1,310,720 --sha-w C:\Users\Véronique\NTUSER.DAT
            2008-10-30 08:58 1,310,720 --sha-w C:\Users\Véronique\NTUSER.DAT
            2008-10-30 08:58 1,310,720 --sha-w C:\Users\Invité\NTUSER.DAT
            2008-10-30 08:58 1,310,720 --sha-w C:\Users\Invité\NTUSER.DAT
            2008-10-29 09:59 --------- d--h--w C:\Program Files\InstallShield Installation Information
            2008-10-26 09:38 --------- d-----w C:\Program Files\Hamachi
            2008-10-23 19:36 --------- d-----w C:\Program Files\Common Files\InstallShield
            2008-10-20 10:28 --------- d-----w C:\Program Files\Windows Live
            2008-10-16 01:13 --------- d-----w C:\Program Files\Windows Mail
            2008-10-16 01:04 --------- d-----w C:\ProgramData\Microsoft Help
            2008-10-12 19:24 --------- d-----w C:\Program Files\LimeWire
            2008-10-11 20:50 --------- d-----w C:\ProgramData\WLInstaller
            2008-10-10 10:36 --------- d-----w C:\Program Files\QuickTime
            2008-10-10 10:35 --------- d-----w C:\Program Files\Common Files\Apple
            2008-10-08 11:31 --------- d-----w C:\Program Files\FinePixViewer
            2008-10-08 11:27 --------- d-----w C:\Users\Anne-laure\AppData\Roaming\FUJIFILM
            2008-10-08 11:23 --------- d-----w C:\Users\Véronique\AppData\Roaming\FUJIFILM
            2008-08-29 08:18 87,336 ----a-w C:\Windows\System32\dns-sd.exe
            2008-08-29 07:53 61,440 ----a-w C:\Windows\System32\dnssd.dll
            2008-08-02 03:26 36,864 ----a-w C:\Windows\System32\cdd.dll
            2008-07-31 03:32 460,288 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
            2008-07-31 03:32 2,154,496 ----a-w C:\Windows\AppPatch\AcGenral.dll
            2008-07-31 03:32 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
            2008-06-20 17:38 1,435,224 ----a-w C:\Users\nanou\TMPGEnc-2.524.63.181-Free.zip
            2008-06-20 17:05 1,665,325 ----a-w C:\Users\nanou\agfreesetup.exe
            2008-06-20 16:31 1,579,972 ----a-w C:\Users\nanou\dvdaudioextractor.exe
            2008-06-10 19:38 20,019 ----a-w C:\Users\nanou\unfreez.zip
            2008-05-31 19:45 3,115,008 ----a-w C:\Users\nanou\AudioVideo_To_Exe(English).exe
            2008-05-28 09:46 47,360 ----a-w C:\Users\Véronique\AppData\Roaming\pcouffin.sys
            2008-05-26 13:09 605 ----a-w C:\Users\Véronique\.FCMaeUserData.dat
            2008-05-26 13:09 605 ----a-w C:\Users\Véronique\.FCMaeUserData.dat
            2008-04-28 01:45 174 --sha-w C:\Program Files\desktop.ini
            2008-04-27 07:45 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
            2008-04-27 07:45 32,768 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
            2008-04-27 07:45 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
            .

            ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
            .
            .
            *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
            REGEDIT4

            [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
            "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
            "msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
            "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 2156368]
            "WindowsWelcomeCenter"="oobefldr.dll" [2008-01-19 C:\WINDOWS\System32\oobefldr.dll]

            [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
            "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
            "au"="C:\Program Files\Dealio\DealioAU.exe" [2008-04-16 591200]
            "ORAHSSSessionManager"="C:\Program Files\OrangeHSS\SessionManager\SessionManager.exe" [2007-12-12 107248]
            "F-Secure Manager"="C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE" [2008-04-23 182936]
            "F-Secure TNB"="C:\Program Files\Orange\AntivirusFirewall\FSGUI\TNBUtil.exe" [2008-04-23 744032]
            "TomTomHOME.exe"="C:\Program Files\TomTom HOME\TomTomHOME.exe" [2007-03-14 3770024]
            "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-09-06 413696]
            "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-10-01 289576]
            "PCDAS"="C:\Program Files\Defenza\pcd-as.exe" [2006-12-15 1359872]

            [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
            "Launcher"="C:\Windows\SMINST\launcher.exe" [2007-03-07 44168]

            C:\Users\Anne-laure\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
            Outil de notification Live Search.lnk - C:\Users\Anne-laure\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe [2008-10-20 143360]

            C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
            ExifLauncher2.lnk - C:\Program Files\FinePixViewer\QuickDCF2.exe [2008-06-15 303104]

            [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
            "EnableLUA"= 0 (0x0)
            "EnableUIADesktopToggle"= 0 (0x0)

            [HKEY_LOCAL_MACHINE\software\microsoft\security center]
            "UacDisableNotify"=dword:00000001
            "InternetSettingsDisableNotify"=dword:00000001
            "AutoUpdateDisableNotify"=dword:00000001

            [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
            "DisableMonitoring"=dword:00000001

            [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
            "DisableMonitoring"=dword:00000001

            [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
            "DisableMonitoring"=dword:00000001

            [HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
            "EnableFirewall"= 0 (0x0)

            [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
            "{2BF1B30A-E70B-40C0-A49B-E32E0357E594}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
            "{5DE2C203-A710-4888-A4A0-B03BC6F9F7EE}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
            "{AB26A2BA-3E21-4EDC-BA86-74252A1E9B60}"= UDP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
            "{0F718442-4349-481B-B9BE-0434243B45CC}"= TCP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
            "{2584FB02-825A-4197-BCA8-5DEFEA1D7FC3}"= UDP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
            "{7D89EE86-9CF5-4C71-B679-C896786B9327}"= TCP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
            "{23CCE833-C21A-4284-942A-1E2BDC544952}"= UDP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
            "{158F0404-1BBA-48A7-B105-4CFF6C637FA8}"= TCP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
            "TCP Query User{E4240EF3-695C-4EAC-834B-580750BF9B6A}C:\\program files\\emule\\emule.exe"= UDP:C:\program files\emule\emule.exe:eMule
            "UDP Query User{BA578043-7B5F-4C14-A5F0-DD1203936051}C:\\program files\\emule\\emule.exe"= TCP:C:\program files\emule\emule.exe:eMule
            "TCP Query User{FB00228A-A7BB-43F6-A5BF-73A7D28205CB}C:\\programdata\\kaspersky lab setup files\\kaspersky internet security 7.0.1.325\\french\\setup.exe"= UDP:C:\programdata\kaspersky lab setup files\kaspersky internet security 7.0.1.325\french\setup.exe:Programme d'installation de Kaspersky Internet Security 7.0
            "UDP Query User{440986FF-83C0-400D-93B1-ECA44E786697}C:\\programdata\\kaspersky lab setup files\\kaspersky internet security 7.0.1.325\\french\\setup.exe"= TCP:C:\programdata\kaspersky lab setup files\kaspersky internet security 7.0.1.325\french\setup.exe:Programme d'installation de Kaspersky Internet Security 7.0
            "TCP Query User{AECC5E9E-BAE8-4888-9F67-6301045DAADA}C:\\program files\\hamachi\\hamachi.exe"= UDP:C:\program files\hamachi\hamachi.exe:Hamachi Client
            "UDP Query User{23AB184E-67A6-4A61-8C12-79AEB04D7169}C:\\program files\\hamachi\\hamachi.exe"= TCP:C:\program files\hamachi\hamachi.exe:Hamachi Client
            "TCP Query User{E3F29125-A2B2-4113-8259-25657DFDBDB6}C:\\program files\\utorrent\\utorrent.exe"= UDP:C:\program files\utorrent\utorrent.exe:uTorrent
            "UDP Query User{9E030592-428F-49C6-A9A2-23D22441CF1A}C:\\program files\\utorrent\\utorrent.exe"= TCP:C:\program files\utorrent\utorrent.exe:uTorrent
            "{63C96D9E-C7A9-44CE-88BE-0C515539437C}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
            "{2192EAE9-5368-4EE8-8CD3-9C66A8912293}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
            "{6D454281-F9A4-42A7-86FC-C5AE502DEEBA}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
            "{A03C0C98-1D14-4B69-8834-7AF18EE7CBC7}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
            "{AD2F44F6-5754-4B64-A8A8-4F6C6A2FA4BF}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
            "{112DB924-3F00-438F-ACB8-1C1D58D9EBA6}"= UDP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
            "{48480C3F-4276-4B3B-9D8B-488BD0F40DEA}"= TCP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire

            [HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
            "EnableFirewall"= 0 (0x0)

            [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
            "EnableFirewall"= 0 (0x0)

            [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
            "C:\\Program Files\\OrangeHSS\\Connectivity\\ConnectivityManager.exe"= C:\Program Files\OrangeHSS\Connectivity\ConnectivityManager.exe:*:enabled:CSS

            R1 F-Secure HIPS;F-Secure HIPS;C:\Program Files\Orange\AntivirusFirewall\HIPS\fshs.sys [2008-10-29 41184]
            R1 FSES;F-Secure Email Scanning Driver;C:\Windows\system32\drivers\fses.sys [2008-04-23 34752]
            R1 FSFW;F-Secure Firewall Driver;C:\Windows\system32\drivers\fsdfw.sys [2008-10-29 60064]
            R1 fsvista;F-Secure Vista Support Driver;C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\minifilter\fsvista.sys [2008-04-23 12896]
            R3 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\minifilter\fsgk.sys [2008-04-23 62048]
            S3 Brndis;External USB Cable Modem;C:\Windows\system32\DRIVERS\Brndis.sys [2004-02-06 16512]
            S3 PCAMp50;PCAMp50 NDIS Protocol Driver;C:\Windows\system32\Drivers\PCAMp50.sys [2006-11-28 28224]
            S3 PCASp50;PCASp50 NDIS Protocol Driver;C:\Windows\system32\Drivers\PCASp50.sys [2006-11-28 27072]
            S4 F-Secure Filter;F-Secure File System Filter;C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\Win2K\FSfilter.sys [2008-04-23 39776]
            S4 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\Win2K\FSrec.sys [2008-04-23 25184]

            [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6f5f6184-012e-11dd-8acc-806e6f6e6963}]
            \shell\AutoRun\command - E:\EPSETUP.EXE

            [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{990fee76-9538-11dd-9d90-001bb97e2318}]
            \shell\AutoRun\command - J:\InstallTomTomHOME.exe

            [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e9f1fc82-990f-11dd-bed9-001bb97e2318}]
            \shell\AutoRun\command - K:\start.exe

            *Newly Created Service* - CATCHME
            *Newly Created Service* - PROCEXP90
            .
            Contenu du dossier 'Tâches planifiées'

            2008-10-30 C:\Windows\Tasks\User_Feed_Synchronization-{2D2B0467-6BFE-4217-82E0-E7D63BCEFB92}.job
            - C:\Windows\system32\msfeedssync.exe [2008-01-19 08:33]

            2008-10-30 C:\Windows\Tasks\User_Feed_Synchronization-{A3BD8618-9E38-4205-94E6-90329DCC055B}.job
            - C:\Windows\system32\msfeedssync.exe [2008-01-19 08:33]
            .
            - - - - ORPHELINS SUPPRIMES - - - -

            WebBrowser-{21FA44EF-376D-4D53-9B0F-8A89D3229068} - (no file)

            .
            ------- Examen supplémentaire -------
            .
            FireFox -: Profile - C:\Users\Anne-laure\AppData\Roaming\Mozilla\Firefox\Profiles\leichzot.default\
            FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
            FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.msn.fr/
            .

            **************************************************************************

            catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
            Rootkit scan 2008-10-30 10:04:59
            Windows 6.0.6001 Service Pack 1 NTFS

            Recherche de processus cachés ...

            Recherche d'éléments en démarrage automatique cachés ...

            Recherche de fichiers cachés ...

            Scan terminé avec succès
            Fichiers cachés: 0
            1. Help-me-=) Auteur
              Voilà J'ai fais Exactement Se Que Vous Avez Dit , J'éspere que ça à marcher , voilà le rapport :

              ComboFix 08-10-30.04 - Anne-laure 2008-10-30 9:58:32.1 - NTFSx86
              Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.1222 [GMT 1:00]
              Lancé depuis: C:\Users\Anne-laure\Desktop\ComboFix.exe
              .

              (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
              .

              C:\Program Files\FBrowserAdvisor
              C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PlayMP3z
              C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PlayMP3z\Run PlayMP3z.lnk
              C:\Users\Véronique\AppData\Roaming\inst.exe

              .
              ((((((((((((((((((((((((((((( Fichiers créés du 2008-09-28 au 2008-10-30 ))))))))))))))))))))))))))))))))))))
              .

              2008-10-29 20:37 . 2008-10-29 20:37 401,720 --a------ C:\Users\Anne-laure\HiJackThis.exe
              2008-10-29 19:52 . 2008-10-29 19:52 <REP> d-------- C:\Program Files\Trend Micro
              2008-10-29 18:04 . 2008-10-29 18:04 <REP> d-------- C:\VundoFix Backups
              2008-10-29 15:48 . 2008-10-29 15:55 <REP> d-------- C:\Users\Anne-laure\DoctorWeb
              2008-10-29 13:09 . 2008-10-29 13:51 <REP> d-------- C:\Users\All Users\Spybot - Search & Destroy
              2008-10-29 13:09 . 2008-10-29 13:51 <REP> d-------- C:\ProgramData\Spybot - Search & Destroy
              2008-10-29 13:09 . 2008-10-29 13:22 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
              2008-10-29 11:00 . 2008-10-29 11:00 <REP> d-------- C:\Program Files\Defenza
              2008-10-29 11:00 . 1996-08-20 20:37 15,840 --a------ C:\WINDOWS\System32\Machnm1.exe
              2008-10-29 11:00 . 2005-09-25 16:37 5,632 --a------ C:\WINDOWS\System32\Machnm64.sys
              2008-10-29 11:00 . 2008-10-29 11:00 3,120 --a------ C:\WINDOWS\System32\118290.54
              2008-10-29 11:00 . 2008-10-29 11:00 3,120 --a------ C:\WINDOWS\118294.78
              2008-10-29 11:00 . 2003-08-13 00:27 2,304 --a------ C:\WINDOWS\System32\Machnm32.sys
              2008-10-29 08:38 . 2008-08-12 04:39 443,392 --a------ C:\WINDOWS\System32\win32spl.dll
              2008-10-29 08:38 . 2008-09-18 05:56 147,456 --a------ C:\WINDOWS\System32\Faultrep.dll
              2008-10-29 08:38 . 2008-09-18 05:56 125,952 --a------ C:\WINDOWS\System32\wersvc.dll
              2008-10-28 09:31 . 2008-10-28 09:32 <REP> d-------- C:\Program Files\Photo Story 3 for Windows
              2008-10-26 19:53 . 2008-10-28 20:35 <REP> d-------- C:\Program Files\Messenger Plus! Live
              2008-10-26 10:28 . 2008-10-26 10:28 <REP> d-------- C:\Program Files\The Cleaner Demo
              2008-10-26 10:12 . 2008-10-26 10:57 <REP> d-------- C:\Program Files\Trojan Remover
              2008-10-23 20:34 . 2008-10-23 20:34 <REP> d-------- C:\Users\All Users\UDL
              2008-10-23 20:34 . 2008-10-23 20:34 <REP> d-------- C:\ProgramData\UDL
              2008-10-23 20:24 . 2006-12-08 03:04 76,800 --a------ C:\WINDOWS\System32\E_FLBBZE.DLL
              2008-10-23 20:24 . 2006-04-19 03:00 62,976 --a------ C:\WINDOWS\System32\E_FD4BBZE.DLL
              2008-10-23 20:24 . 2004-09-10 21:12 49,152 --a------ C:\WINDOWS\System32\E_DCINST.DLL
              2008-10-23 20:23 . 2008-10-23 20:29 <REP> d-------- C:\Users\All Users\EPSON
              2008-10-23 20:23 . 2008-10-23 20:29 <REP> d-------- C:\ProgramData\EPSON
              2008-10-23 20:23 . 2008-10-23 20:32 <REP> d-------- C:\Program Files\EPSON
              2008-10-23 20:22 . 2008-10-23 20:22 25 --a------ C:\WINDOWS\CDED92Euro.ini
              2008-10-23 07:55 . 2008-08-05 10:49 428,544 --a------ C:\WINDOWS\System32\EncDec.dll
              2008-10-23 07:55 . 2008-08-05 10:49 293,376 --a------ C:\WINDOWS\System32\psisdecd.dll
              2008-10-23 07:55 . 2008-08-05 10:48 217,088 --a------ C:\WINDOWS\System32\psisrndr.ax
              2008-10-23 07:55 . 2008-08-05 10:48 177,664 --a------ C:\WINDOWS\System32\mpg2splt.ax
              2008-10-23 07:55 . 2008-08-05 10:48 80,896 --a------ C:\WINDOWS\System32\MSNP.ax
              2008-10-18 19:12 . 2008-10-26 10:23 <REP> d-------- C:\Users\Anne-laure\AppData\Roaming\Hamachi
              2008-10-18 19:11 . 2008-10-18 19:11 25,280 --a------ C:\WINDOWS\System32\drivers\hamachi.sys
              2008-10-18 17:10 . 2008-10-18 17:55 <REP> d-------- C:\Program Files\Dofus
              2008-10-15 10:11 . 2008-10-15 10:11 <REP> d-------- C:\Users\Anne-laure\AppData\Roaming\Media Player Classic
              2008-10-15 07:40 . 2008-09-18 06:09 3,601,464 --a------ C:\WINDOWS\System32\ntkrnlpa.exe
              2008-10-15 07:40 . 2008-09-18 06:09 3,549,240 --a------ C:\WINDOWS\System32\ntoskrnl.exe
              2008-10-15 07:40 . 2008-09-18 03:16 2,032,640 --a------ C:\WINDOWS\System32\win32k.sys
              2008-10-15 07:40 . 2008-10-02 04:49 827,392 --a------ C:\WINDOWS\System32\wininet.dll
              2008-10-15 07:40 . 2008-09-03 04:59 468,992 --a------ C:\WINDOWS\System32\newdev.dll
              2008-10-15 07:40 . 2008-08-27 02:06 288,768 --a------ C:\WINDOWS\System32\drivers\srv.sys
              2008-10-15 07:40 . 2008-09-03 04:58 74,752 --a------ C:\WINDOWS\System32\newdev.exe
              2008-10-15 07:39 . 2008-10-02 02:32 1,383,424 --a------ C:\WINDOWS\System32\mshtml.tlb
              2008-10-14 18:21 . 2008-10-14 18:21 <REP> d-------- C:\Program Files\Audacity
              2008-10-14 18:16 . 2008-10-14 18:16 <REP> d-------- C:\Program Files\Common Files\DVDVIDEOSOFT
              2008-10-14 18:16 . 2002-01-05 14:37 344,064 --a------ C:\WINDOWS\System32\msvcr70.dll
              2008-10-14 17:42 . 2008-03-21 21:30 3,596,288 --a------ C:\WINDOWS\System32\qt-dx331.dll
              2008-10-14 17:42 . 2008-01-10 13:15 755,027 --a------ C:\WINDOWS\System32\xvidcore.dll
              2008-10-14 17:42 . 2008-03-31 22:25 682,496 --a------ C:\WINDOWS\System32\divx.dll
              2008-10-14 17:42 . 2006-09-24 16:11 389,120 --a------ C:\WINDOWS\System32\lameACM.acm
              2008-10-14 17:42 . 2004-01-25 17:18 217,088 --a------ C:\WINDOWS\System32\yv12vfw.dll
              2008-10-14 17:42 . 2007-09-04 17:56 164,352 --a------ C:\WINDOWS\System32\unrar.dll
              2008-10-14 17:42 . 2008-01-10 13:16 159,839 --a------ C:\WINDOWS\System32\xvidvfw.dll
              2008-10-14 17:42 . 2007-09-21 01:52 118,784 --a------ C:\WINDOWS\System32\ac3acm.acm
              2008-10-14 17:42 . 2008-03-21 21:28 81,920 --a------ C:\WINDOWS\System32\dpl100.dll
              2008-10-14 17:42 . 2007-10-03 16:03 414 --a------ C:\WINDOWS\System32\lame_acm.xml
              2008-10-14 17:41 . 2008-10-14 17:42 <REP> d-------- C:\Program Files\K-Lite Codec Pack
              2008-10-14 17:41 . 2008-03-28 18:41 7,680 --a------ C:\WINDOWS\System32\ff_vfw.dll
              2008-10-14 17:41 . 2007-07-10 17:10 547 --a------ C:\WINDOWS\System32\ff_vfw.dll.manifest
              2008-10-12 20:24 . 2008-10-28 13:14 <REP> d-------- C:\Users\Anne-laure\AppData\Roaming\LimeWire
              2008-10-11 21:56 . 2008-10-26 10:48 <REP> d-------- C:\Program Files\Windows Live Toolbar
              2008-10-11 21:56 . 2008-10-11 21:56 <REP> d-------- C:\Program Files\Microsoft SQL Server Compact Edition
              2008-10-11 21:20 . 2006-11-29 12:06 3,426,072 --a------ C:\WINDOWS\System32\d3dx9_32.dll
              2008-10-11 21:17 . 2008-06-26 04:21 712,704 --a------ C:\WINDOWS\System32\WindowsCodecs.dll
              2008-10-11 21:17 . 2008-06-26 04:21 347,648 --a------ C:\WINDOWS\System32\WindowsCodecsExt.dll
              2008-10-11 21:14 . 2008-10-11 21:14 <REP> d-------- C:\Program Files\Microsoft
              2008-10-11 21:10 . 2008-10-11 21:10 <REP> d-------- C:\Program Files\Common Files\Windows Live
              2008-10-11 21:07 . 2008-10-23 20:44 <REP> d-------- C:\Program Files\Microsoft Silverlight
              2008-10-11 17:17 . 2008-10-11 17:19 <REP> d-------- C:\Users\Anne-laure\AppData\Roaming\SecondLife
              2008-10-10 11:38 . 2008-04-17 12:12 107,368 --a------ C:\WINDOWS\System32\GEARAspi.dll
              2008-10-10 11:38 . 2008-04-17 12:12 15,464 --a------ C:\WINDOWS\System32\drivers\GEARAspiWDM.sys
              2008-10-10 11:37 . 2008-10-10 11:38 <REP> d-------- C:\Users\All Users\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
              2008-10-10 11:37 . 2008-10-10 11:38 <REP> d-------- C:\ProgramData\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
              2008-10-10 11:37 . 2008-10-10 11:38 <REP> d-------- C:\Program Files\iTunes
              2008-10-10 11:37 . 2008-10-10 11:37 <REP> d-------- C:\Program Files\iPod
              2008-10-10 11:36 . 2008-10-10 11:36 <REP> d-------- C:\Program Files\Bonjour
              2008-10-10 11:28 . 2008-10-10 11:28 <REP> d-------- C:\Program Files\Apple Software Update
              2008-10-09 19:49 . 2008-10-09 19:49 <REP> d-------- C:\Program Files\Conjugaison
              2008-10-09 19:24 . 2008-10-29 08:32 <REP> d-------- C:\Users\vero\AppData\Roaming\F-Secure
              2008-10-09 18:26 . 2008-10-09 18:26 <REP> d-------- C:\Users\All Users\TomTom
              2008-10-09 18:26 . 2008-10-09 18:26 <REP> d-------- C:\ProgramData\TomTom
              2008-10-09 18:26 . 2008-10-30 09:53 <REP> d-------- C:\Program Files\TomTom HOME
              2008-10-09 18:25 . 2008-10-09 18:25 <REP> d-------- C:\Users\vero\AppData\Roaming\TomTom
              2008-10-09 18:25 . 2008-10-09 18:25 <REP> d-------- C:\Users\vero\AppData\Roaming\InstallShield
              2008-10-09 18:24 . 2008-10-09 18:24 <REP> d-------- C:\Program Files\TomTom HOME 2
              2008-10-09 18:23 . 2008-10-09 18:23 <REP> d-------- C:\Program Files\TomTom DesktopSuite
              2008-10-08 12:24 . 2008-10-08 12:24 <REP> d-------- C:\Users\Anne-laure\AppData\Roaming\InstallShield
              2008-10-08 11:24 . 2008-10-08 11:24 <REP> d-------- C:\Users\vero\AppData\Roaming\Apple Computer
              2008-10-07 02:10 . 2008-07-16 02:32 2,048 --a------ C:\WINDOWS\System32\tzres.dll
              2008-10-06 16:35 . 2008-10-29 10:49 <REP> d-------- C:\Users\Anne-laure\AppData\Roaming\F-Secure
              2008-10-06 16:25 . 2008-04-23 17:15 572,512 --a------ C:\WINDOWS\System32\msvcp50.dll
              2008-10-06 16:25 . 2008-10-29 10:36 60,064 --a------ C:\WINDOWS\System32\drivers\fsdfw.sys
              2008-10-06 16:25 . 2008-04-23 17:11 34,752 --a------ C:\WINDOWS\System32\drivers\fses.sys
              2008-10-06 16:24 . 2008-10-06 16:24 <REP> d-------- C:\Users\All Users\F-Secure
              2008-10-06 16:24 . 2008-10-06 16:24 <REP> d-------- C:\ProgramData\F-Secure
              2008-10-06 16:22 . 2008-10-06 16:22 <REP> d-------- C:\Program Files\Orange
              2008-10-06 16:18 . 2008-10-14 09:04 <REP> d-------- C:\Users\All Users\fssg
              2008-10-06 16:18 . 2008-10-14 09:04 <REP> d-------- C:\ProgramData\fssg
              2008-10-06 15:08 . 2008-06-26 02:45 12,240,896 --a------ C:\WINDOWS\System32\NlsLexicons0007.dll
              2008-10-06 15:08 . 2008-06-26 02:45 2,644,480 --a------ C:\WINDOWS\System32\NlsLexicons0009.dll
              2008-10-06 15:07 . 2008-06-26 04:29 801,280 --a------ C:\WINDOWS\System32\NaturalLanguage6.dll
              2008-10-06 15:05 . 2008-07-31 02:13 4,240,384 --a------ C:\WINDOWS\System32\GameUXLegacyGDFs.dll
              2008-10-06 15:05 . 2008-04-26 09:26 891,448 --a------ C:\WINDOWS\System32\drivers\tcpip.sys
              2008-10-06 15:05 . 2008-04-12 04:32 784,896 --a------ C:\WINDOWS\System32\rpcrt4.dll
              2008-10-06 15:05 . 2008-06-19 04:31 361,984 --a------ C:\WINDOWS\System32\IPSECSVC.DLL
              2008-10-06 15:05 . 2008-04-05 02:21 72,192 --a------ C:\WINDOWS\System32\drivers\pacer.sys
              2008-10-06 15:05 . 2008-07-31 04:32 28,160 --a------ C:\WINDOWS\System32\Apphlpdm.dll
              2008-10-06 15:05 . 2008-04-05 04:34 15,360 --a------ C:\WINDOWS\System32\pacerprf.dll
              2008-10-06 14:41 . 2008-07-19 06:09 1,811,656 --a------ C:\WINDOWS\System32\wuaueng.dll
              2008-10-06 14:41 . 2008-07-19 04:44 1,524,736 --a------ C:\WINDOWS\System32\wucltux.dll
              2008-10-06 14:41 . 2008-07-19 06:09 563,912 --a------ C:\WINDOWS\System32\wuapi.dll
              2008-10-06 14:41 . 2008-07-19 04:44 83,456 --a------ C:\WINDOWS\System32\wudriver.dll
              2008-10-06 14:41 . 2008-07-19 06:10 53,448 --a------ C:\WINDOWS\System32\wuauclt.exe
              2008-10-06 14:41 . 2008-07-19 06:10 45,768 --a------ C:\WINDOWS\System32\wups2.dll
              2008-10-06 14:41 . 2008-07-19 06:10 36,552 --a------ C:\WINDOWS\System32\wups.dll
              2008-10-06 14:40 . 2008-07-18 21:08 163,904 --a------ C:\WINDOWS\System32\wuwebv.dll
              2008-10-06 14:40 . 2008-07-18 19:44 31,232 --a------ C:\WINDOWS\System32\wuapp.exe
              2008-10-06 14:24 . 2008-10-06 14:24 <REP> d-------- C:\Program Files\Securitoo
              2008-10-06 14:24 . 2006-11-28 19:46 28,224 --a------ C:\WINDOWS\System32\drivers\PCAMp50.sys
              2008-10-06 14:24 . 2006-11-28 19:46 27,072 --a------ C:\WINDOWS\System32\drivers\PCASp50.sys
              2008-10-06 14:22 . 2008-10-06 14:49 <REP> d-------- C:\Program Files\OrangeHSS
              2008-10-06 14:22 . 2007-12-11 19:22 65,536 --a------ C:\WINDOWS\System32\Autodial2000.dll

              .
              (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
              .
              2008-10-30 08:58 1,310,720 --sha-w C:\Users\Véronique\NTUSER.DAT
              2008-10-30 08:58 1,310,720 --sha-w C:\Users\Véronique\NTUSER.DAT
              2008-10-30 08:58 1,310,720 --sha-w C:\Users\Invité\NTUSER.DAT
              2008-10-30 08:58 1,310,720 --sha-w C:\Users\Invité\NTUSER.DAT
              2008-10-29 09:59 --------- d--h--w C:\Program Files\InstallShield Installation Information
              2008-10-26 09:38 --------- d-----w C:\Program Files\Hamachi
              2008-10-23 19:36 --------- d-----w C:\Program Files\Common Files\InstallShield
              2008-10-20 10:28 --------- d-----w C:\Program Files\Windows Live
              2008-10-16 01:13 --------- d-----w C:\Program Files\Windows Mail
              2008-10-16 01:04 --------- d-----w C:\ProgramData\Microsoft Help
              2008-10-12 19:24 --------- d-----w C:\Program Files\LimeWire
              2008-10-11 20:50 --------- d-----w C:\ProgramData\WLInstaller
              2008-10-10 10:36 --------- d-----w C:\Program Files\QuickTime
              2008-10-10 10:35 --------- d-----w C:\Program Files\Common Files\Apple
              2008-10-08 11:31 --------- d-----w C:\Program Files\FinePixViewer
              2008-10-08 11:27 --------- d-----w C:\Users\Anne-laure\AppData\Roaming\FUJIFILM
              2008-10-08 11:23 --------- d-----w C:\Users\Véronique\AppData\Roaming\FUJIFILM
              2008-08-29 08:18 87,336 ----a-w C:\Windows\System32\dns-sd.exe
              2008-08-29 07:53 61,440 ----a-w C:\Windows\System32\dnssd.dll
              2008-08-02 03:26 36,864 ----a-w C:\Windows\System32\cdd.dll
              2008-07-31 03:32 460,288 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
              2008-07-31 03:32 2,154,496 ----a-w C:\Windows\AppPatch\AcGenral.dll
              2008-07-31 03:32 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
              2008-06-20 17:38 1,435,224 ----a-w C:\Users\nanou\TMPGEnc-2.524.63.181-Free.zip
              2008-06-20 17:05 1,665,325 ----a-w C:\Users\nanou\agfreesetup.exe
              2008-06-20 16:31 1,579,972 ----a-w C:\Users\nanou\dvdaudioextractor.exe
              2008-06-10 19:38 20,019 ----a-w C:\Users\nanou\unfreez.zip
              2008-05-31 19:45 3,115,008 ----a-w C:\Users\nanou\AudioVideo_To_Exe(English).exe
              2008-05-28 09:46 47,360 ----a-w C:\Users\Véronique\AppData\Roaming\pcouffin.sys
              2008-05-26 13:09 605 ----a-w C:\Users\Véronique\.FCMaeUserData.dat
              2008-05-26 13:09 605 ----a-w C:\Users\Véronique\.FCMaeUserData.dat
              2008-04-28 01:45 174 --sha-w C:\Program Files\desktop.ini
              2008-04-27 07:45 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
              2008-04-27 07:45 32,768 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
              2008-04-27 07:45 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
              .

              ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
              .
              .
              *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
              REGEDIT4

              [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
              "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
              "msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
              "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 2156368]
              "WindowsWelcomeCenter"="oobefldr.dll" [2008-01-19 C:\WINDOWS\System32\oobefldr.dll]

              [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
              "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
              "au"="C:\Program Files\Dealio\DealioAU.exe" [2008-04-16 591200]
              "ORAHSSSessionManager"="C:\Program Files\OrangeHSS\SessionManager\SessionManager.exe" [2007-12-12 107248]
              "F-Secure Manager"="C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE" [2008-04-23 182936]
              "F-Secure TNB"="C:\Program Files\Orange\AntivirusFirewall\FSGUI\TNBUtil.exe" [2008-04-23 744032]
              "TomTomHOME.exe"="C:\Program Files\TomTom HOME\TomTomHOME.exe" [2007-03-14 3770024]
              "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-09-06 413696]
              "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-10-01 289576]
              "PCDAS"="C:\Program Files\Defenza\pcd-as.exe" [2006-12-15 1359872]

              [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
              "Launcher"="C:\Windows\SMINST\launcher.exe" [2007-03-07 44168]

              C:\Users\Anne-laure\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
              Outil de notification Live Search.lnk - C:\Users\Anne-laure\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe [2008-10-20 143360]

              C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
              ExifLauncher2.lnk - C:\Program Files\FinePixViewer\QuickDCF2.exe [2008-06-15 303104]

              [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
              "EnableLUA"= 0 (0x0)
              "EnableUIADesktopToggle"= 0 (0x0)

              [HKEY_LOCAL_MACHINE\software\microsoft\security center]
              "UacDisableNotify"=dword:00000001
              "InternetSettingsDisableNotify"=dword:00000001
              "AutoUpdateDisableNotify"=dword:00000001

              [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
              "DisableMonitoring"=dword:00000001

              [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
              "DisableMonitoring"=dword:00000001

              [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
              "DisableMonitoring"=dword:00000001

              [HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
              "EnableFirewall"= 0 (0x0)

              [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
              "{2BF1B30A-E70B-40C0-A49B-E32E0357E594}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
              "{5DE2C203-A710-4888-A4A0-B03BC6F9F7EE}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
              "{AB26A2BA-3E21-4EDC-BA86-74252A1E9B60}"= UDP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
              "{0F718442-4349-481B-B9BE-0434243B45CC}"= TCP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
              "{2584FB02-825A-4197-BCA8-5DEFEA1D7FC3}"= UDP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
              "{7D89EE86-9CF5-4C71-B679-C896786B9327}"= TCP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
              "{23CCE833-C21A-4284-942A-1E2BDC544952}"= UDP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
              "{158F0404-1BBA-48A7-B105-4CFF6C637FA8}"= TCP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
              "TCP Query User{E4240EF3-695C-4EAC-834B-580750BF9B6A}C:\\program files\\emule\\emule.exe"= UDP:C:\program files\emule\emule.exe:eMule
              "UDP Query User{BA578043-7B5F-4C14-A5F0-DD1203936051}C:\\program files\\emule\\emule.exe"= TCP:C:\program files\emule\emule.exe:eMule
              "TCP Query User{FB00228A-A7BB-43F6-A5BF-73A7D28205CB}C:\\programdata\\kaspersky lab setup files\\kaspersky internet security 7.0.1.325\\french\\setup.exe"= UDP:C:\programdata\kaspersky lab setup files\kaspersky internet security 7.0.1.325\french\setup.exe:Programme d'installation de Kaspersky Internet Security 7.0
              "UDP Query User{440986FF-83C0-400D-93B1-ECA44E786697}C:\\programdata\\kaspersky lab setup files\\kaspersky internet security 7.0.1.325\\french\\setup.exe"= TCP:C:\programdata\kaspersky lab setup files\kaspersky internet security 7.0.1.325\french\setup.exe:Programme d'installation de Kaspersky Internet Security 7.0
              "TCP Query User{AECC5E9E-BAE8-4888-9F67-6301045DAADA}C:\\program files\\hamachi\\hamachi.exe"= UDP:C:\program files\hamachi\hamachi.exe:Hamachi Client
              "UDP Query User{23AB184E-67A6-4A61-8C12-79AEB04D7169}C:\\program files\\hamachi\\hamachi.exe"= TCP:C:\program files\hamachi\hamachi.exe:Hamachi Client
              "TCP Query User{E3F29125-A2B2-4113-8259-25657DFDBDB6}C:\\program files\\utorrent\\utorrent.exe"= UDP:C:\program files\utorrent\utorrent.exe:uTorrent
              "UDP Query User{9E030592-428F-49C6-A9A2-23D22441CF1A}C:\\program files\\utorrent\\utorrent.exe"= TCP:C:\program files\utorrent\utorrent.exe:uTorrent
              "{63C96D9E-C7A9-44CE-88BE-0C515539437C}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
              "{2192EAE9-5368-4EE8-8CD3-9C66A8912293}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
              "{6D454281-F9A4-42A7-86FC-C5AE502DEEBA}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
              "{A03C0C98-1D14-4B69-8834-7AF18EE7CBC7}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
              "{AD2F44F6-5754-4B64-A8A8-4F6C6A2FA4BF}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
              "{112DB924-3F00-438F-ACB8-1C1D58D9EBA6}"= UDP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
              "{48480C3F-4276-4B3B-9D8B-488BD0F40DEA}"= TCP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire

              [HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
              "EnableFirewall"= 0 (0x0)

              [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
              "EnableFirewall"= 0 (0x0)

              [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
              "C:\\Program Files\\OrangeHSS\\Connectivity\\ConnectivityManager.exe"= C:\Program Files\OrangeHSS\Connectivity\ConnectivityManager.exe:*:enabled:CSS

              R1 F-Secure HIPS;F-Secure HIPS;C:\Program Files\Orange\AntivirusFirewall\HIPS\fshs.sys [2008-10-29 41184]
              R1 FSES;F-Secure Email Scanning Driver;C:\Windows\system32\drivers\fses.sys [2008-04-23 34752]
              R1 FSFW;F-Secure Firewall Driver;C:\Windows\system32\drivers\fsdfw.sys [2008-10-29 60064]
              R1 fsvista;F-Secure Vista Support Driver;C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\minifilter\fsvista.sys [2008-04-23 12896]
              R3 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\minifilter\fsgk.sys [2008-04-23 62048]
              S3 Brndis;External USB Cable Modem;C:\Windows\system32\DRIVERS\Brndis.sys [2004-02-06 16512]
              S3 PCAMp50;PCAMp50 NDIS Protocol Driver;C:\Windows\system32\Drivers\PCAMp50.sys [2006-11-28 28224]
              S3 PCASp50;PCASp50 NDIS Protocol Driver;C:\Windows\system32\Drivers\PCASp50.sys [2006-11-28 27072]
              S4 F-Secure Filter;F-Secure File System Filter;C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\Win2K\FSfilter.sys [2008-04-23 39776]
              S4 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\Win2K\FSrec.sys [2008-04-23 25184]

              [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6f5f6184-012e-11dd-8acc-806e6f6e6963}]
              \shell\AutoRun\command - E:\EPSETUP.EXE

              [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{990fee76-9538-11dd-9d90-001bb97e2318}]
              \shell\AutoRun\command - J:\InstallTomTomHOME.exe

              [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e9f1fc82-990f-11dd-bed9-001bb97e2318}]
              \shell\AutoRun\command - K:\start.exe

              *Newly Created Service* - CATCHME
              *Newly Created Service* - PROCEXP90
              .
              Contenu du dossier 'Tâches planifiées'

              2008-10-30 C:\Windows\Tasks\User_Feed_Synchronization-{2D2B0467-6BFE-4217-82E0-E7D63BCEFB92}.job
              - C:\Windows\system32\msfeedssync.exe [2008-01-19 08:33]

              2008-10-30 C:\Windows\Tasks\User_Feed_Synchronization-{A3BD8618-9E38-4205-94E6-90329DCC055B}.job
              - C:\Windows\system32\msfeedssync.exe [2008-01-19 08:33]
              .
              - - - - ORPHELINS SUPPRIMES - - - -

              WebBrowser-{21FA44EF-376D-4D53-9B0F-8A89D3229068} - (no file)

              .
              ------- Examen supplémentaire -------
              .
              FireFox -: Profile - C:\Users\Anne-laure\AppData\Roaming\Mozilla\Firefox\Profiles\leichzot.default\
              FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
              FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.msn.fr/
              .

              **************************************************************************

              catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
              Rootkit scan 2008-10-30 10:04:59
              Windows 6.0.6001 Service Pack 1 NTFS

              Recherche de processus cachés ...

              Recherche d'éléments en démarrage automatique cachés ...

              Recherche de fichiers cachés ...

              Scan terminé avec succès
              Fichiers cachés: 0
              1. Help-me-=) Auteur
                Oula , pardon
                1. archet9
                  TFais un scan avec cet antispyware :

                  Telecharge malwarebytes + tutoriel :

                  -> https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

                  Tu l´instale; le programme va se mettre automatiquement a jour.

                  Une fois a jour, le programme va se lancer; click sur l´onglet parametre, et coche la case : "Arreter internet explorer pendant la suppression".

                  Click maintenant sur l´onglet recherche et coche la case : "executer un examun complet".

                  Puis click sur "rechercher".

                  Laisse le scanner le pc...

                  Si des elements on ete trouvés > click sur supprimer la selection.

                  si il t´es demandé de redemarrer > click sur "yes".

                  A la fin un rapport va s´ouvrir; sauvegarde le de maniere a le retrouver en vu de le poster sur le forum.

                  Copie et colle le rapport stp.

                  RES BIEN
                  ce n est pas finit....
                  ceci maintenant:
                2. archet9
                  @archet9tres bien...
                  ce n est pas fini...
                  ceci maintenant:

                  Fais un scan avec cet antispyware :

                  Telecharge malwarebytes + tutoriel :

                  -> https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

                  Tu l´instale; le programme va se mettre automatiquement a jour.

                  Une fois a jour, le programme va se lancer; click sur l´onglet parametre, et coche la case : "Arreter internet explorer pendant la suppression".

                  Click maintenant sur l´onglet recherche et coche la case : "executer un examun complet".

                  Puis click sur "rechercher".

                  Laisse le scanner le pc...

                  Si des elements on ete trouvés > click sur supprimer la selection.

                  si il t´es demandé de redemarrer > click sur "yes".

                  A la fin un rapport va s´ouvrir; sauvegarde le de maniere a le retrouver en vu de le poster sur le forum.

                  Copie et colle le rapport stp.

              3. Help-me-=) Auteur
                Enfin !!

                Donc voila le rapport :

                Malwarebytes' Anti-Malware 1.30
                Version de la base de données: 1338
                Windows 6.0.6001 Service Pack 1

                30/10/2008 13:21:28
                mbam-log-2008-10-30 (13-21-28).txt

                Type de recherche: Examen complet (C:\|D:\|E:\|F:\|G:\|H:\|I:\|)
                Eléments examinés: 205346
                Temps écoulé: 2 hour(s), 0 minute(s), 32 second(s)

                Processus mémoire infecté(s): 0
                Module(s) mémoire infecté(s): 0
                Clé(s) du Registre infectée(s): 1
                Valeur(s) du Registre infectée(s): 0
                Elément(s) de données du Registre infecté(s): 1
                Dossier(s) infecté(s): 1
                Fichier(s) infecté(s): 8

                Processus mémoire infecté(s):
                (Aucun élément nuisible détecté)

                Module(s) mémoire infecté(s):
                (Aucun élément nuisible détecté)

                Clé(s) du Registre infectée(s):
                HKEY_CLASSES_ROOT\BitDownload (Trojan.Lop) -> Quarantined and deleted successfully.

                Valeur(s) du Registre infectée(s):
                (Aucun élément nuisible détecté)

                Elément(s) de données du Registre infecté(s):
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search\Local Page (Hijack.Search) -> Bad: (http://www.iesearch.com/) Good: (https://www.google.com/?gws_rd=ssl -> Quarantined and deleted successfully.

                Dossier(s) infecté(s):
                C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BitDownload (Trojan.Lop) -> Quarantined and deleted successfully.

                Fichier(s) infecté(s):
                C:\regxpcom.exe (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
                C:\Users\Véronique\AppData\Local\Temp\temC94F.tmp.exe (Adware.Agent) -> Quarantined and deleted successfully.
                C:\Users\Véronique\AppData\Local\Temp\tem4213.tmp.exe (Adware.Agent) -> Quarantined and deleted successfully.
                C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BitDownload\BitDownload Downloads.lnk (Trojan.Lop) -> Quarantined and deleted successfully.
                C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BitDownload\BitDownload Uninstall.lnk (Trojan.Lop) -> Quarantined and deleted successfully.
                C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BitDownload\BitDownload.lnk (Trojan.Lop) -> Quarantined and deleted successfully.
                C:\Program Files\EoRezo (Rogue.Eorezo) -> Delete on reboot.
                C:\Users\Véronique\Desktop\BitDownload Downloads.lnk (Trojan.Lop) -> Quarantined and deleted successfully.
                1. archet9
                  c est tres bien tout ca.....

                  colle 1 nouveau log hijack stp...

                  a+
                2. archet9
                  c est tres bien tout ca.....

                  colle 1 nouveau log hijack stp...

                  a+
              4. Help-me-=) Auteur
                Voilà :

                Logfile of Trend Micro HijackThis v2.0.2
                Scan saved at 21:52:44, on 30/10/2008
                Platform: Windows Vista SP1 (WinNT 6.00.1905)
                MSIE: Internet Explorer v7.00 (7.00.6001.18000)
                Boot mode: Normal

                Running processes:
                C:\Windows\system32\taskeng.exe
                C:\Windows\system32\Dwm.exe
                C:\Windows\system32\conime.exe
                C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE
                C:\Program Files\TomTom HOME\TomTomHOME.exe
                C:\Program Files\iTunes\iTunesHelper.exe
                C:\Program Files\Defenza\pcd-as.exe
                C:\Program Files\Windows Sidebar\sidebar.exe
                C:\Program Files\Orange\AntivirusFirewall\FSGUI\fsguidll.exe
                C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
                C:\Program Files\Windows Live\Messenger\msnmsgr.exe
                C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                C:\Program Files\FinePixViewer\QuickDCF2.exe
                C:\Users\Anne-laure\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
                C:\Users\Anne-laure\AppData\Roaming\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
                C:\Program Files\OrangeHSS\systray\systrayapp.exe
                C:\Program Files\Windows Media Player\wmplayer.exe
                C:\Windows\Explorer.exe
                C:\Program Files\Internet Explorer\iexplore.exe
                C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
                C:\Windows\system32\SearchFilterHost.exe
                c:\Users\Anne-laure\HiJackThis.exe

                R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF
                R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
                R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\OrangeHSS\SearchURLHook\SearchPageURL.dll
                O1 - Hosts: ::1 localhost
                O1 - Hosts: 92.48.81.32 iHabbixReloaded
                O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
                O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (file missing)
                O2 - BHO: DealioBHO Class - {6A87B991-A31F-4130-AE72-6D0C294BF082} - C:\Program Files\Dealio\kb127\Dealio.dll
                O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                O3 - Toolbar: Dealio - {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - C:\Program Files\Dealio\kb127\Dealio.dll
                O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
                O4 - HKLM\..\Run: [au] C:\Program Files\Dealio\DealioAU.exe
                O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\OrangeHSS\SessionManager\SessionManager.exe
                O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE" /splash
                O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Orange\AntivirusFirewall\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
                O4 - HKLM\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME\TomTomHOME.exe" -s
                O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
                O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
                O4 - HKLM\..\Run: [PCDAS] C:\Program Files\Defenza\pcd-as.exe /10003
                O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
                O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
                O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
                O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
                O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
                O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
                O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
                O4 - Startup: Outil de notification Live Search.lnk = Anne-laure\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
                O4 - Global Startup: ExifLauncher2.lnk = C:\Program Files\FinePixViewer\QuickDCF2.exe
                O8 - Extra context menu item: Compare Prices with &Dealio - C:\Users\Anne-laure\AppData\LocalLow\Dealio\kb127\res\DealioSearch.html
                O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
                O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
                O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
                O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
                O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Users\Véronique\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IMVU\Run IMVU.lnk
                O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                O9 - Extra button: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb127\Dealio.dll
                O9 - Extra 'Tools' menuitem: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb127\Dealio.dll
                O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
                O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
                O13 - Gopher Prefix:
                O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
                O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
                O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsgk32st.exe
                O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsaua.exe
                O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\FWES\Program\fsdfwd.exe
                O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\Common\FSMA32.EXE
                O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
                O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
                O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
                O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
                O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
                O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
                O23 - Service: RoxMediaDB9 - Sonic Solutions - c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
                O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
                1. Help-me-=) Auteur
                  Voilà :

                  Logfile of Trend Micro HijackThis v2.0.2
                  Scan saved at 21:52:44, on 30/10/2008
                  Platform: Windows Vista SP1 (WinNT 6.00.1905)
                  MSIE: Internet Explorer v7.00 (7.00.6001.18000)
                  Boot mode: Normal

                  Running processes:
                  C:\Windows\system32\taskeng.exe
                  C:\Windows\system32\Dwm.exe
                  C:\Windows\system32\conime.exe
                  C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE
                  C:\Program Files\TomTom HOME\TomTomHOME.exe
                  C:\Program Files\iTunes\iTunesHelper.exe
                  C:\Program Files\Defenza\pcd-as.exe
                  C:\Program Files\Windows Sidebar\sidebar.exe
                  C:\Program Files\Orange\AntivirusFirewall\FSGUI\fsguidll.exe
                  C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
                  C:\Program Files\Windows Live\Messenger\msnmsgr.exe
                  C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                  C:\Program Files\FinePixViewer\QuickDCF2.exe
                  C:\Users\Anne-laure\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
                  C:\Users\Anne-laure\AppData\Roaming\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
                  C:\Program Files\OrangeHSS\systray\systrayapp.exe
                  C:\Program Files\Windows Media Player\wmplayer.exe
                  C:\Windows\Explorer.exe
                  C:\Program Files\Internet Explorer\iexplore.exe
                  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
                  C:\Windows\system32\SearchFilterHost.exe
                  c:\Users\Anne-laure\HiJackThis.exe

                  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF
                  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
                  R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\OrangeHSS\SearchURLHook\SearchPageURL.dll
                  O1 - Hosts: ::1 localhost
                  O1 - Hosts: 92.48.81.32 iHabbixReloaded
                  O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
                  O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                  O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (file missing)
                  O2 - BHO: DealioBHO Class - {6A87B991-A31F-4130-AE72-6D0C294BF082} - C:\Program Files\Dealio\kb127\Dealio.dll
                  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                  O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                  O3 - Toolbar: Dealio - {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - C:\Program Files\Dealio\kb127\Dealio.dll
                  O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
                  O4 - HKLM\..\Run: [au] C:\Program Files\Dealio\DealioAU.exe
                  O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\OrangeHSS\SessionManager\SessionManager.exe
                  O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE" /splash
                  O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Orange\AntivirusFirewall\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
                  O4 - HKLM\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME\TomTomHOME.exe" -s
                  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
                  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
                  O4 - HKLM\..\Run: [PCDAS] C:\Program Files\Defenza\pcd-as.exe /10003
                  O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
                  O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
                  O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
                  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
                  O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                  O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
                  O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
                  O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
                  O4 - Startup: Outil de notification Live Search.lnk = Anne-laure\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
                  O4 - Global Startup: ExifLauncher2.lnk = C:\Program Files\FinePixViewer\QuickDCF2.exe
                  O8 - Extra context menu item: Compare Prices with &Dealio - C:\Users\Anne-laure\AppData\LocalLow\Dealio\kb127\res\DealioSearch.html
                  O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
                  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                  O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                  O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                  O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                  O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
                  O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
                  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
                  O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Users\Véronique\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IMVU\Run IMVU.lnk
                  O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                  O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                  O9 - Extra button: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb127\Dealio.dll
                  O9 - Extra 'Tools' menuitem: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb127\Dealio.dll
                  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
                  O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
                  O13 - Gopher Prefix:
                  O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
                  O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                  O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
                  O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsgk32st.exe
                  O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsaua.exe
                  O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\FWES\Program\fsdfwd.exe
                  O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\Common\FSMA32.EXE
                  O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
                  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
                  O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
                  O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
                  O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
                  O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
                  O23 - Service: RoxMediaDB9 - Sonic Solutions - c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
                  O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
                  1. archet9
                    ok.....

                    y a encore des problemes...
                    fais ceci:

                    Télécharge SmitfraudFix (de de S!Ri, balltrap34 et moe31) :
                    http://siri.urz.free.fr/Fix/SmitfraudFix.exe ou http://www.geekstogo.com/forum/files/file/6-smitfraudfix/

                    - Enregistre-le sur le bureau

                    - Double-clique sur SmitfraudFix.exe et choisis l'option 1 puis Entrée

                    - Un rapport sera généré, poste-le dans ta prochaine réponse.

                    [*] process.exe est détecté par certains antivirus comme étant un risktool. Il ne s'agit pas d'un virus mais d'un utilitaire destiné à mettre fin à des processus.[*]

                    ** Ne fais l'étape 2 que si on te le demande, on doit d'abord examiner le premier rapport de

                    a+
                2. Help-me-=) Auteur
                  alors voilà c'était tou se qu'il fallait faire ?

                  ...

                  SmitFraudFix v2.369

                  Scan done at 22:56:11,19, 30/10/2008
                  Run from C:\Users\Anne-laure\Desktop\SmitfraudFix
                  OS: Microsoft Windows [version 6.0.6001] - Windows_NT
                  The filesystem type is NTFS
                  Fix run in normal mode

                  »»»»»»»»»»»»»»»»»»»»»»»» Process

                  C:\Windows\system32\csrss.exe
                  C:\Windows\system32\wininit.exe
                  C:\Windows\system32\csrss.exe
                  C:\Windows\system32\services.exe
                  C:\Windows\system32\lsass.exe
                  C:\Windows\system32\lsm.exe
                  C:\Windows\system32\winlogon.exe
                  C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe
                  C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe
                  C:\Windows\system32\svchost.exe
                  C:\Windows\system32\SLsvc.exe
                  C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe
                  C:\Windows\System32\spoolsv.exe
                  C:\Windows\system32\svchost.exe
                  C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                  C:\Program Files\Bonjour\mDNSResponder.exe
                  C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsgk32st.exe
                  C:\Program Files\Orange\AntivirusFirewall\Common\FSMA32.EXE
                  C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\FSGK32.EXE
                  C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
                  c:\Program Files\Common Files\LightScribe\LSSrvc.exe
                  C:\Program Files\Orange\AntivirusFirewall\Common\FSMB32.EXE
                  C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
                  C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe
                  C:\Windows\System32\svchost.exe
                  C:\Windows\system32\SearchIndexer.exe
                  C:\Windows\system32\WUDFHost.exe
                  C:\Program Files\Orange\AntivirusFirewall\Common\FCH32.EXE
                  C:\Program Files\Orange\AntivirusFirewall\Common\FAMEH32.EXE
                  C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsqh.exe
                  C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsaua.exe
                  C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fssm32.exe
                  C:\Program Files\Orange\AntivirusFirewall\FWES\Program\fsdfwd.exe
                  C:\Windows\system32\taskeng.exe
                  C:\Windows\system32\Dwm.exe
                  C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsus.exe
                  C:\Windows\system32\conime.exe
                  C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsav32.exe
                  C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE
                  C:\Program Files\TomTom HOME\TomTomHOME.exe
                  C:\Program Files\iTunes\iTunesHelper.exe
                  C:\Program Files\Defenza\pcd-as.exe
                  C:\Program Files\Windows Sidebar\sidebar.exe
                  C:\Program Files\Orange\AntivirusFirewall\FSGUI\fsguidll.exe
                  C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
                  C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                  C:\Program Files\FinePixViewer\QuickDCF2.exe
                  C:\Program Files\iPod\bin\iPodService.exe
                  C:\Users\Anne-laure\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
                  C:\Windows\system32\taskeng.exe
                  C:\Users\Anne-laure\AppData\Roaming\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
                  C:\Program Files\OrangeHSS\systray\systrayapp.exe
                  C:\Program Files\Windows Live\Messenger\usnsvc.exe
                  C:\Program Files\Windows Media Player\wmpnetwk.exe
                  C:\Program Files\Windows Media Player\wmplayer.exe
                  C:\Windows\Explorer.exe
                  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
                  C:\Windows\system32\taskeng.exe
                  C:\Program Files\Internet Explorer\iexplore.exe
                  C:\Windows\system32\SearchProtocolHost.exe
                  C:\Windows\system32\SearchFilterHost.exe
                  C:\Windows\system32\cmd.exe
                  C:\Windows\system32\wbem\wmiprvse.exe

                  »»»»»»»»»»»»»»»»»»»»»»»» hosts

                  hosts file corrupted !

                  127.0.0.1 www.legal-at-spybot.info
                  127.0.0.1 legal-at-spybot.info

                  »»»»»»»»»»»»»»»»»»»»»»»» C:\

                  »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows

                  »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system

                  »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\Web

                  »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32

                  »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32\LogFiles

                  »»»»»»»»»»»»»»»»»»»»»»»» C:\Users\Anne-laure

                  »»»»»»»»»»»»»»»»»»»»»»»» C:\Users\Anne-laure\Application Data

                  »»»»»»»»»»»»»»»»»»»»»»»» Start Menu

                  »»»»»»»»»»»»»»»»»»»»»»»» C:\Users\ANNE-L~1\FAVORI~1

                  »»»»»»»»»»»»»»»»»»»»»»»» Desktop

                  »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

                  »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys

                  »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

                  »»»»»»»»»»»»»»»»»»»»»»»» o4Patch
                  !!!Attention, following keys are not inevitably infected!!!

                  o4Patch
                  Credits: Malware Analysis & Diagnostic
                  Code: S!Ri

                  »»»»»»»»»»»»»»»»»»»»»»»» IEDFix
                  !!!Attention, following keys are not inevitably infected!!!

                  IEDFix
                  Credits: Malware Analysis & Diagnostic
                  Code: S!Ri

                  »»»»»»»»»»»»»»»»»»»»»»»» VACFix
                  !!!Attention, following keys are not inevitably infected!!!

                  VACFix
                  Credits: Malware Analysis & Diagnostic
                  Code: S!Ri

                  »»»»»»»»»»»»»»»»»»»»»»»» 404Fix
                  !!!Attention, following keys are not inevitably infected!!!

                  404Fix
                  Credits: Malware Analysis & Diagnostic
                  Code: S!Ri

                  »»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix
                  !!!Attention, following keys are not inevitably infected!!!

                  »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
                  !!!Attention, following keys are not inevitably infected!!!

                  SrchSTS.exe by S!Ri
                  Search SharedTaskScheduler's .dll

                  »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
                  !!!Attention, following keys are not inevitably infected!!!

                  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
                  "AppInit_DLLs"=""

                  »»»»»»»»»»»»»»»»»»»»»»»» Winlogon
                  !!!Attention, following keys are not inevitably infected!!!

                  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
                  "Userinit"="C:\\Windows\\system32\\userinit.exe,"
                  "System"=""

                  »»»»»»»»»»»»»»»»»»»»»»»» RK

                  »»»»»»»»»»»»»»»»»»»»»»»» DNS

                  Description: Contrôleur de réseau NVIDIA nForce
                  DNS Server Search Order: 192.168.1.1
                  DNS Server Search Order: 192.168.1.1

                  HKLM\SYSTEM\CCS\Services\Tcpip\..\{3AB319A9-3A4B-4D46-9009-02C532DB4219}: DhcpNameServer=192.168.1.1 192.168.1.1
                  HKLM\SYSTEM\CCS\Services\Tcpip\..\{935042F9-914D-41CA-AD82-67BD57308E22}: DhcpNameServer=82.216.111.124 82.216.111.125 82.216.111.121 82.216.111.122 82.216.111.123
                  HKLM\SYSTEM\CS1\Services\Tcpip\..\{3AB319A9-3A4B-4D46-9009-02C532DB4219}: DhcpNameServer=192.168.1.1 192.168.1.1
                  HKLM\SYSTEM\CS1\Services\Tcpip\..\{935042F9-914D-41CA-AD82-67BD57308E22}: DhcpNameServer=82.216.111.124 82.216.111.125 82.216.111.121 82.216.111.122 82.216.111.123
                  HKLM\SYSTEM\CS3\Services\Tcpip\..\{3AB319A9-3A4B-4D46-9009-02C532DB4219}: DhcpNameServer=192.168.1.1 192.168.1.1
                  HKLM\SYSTEM\CS3\Services\Tcpip\..\{935042F9-914D-41CA-AD82-67BD57308E22}: DhcpNameServer=82.216.111.124 82.216.111.125 82.216.111.121 82.216.111.122 82.216.111.123
                  HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 192.168.1.1
                  HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 192.168.1.1
                  HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 192.168.1.1

                  »»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection

                  »»»»»»»»»»»»»»»»»»»»»»»» End
                  1. archet9
                    oui c est tout...
                    mais choux blanc.....

                    fait ceci:

                    Télécharge Toolbar-S&D (Team IDN) sur ton Bureau.
                    https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2

                    * Lance l'installation du programme en exécutant le fichier téléchargé.
                    * Double-clique maintenant sur le raccourci de Toolbar-S&D.
                    * Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.
                    * Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche.
                    * Poste le rapport généré. (C:\TB.txt)
                3. Help-me-=) Auteur
                  Euh ... Le Lien Ne Marchait Pas Donc J'ai CherChé SUr google en esperent ne pas m'etre trompé

                  Seul probléme je crois que c'est pas ça xD ... vous pouvez me donner le nom exact de se log??
                  1. archet9
                    j ai testé le lien...il marche
                    mais avant reprend smitfraudfix et fait ceci:

                    --Suite de la manipe ( nettoyage ), fais exactement ce qui suit :

                    * Impératif : Redémarrer l'ordinateur en mode sans échec .
                    Comment aller en Mode sans échec
                    1) Redémarre ton ordi
                    2) Tapote la touche F8 immédiatement, (F5 sur certains PC) juste après le "Bip"
                    3) Tu verras un écran avec options de démarrage apparaître
                    4) Choisis la première option : Sans Échec, et valide avec "Entrée"
                    5) Choisis ton compte habituel, et non Administrateur (si besoin ... )
                    ( ps : n'oublies pas , en mode sans échec , pas de connexion ! Donc copies ou imprimes bien les info ci-dessous ...)

                    *Double click sur SmitfraudFix.exe

                    * Sélectionnes 2 et presses "Entrée" dans le menu pour supprimer les fichiers responsables de l'infection.

                    -> Si besion :
                    * A la question: Voulez-vous nettoyer le registre ? répondre O (oui) et presser Entrée afin de débloquer le fond d'écran et supprimer les clés de registre de l'infection.

                    ( Le correctif déterminera si le fichier wininet.dll est infecté.)

                    * A la question: "Corriger le fichier infecté ?" répondre O (oui) et presser Entrée
                    pour remplacer le fichier corrompu.

                    * Un redémarrage sera peut être nécessaire pour terminer la procédure de nettoyage ( sinon fais le manuellement )

                    Le rapport se trouve à la racine de C\:
                    (dans le fichier "rapport.txt")

                    Postes moi ce dernier rapport ... Attention , il va être trop long pour être poster entièrement sur le forum
                    --> donc postes moi seulement le début et la fin ( coupes la listes des "fichiers hosts" )

                    Antonio Giacomo Stradivari, souvent appelé Stradivarius (Crémone, 1644 - Crémone, 18 décembre 1737 
                    Le Soil (1714), considéré par beaucoup comme le meilleur instrument du monde.
                    peu de temps avant sa mort il cherchait encore... 
                4. Help-me-=) Auteur
                  Bonjur , Excusez Moi pour le temps de réponse je n'ai pas pu venir

                  Voilà :

                  Ca C'est Le Début :

                  SmitFraudFix v2.369

                  Scan done at 14:52:18,20, 01/11/2008
                  Run from C:\Users\Anne-laure\Desktop\SmitfraudFix
                  OS: Microsoft Windows [version 6.0.6001] - Windows_NT
                  The filesystem type is NTFS
                  Fix run in safe mode

                  »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
                  !!!Attention, following keys are not inevitably infected!!!

                  SrchSTS.exe by S!Ri
                  Search SharedTaskScheduler's .dll

                  »»»»»»»»»»»»»»»»»»»»»»»» Killing process

                  Et Ca C'est La Fin Du Rapport :

                  404Fix
                  Credits: Malware Analysis & Diagnostic
                  Code: S!Ri

                  »»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix

                  »»»»»»»»»»»»»»»»»»»»»»»» RK

                  »»»»»»»»»»»»»»»»»»»»»»»» DNS

                  HKLM\SYSTEM\CCS\Services\Tcpip\..\{3AB319A9-3A4B-4D46-9009-02C532DB4219}: DhcpNameServer=192.168.1.1 192.168.1.1
                  HKLM\SYSTEM\CCS\Services\Tcpip\..\{935042F9-914D-41CA-AD82-67BD57308E22}: DhcpNameServer=82.216.111.124 82.216.111.125 82.216.111.121 82.216.111.122 82.216.111.123
                  HKLM\SYSTEM\CS1\Services\Tcpip\..\{3AB319A9-3A4B-4D46-9009-02C532DB4219}: DhcpNameServer=192.168.1.1 192.168.1.1
                  HKLM\SYSTEM\CS1\Services\Tcpip\..\{935042F9-914D-41CA-AD82-67BD57308E22}: DhcpNameServer=82.216.111.124 82.216.111.125 82.216.111.121 82.216.111.122 82.216.111.123
                  HKLM\SYSTEM\CS3\Services\Tcpip\..\{3AB319A9-3A4B-4D46-9009-02C532DB4219}: DhcpNameServer=192.168.1.1 192.168.1.1
                  HKLM\SYSTEM\CS3\Services\Tcpip\..\{935042F9-914D-41CA-AD82-67BD57308E22}: DhcpNameServer=82.216.111.124 82.216.111.125 82.216.111.121 82.216.111.122 82.216.111.123
                  HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 192.168.1.1
                  HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 192.168.1.1
                  HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 192.168.1.1

                  »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files

                  »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
                  !!!Attention, following keys are not inevitably infected!!!

                  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
                  "System"=""

                  »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

                  Registry Cleaning done.

                  »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
                  !!!Attention, following keys are not inevitably infected!!!

                  SrchSTS.exe by S!Ri
                  Search SharedTaskScheduler's .dll

                  »»»»»»»»»»»»»»»»»»»»»»»» End
                  1. Help-me-=) Auteur
                    Merci d'être la pour m'aider
                    1. archet9
                      RE
                      desinstalle norton avec ceci

                      --http://service1.symantec.com/SUPPORT/INTER/tsgeninfointl.nsf/fr_docid/20050414110429924

                      et colle 1 nouveau scan hijack stp

                      a+
                      Antonio Giacomo Stradivari, souvent appelé Stradivarius (Crémone, 1644 - Crémone, 18 décembre 1737 
                      Le Soil (1714), considéré par beaucoup comme le meilleur instrument du monde.
                      peu de temps avant sa mort il cherchait encore... 
                  2. Help-me-=) Auteur
                    Logfile of Trend Micro HijackThis v2.0.2
                    Scan saved at 16:05:01, on 01/11/2008
                    Platform: Windows Vista SP1 (WinNT 6.00.1905)
                    MSIE: Internet Explorer v7.00 (7.00.6001.18000)
                    Boot mode: Normal

                    Running processes:
                    C:\Windows\system32\taskeng.exe
                    C:\Windows\system32\Dwm.exe
                    C:\Windows\Explorer.EXE
                    C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
                    C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE
                    C:\Program Files\TomTom HOME\TomTomHOME.exe
                    C:\Program Files\iTunes\iTunesHelper.exe
                    C:\Program Files\OrangeHSS\Launcher\Launcher.exe
                    C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
                    C:\Program Files\Defenza\pcd-as.exe
                    C:\Program Files\Orange\AntivirusFirewall\FSGUI\fsguidll.exe
                    C:\Windows\system32\conime.exe
                    C:\Program Files\Windows Sidebar\sidebar.exe
                    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
                    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                    C:\Program Files\FinePixViewer\QuickDCF2.exe
                    C:\Users\Anne-laure\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
                    C:\Users\Anne-laure\AppData\Roaming\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
                    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
                    C:\Windows\system32\SearchFilterHost.exe
                    C:\Program Files\Internet Explorer\IEXPLORE.EXE
                    c:\Users\Anne-laure\HiJackThis.exe
                    C:\Program Files\OrangeHSS\systray\systrayapp.exe

                    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
                    R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\OrangeHSS\SearchURLHook\SearchPageURL.dll
                    O1 - Hosts: ::1 localhost
                    O1 - Hosts: 92.48.81.32 iHabbixReloaded
                    O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
                    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                    O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (file missing)
                    O2 - BHO: DealioBHO Class - {6A87B991-A31F-4130-AE72-6D0C294BF082} - C:\Program Files\Dealio\kb127\Dealio.dll
                    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                    O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                    O3 - Toolbar: Dealio - {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - C:\Program Files\Dealio\kb127\Dealio.dll
                    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
                    O4 - HKLM\..\Run: [au] C:\Program Files\Dealio\DealioAU.exe
                    O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\OrangeHSS\SessionManager\SessionManager.exe
                    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Orange\AntivirusFirewall\Common\FSM32.EXE" /splash
                    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Orange\AntivirusFirewall\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
                    O4 - HKLM\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME\TomTomHOME.exe" -s
                    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
                    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
                    O4 - HKLM\..\Run: [PCDAS] C:\Program Files\Defenza\pcd-as.exe /10003
                    O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
                    O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
                    O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
                    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
                    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
                    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
                    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
                    O4 - Startup: Outil de notification Live Search.lnk = Anne-laure\AppData\Roaming\Microsoft\Live Search\Notification-LiveSearch.exe
                    O4 - Global Startup: ExifLauncher2.lnk = C:\Program Files\FinePixViewer\QuickDCF2.exe
                    O8 - Extra context menu item: Compare Prices with &Dealio - C:\Users\Anne-laure\AppData\LocalLow\Dealio\kb127\res\DealioSearch.html
                    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
                    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
                    O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                    O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                    O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
                    O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
                    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
                    O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Users\Véronique\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IMVU\Run IMVU.lnk
                    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                    O9 - Extra button: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb127\Dealio.dll
                    O9 - Extra 'Tools' menuitem: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb127\Dealio.dll
                    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
                    O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
                    O13 - Gopher Prefix:
                    O15 - Trusted Zone: http://*.mappy.com
                    O15 - Trusted Zone: http://*.orange.fr
                    O15 - Trusted Zone: http://rw.search.ke.voila.fr
                    O15 - Trusted Zone: http://orange.weborama.fr
                    O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
                    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                    O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
                    O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\Anti-Virus\fsgk32st.exe
                    O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\FSAUA\program\fsaua.exe
                    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\FWES\Program\fsdfwd.exe
                    O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\Orange\AntivirusFirewall\Common\FSMA32.EXE
                    O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
                    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
                    O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
                    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
                    O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
                    O23 - Service: RoxMediaDB9 - Sonic Solutions - c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
                    O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
                    1. archet9
                      NORTONest toujours la...
                      mais on verra apres
                      fais ceci2- Télécharges FindyKill de Chiquitine29 :

                      http://sd-1.archive-host.com/membres/up/116615172019703188/FindyKill.exe

                      ->Enregistres le sur ton bureau et pas ailleurs !

                      !! Déconnectes toi et fermes toute applications en cours !!

                      ( Si ton anti-virus s'affolle au moment de l'enregistrement ou de l'utilisation de l'outil , ignore l'alerte ...)

                      -> Cliques sur "FindyKill.exe" pour lancer l'installe de l'outil . Ne touche surtout pas aux paramètres d'installation.

                      a+
                  3. Help-me-=) Auteur
                    Quand j'ouvre Findyfiil apres lavoir instalé comme prévu ça me dit sa :

                    Des fichiers sont manquants , l'outils est mal installù !
                    Findykill ne peut continuer a s'éxecuter ..
                    Appuyer sur une touche pour quitter Fyndikiill

                    Rann !!! très énervent , jai suivie a la lettre se que vous m'avez dit !
                    1. archet9
                      essayes ceci:

                      --https://www.androidworld.fr/
                      deroule toute la page....
                      et tout en bas clique sur le n°/18
                      A+

                      Antonio Giacomo Stradivari, souvent appelé Stradivarius (Crémone, 1644 - Crémone, 18 décembre 1737 
                      Le Soil (1714), considéré par beaucoup comme le meilleur instrument du monde.
                      peu de temps avant sa mort il cherchait encore... 
                  • 1
                  • 2

                  Discussions similaires

                  Aide pour un virus
                  cerise92700

                  41 réponses
                  Trojan impossible à supprimer!
                  Gridouu

                  12 réponses
                  Comment supprimer le virus Trojan
                  vitsou

                  18 réponses
                  Cheval de Troie- e.tre456.worm.windows
                  Ninou037

                  13 réponses
                  trojan-spy.win32@mx
                  caramel79

                  3 réponses