Pub intepesrive

petitgalop -  
Bonjour, j'ai depuis un certain temps, une pub qui s'affiche sur mon ecran, et impossible de l'eradiquer, 1er ment, spybot ne trouve rien , mon parefeu laisse passer, mon intivivus ne voit rien , bref, on peut faire comment pour arreter cela? il s'agit d'une pub pour (vendre des appartements)
Configuration: Windows XP
Internet Explorer 7.0

23 réponses

  • Votes
  • Date
  • Date décroissante
  1. Destrio5 Modérateur
    1/

    ---> Va dans Ajout/Suppression des programmes et désinstalle :
    - Navilog1
    - Ad-Remover

    2/

    ---> Télécharge HostsXpert sur ton Bureau :
    http://www.funkytoad.com/download/HostsXpert.zip

    ---> Décompresse-le (Clic droit >> Extraire ici)

    ---> Double-clique sur HostsXpert pour le lancer

    ---> clique sur le bouton "Restore MS Hosts File" puis ferme le programme

    PS : Avant de cliquer sur le bouton "Restore MS Hosts File", vérifie que le cadenas en haut à gauche soit ouvert sinon tu vas avoir un message d'erreur.

    3/

    - Télécharge SmitfraudFix (de de S!Ri, balltrap34 et moe31) sur ton Bureau.
    http://siri.urz.free.fr/Fix/SmitfraudFix.exe

    - Double-clique sur SmitfraudFix.exe et choisis l'option 1 puis Entrée.

    - Un rapport sera généré, poste-le dans ta prochaine réponse.

    [*] process.exe est détecté par certains antivirus comme étant un risktool. Il ne s'agit pas d'un virus mais d'un utilitaire destiné à mettre fin à des processus.[*]

    ** Ne fais l'étape 2 que si on te le demande, on doit d'abord examiner le premier rapport de SmitfraudFix.
    1. Destrio5 Modérateur
      Ton fichier Hosts était corrompu alors on l'a restauré avec HostsXpert que tu peux supprimer d'ailleurs.

      - Redémarre ton ordinateur en mode sans échec :
      https://blog.sosordi.net/

      - Double-clique sur SmitfraudFix.exe, choisis l'option 2 et Entrée.

      - Réponds O (Oui) à ces deux questions si elles te sont posées :

      Voulez-vous nettoyer le registre ?
      Corriger le fichier infecté ?

      - Un rapport sera généré, sauvegarde-le sur le Bureau.

      - Redémarre en mode normal.

      - Poste le rapport SmitfraudFix.
      1. Destrio5 Modérateur
        Salut,

        - Télécharge Random's System Information Tool (RSIT) (par random/random) sur ton Bureau.

        - Double-clique sur RSIT.exe afin de lancer le programme.

        - Clique sur Continue à l'écran Disclaimer.

        - Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.

        - Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (c'est celui qui apparaît à l'écran) ainsi que de info.txt (que tu verras dans la barre des tâches).

        Note : Les rapports sont sauvegardés dans le dossier C:\rsit.
        1. petitgalop Auteur
          BONJOUR,ci-joint le fichier log.txt
          Logfile of random's system information tool 1.04 (written by random/random)
          Run by CHRISTIAN at 2008-11-08 14:08:44
          Microsoft Windows XP Professionnel Service Pack 2
          System drive C: has 105 GB (44%) free of 239 GB
          Total RAM: 1279 MB (57% free)

          Logfile of Trend Micro HijackThis v2.0.2
          Scan saved at 14:09:12, on 08/11/2008
          Platform: Windows XP SP2 (WinNT 5.01.2600)
          MSIE: Internet Explorer v7.00 (7.00.6000.16544)
          Boot mode: Normal

          Running processes:
          C:\WINDOWS\System32\smss.exe
          C:\WINDOWS\system32\winlogon.exe
          C:\WINDOWS\system32\services.exe
          C:\WINDOWS\system32\lsass.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\System32\svchost.exe
          C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
          C:\Program Files\Alwil Software\Avast4\ashServ.exe
          C:\WINDOWS\Explorer.EXE
          C:\WINDOWS\system32\spoolsv.exe
          C:\Program Files\EoRezo\EoEngine.exe
          C:\WINDOWS\system32\ctfmon.exe
          C:\Program Files\Microsoft ActiveSync\wcescomm.exe
          C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
          C:\PROGRA~1\MI3AA1~1\rapimgr.exe
          c:\program files\a-squared free\a2service.exe
          C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
          C:\Program Files\Bonjour\mDNSResponder.exe
          C:\WINDOWS\system32\drivers\CDAC11BA.EXE
          C:\Program Files\Digital Media Center\DMGateway.exe
          C:\Program Files\Micro Application\Les 4 Dictionnaires Utiles\MediaDICO4Ut.EXE
          C:\Program Files\Digital Media Center\WSR\DIGITAL MEDIA RECORDER SERVICE.EXE
          C:\Program Files\Digital Media Center\httpd\bin\httpd.exe
          C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
          C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE
          C:\Program Files\Micro Application\Les 4 Dictionnaires Utiles\Rac4Ut.EXE
          C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
          C:\WINDOWS\System32\svchost.exe
          C:\Program Files\Digital Media Center\httpd\bin\httpd.exe
          C:\Program Files\Digital Media Center\DigitalMediaCenter.exe
          C:\Program Files\FinePixViewer\QuickDCF2.exe
          C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
          C:\Program Files\Digital Media Center\WgLaucher.exe
          C:\Program Files\Digital Media Center\AppServer.exe
          C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
          C:\WINDOWS\System32\svchost.exe
          C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe
          C:\WINDOWS\system32\LVComsX.exe
          C:\Documents and Settings\CHRISTIAN\Bureau\RSIT.exe
          C:\Program Files\trend micro\CHRISTIAN.exe

          R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://actus.sfr.fr
          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.lo.st
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://actus.sfr.fr
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
          R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
          R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://actus.sfr.fr
          R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
          R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = https://support.microsoft.com/en-US/topic/internet-explorer-downloads-d49e1f0d-571c-9a7b-d97e-be248806ca70
          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
          R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
          R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
          O1 - Hosts: 66.98.148.65 auto.search.msn.com
          O1 - Hosts: 66.98.148.65 auto.search.msn.es
          O1 - Hosts: 127.255.255.255 serial.alcohol-soft.com
          O1 - Hosts: 127.255.255.255 www.alcohol-soft.com
          O1 - Hosts: 127.255.255.255 images.alcohol-soft.com
          O2 - BHO: (no name) - {0EEDB912-C5FA-486F-8334-57288578C627} - (no file)
          O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
          O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
          O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
          O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
          O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\PROGRA~1\EoRezo\EoAdv\EOREZO~1.DLL
          O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
          O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
          O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
          O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
          O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
          O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
          O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
          O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
          O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\system32\qttask.exe" -atboottime
          O4 - HKLM\..\Run: [EoEngine] "C:\Program Files\EoRezo\EoEngine.exe"
          O4 - HKLM\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t
          O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
          O4 - HKCU\..\Run: [MediaDICO4Ut] C:\Program Files\Micro Application\Les 4 Dictionnaires Utiles\LanceMediaDICO4Ut.exe Lancement
          O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
          O4 - HKCU\..\Run: [LDM] \Program\
          O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
          O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
          O4 - HKCU\..\Run: [Performance Center] C:\Program Files\Ascentive\Performance Center\ApcMain.exe -m
          O4 - HKCU\..\Run: [PC SpeedScan Pro] C:\Program Files\Ascentive\PC SpeedScan Pro\PCSpeedScan.exe -m
          O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
          O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
          O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
          O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
          O4 - Global Startup: Digital Media Center.lnk = C:\Program Files\Digital Media Center\DigitalMediaCenter.exe
          O4 - Global Startup: ExifLauncher2.lnk = C:\Program Files\FinePixViewer\QuickDCF2.exe
          O4 - Global Startup: Postit Renkar.exe
          O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
          O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
          O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
          O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
          O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
          O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
          O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
          O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll
          O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
          O9 - Extra button: Organise-notes - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Researcher\EROPROJ.DLL
          O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
          O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
          O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
          O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
          O16 - DPF: {3A226D85-574D-4272-B73C-DBCAECF709B3} (TNSClickerb.Clicker) - http://www.consoclicker.com/TNSClickrb.CAB
          O16 - DPF: {48DF87EE-F2DE-11D8-BE7F-302050C10812} (FlyLoader Class) - http://www.flysuite.com/flycalc/loadercalc_win_fr.cab
          O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
          O16 - DPF: {70A5EBDC-3EA6-464A-9FF7-084BC150C417} (TNSClickera.Clicker) - http://www.consoclicker.com/TNSClickra.CAB
          O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
          O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
          O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://www.foto-cards.com/downloads/ImageUploader3.cab
          O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
          O16 - DPF: {B79A53C0-1DAC-4636-BACE-FD086A7A79BF} (AdSignerLCContrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
          O17 - HKLM\System\CCS\Services\Tcpip\..\{7F5FB5C4-FE4D-466B-813A-40D7E57CEF88}: Domain = chu-besancon.priv
          O17 - HKLM\System\CCS\Services\Tcpip\..\{7F5FB5C4-FE4D-466B-813A-40D7E57CEF88}: NameServer = 192.168.229.200,192.168.129.33
          O18 - Protocol: bw+0 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bw+0s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bw-0 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bw-0s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bw00 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bw00s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bw10 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bw10s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bw20 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bw20s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bw30 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bw30s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bw40 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bw40s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bw50 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bw50s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bw60 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bw60s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bw70 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bw70s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bw80 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bw80s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bw90 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bw90s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bwa0 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bwa0s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bwb0 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bwb0s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bwc0 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bwc0s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bwd0 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bwd0s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bwe0 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bwe0s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bwf0 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bwf0s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
          O18 - Protocol: bwg0 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bwg0s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bwh0 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bwh0s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bwi0 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bwi0s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bwj0 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bwj0s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bwk0 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bwk0s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bwl0 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bwl0s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bwm0 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bwm0s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bwn0 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bwn0s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bwo0 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bwo0s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bwp0 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bwp0s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bwq0 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bwq0s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bwr0 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bwr0s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bws0 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bws0s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bwt0 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bwt0s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bwu0 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bwu0s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bwv0 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bwv0s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bww0 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bww0s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bwx0 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bwx0s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bwy0 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bwy0s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bwz0 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: bwz0s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: offline-8876480 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
          O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
          O21 - SSODL: died - {7fa55359-7223-410f-bc82-efb3e3ded07f} - (no file)
          O22 - SharedTaskScheduler: died - {7fa55359-7223-410f-bc82-efb3e3ded07f} - (no file)
          O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - c:\program files\a-squared free\a2service.exe
          O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
          O23 - Service: ADSLAutoconnect - Unknown owner - C:\Program Files\ADSL Autoconnect\ADSL Autoconnect.exe
          O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
          O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
          O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
          O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
          O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
          O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
          O23 - Service: C-DillaCdaC11BA - C-Dilla Ltd - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
          O23 - Service: Digital Media Gateway - Worldsat - C:\Program Files\Digital Media Center\DMGateway.exe
          O23 - Service: Digital Media Recorder Service - WorldSat - C:\Program Files\Digital Media Center\WSR\DIGITAL MEDIA RECORDER SERVICE.EXE
          O23 - Service: Digital Media HTTPd (DigitalMediaHTTPd) - Apache Software Foundation - C:\Program Files\Digital Media Center\httpd\bin\httpd.exe
          O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
          O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
          O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
          O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
          O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
          O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE
          O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
          2. Destrio5 Modérateur
            - Télécharge AD-Remover (de Cyrildu17 / C_XX) sur ton Bureau.

            /!\ Déconnecte-toi et ferme toutes applications en cours /!\

            - Double-clique sur le programme d'installation, installe-le dans son emplacement par défaut (C:\Program files).
            - Double-clique sur l'icône Ad-remover située sur ton Bureau.
            - Au menu principal, choisis l'option "A".
            - Poste le rapport qui apparaît à la fin.

            (Le rapport est sauvegardé aussi sous C:\Ad-report(date).log)

            (CTRL+A pour tout sélectionner, CTRL+C pour copier et CTRL+V pour coller)

            Note :

            "Process.exe", une composante de l'outil, est détectée par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
            Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
            Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.
            1. petitgalop Auteur
              bonjour, ci-joint le rapport après scan de AD-REMOVER.

              F --------- Logfile of AD-Remover 1.0.3.0 by C_XX ---------

              START at: 11:17:03 | 09/11/2008
              ON: Microsoft Windows XP [version 5.1.2600] ( Windows XP )
              OPTION: Scan
              EXECUTED FROM: C:\Program Files\Ad-remover\AD-Remover.bat
              USER: CHRISTIAN | PC: CLOSS
              BOOT MODE: Normal
              DRIVE(S): A:\ ~> Systemdrive: C:\

              IE: 7.0.5730.11

              --------- [ PROCESSES ] ---------

              C:\WINDOWS\System32\smss.exe
              C:\WINDOWS\system32\winlogon.exe
              C:\WINDOWS\system32\services.exe
              C:\WINDOWS\system32\lsass.exe
              C:\WINDOWS\system32\svchost.exe
              C:\WINDOWS\System32\svchost.exe
              C:\WINDOWS\Explorer.EXE
              C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
              C:\Program Files\Alwil Software\Avast4\ashServ.exe
              C:\WINDOWS\system32\spoolsv.exe
              C:\Program Files\EoRezo\EoEngine.exe
              C:\WINDOWS\system32\ctfmon.exe
              C:\Program Files\Microsoft ActiveSync\wcescomm.exe
              C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
              c:\program files\a-squared free\a2service.exe
              C:\PROGRA~1\MI3AA1~1\rapimgr.exe
              C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
              C:\Program Files\Bonjour\mDNSResponder.exe
              C:\WINDOWS\system32\drivers\CDAC11BA.EXE
              C:\Program Files\Micro Application\Les 4 Dictionnaires Utiles\MediaDICO4Ut.EXE
              C:\Program Files\Digital Media Center\DMGateway.exe
              C:\Program Files\Digital Media Center\WSR\DIGITAL MEDIA RECORDER SERVICE.EXE
              C:\Program Files\Digital Media Center\httpd\bin\httpd.exe
              C:\Program Files\Micro Application\Les 4 Dictionnaires Utiles\Rac4Ut.EXE
              C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
              C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE
              C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
              C:\WINDOWS\System32\svchost.exe
              C:\Program Files\Digital Media Center\httpd\bin\httpd.exe
              C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
              C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
              C:\Program Files\Digital Media Center\DigitalMediaCenter.exe
              C:\Program Files\FinePixViewer\QuickDCF2.exe
              C:\WINDOWS\System32\svchost.exe
              C:\Program Files\Digital Media Center\WgLaucher.exe
              C:\Program Files\Digital Media Center\AppServer.exe
              C:\WINDOWS\system32\cmd.exe
              C:\WINDOWS\System32\WScript.exe

              ---------------------------- [~> 38]

              +---------------------------------------------------------------------------+
              +------------------------------- SERVICES FOUND
              +---------------------------------------------------------------------------+

              +---------------------------------------------------------------------------+
              +------------------------------- REGISTRY ELEMENTS FOUND
              +---------------------------------------------------------------------------+

              "HKEY_LOCAL_MACHINE\SOFTWARE\EoRezo"
              "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\eoEngine_is1"
              "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64F56FC1-1272-44CD-BA6E-39723696E350}"
              "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run" /v "EoEngine"
              "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar" /v "{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}"
              "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{64F56FC1-1272-44CD-BA6E-39723696E350}"
              "HKEY_CURRENT_USER\SOFTWARE\EoRezo"
              "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{64F56FC1-1272-44CD-BA6E-39723696E350}"
              "HKEY_CLASSES_ROOT\EoRezoBHO.EoBho"
              "HKEY_CLASSES_ROOT\EoRezoBHO.EoBho.1"
              "HKEY_CLASSES_ROOT\Typelib\{B4C656C9-F2E9-4E77-B3F4-443DF2BD778F}"
              "HKEY_CLASSES_ROOT\Interface\{B0D071A1-36B3-4757-A126-14C89C56013A}"

              +---------------------------------------------------------------------------+
              +------------------------------- FILES\FOLDERS FOUND
              +---------------------------------------------------------------------------+

              [14/10/2008 10:27|d--------] C:\Program Files\EoRezo
              [09/11/2008 11:08|d--------] C:\Documents and Settings\CHRISTIAN\Application Data\EoRezo

              +---------- Scanning prefs.js ... ( # Mozilla User Preferences )

              ...\z02hh0h8.default\prefs.js :

              Start Page : "http://www.lo.st"

              +----------+

              +---------------------------------------------------------------------------+

              +---------- Added scan ...

              +-----[HKLM\...\Run]

              Adobe Reader Speed Launcher REG_SZ "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
              QuickTime Task REG_SZ "C:\WINDOWS\system32\qttask.exe" -atboottime
              EoEngine REG_SZ "C:\Program Files\EoRezo\EoEngine.exe"

              +-----[HKCU\...\Run]

              ctfmon.exe REG_SZ C:\WINDOWS\system32\ctfmon.exe
              MediaDICO4Ut REG_SZ C:\Program Files\Micro Application\Les 4 Dictionnaires Utiles\LanceMediaDICO4Ut.exe Lancement
              LogitechSoftwareUpdate REG_SZ "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
              LDM REG_SZ \Program\
              H/PC Connection Agent REG_SZ "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
              BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} REG_SZ "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
              Performance Center REG_SZ C:\Program Files\Ascentive\Performance Center\ApcMain.exe -m
              PC SpeedScan Pro REG_SZ C:\Program Files\Ascentive\PC SpeedScan Pro\PCSpeedScan.exe -m

              +-----[HKLM\...\Internet Explorer\MAIN]

              Start Page : hxxp://www.live.com/\0\0

              +-----[HKCU\...\Internet Explorer\MAIN]

              Start Page : hxxp://www.lo.st

              +---------------------------------------------------------------------------+
              +------------------------------- [ EOF - 106 lines ]
              +---------------------------------------------------------------------------+

              [ END at: 11:19:26 | 09/11/2008 ] - [ Time elapsed: 2 minutes, 22 seconds ]
              1. Destrio5 Modérateur
                /!\ Déconnecte-toi et ferme toutes applications en cours /!\

                - Clique droit sur AD-Remover et choisis Exécuter en tant qu'administrateur : au menu principal choisi l'option "B".

                --> Le programme va travailler...

                - Poste le rapport qui apparaît à la fin.

                (Le rapport est sauvegardé aussi sous C:\Ad-report.log)

                /!\ Si le Bureau ne réapparaît pas, presse Ctrl + Alt + Suppr, Onglet "Fichier", "Nouvelle tâche", tape explorer.exe et valide) /!\
                1. petitgalop Auteur
                  bonjour, ci-joint le rapport de AD-REMOVER apès la phase B

                  F --------- Logfile of AD-Remover 1.0.3.0 by C_XX ---------

                  START at: 12:09:53 | 09/11/2008
                  ON: Microsoft Windows XP [version 5.1.2600] ( Windows XP )
                  OPTION: Clean
                  EXECUTED FROM: C:\Program Files\Ad-remover\AD-Remover.bat
                  USER: CHRISTIAN | PC: CLOSS
                  BOOT MODE: Normal
                  DRIVE(S): A:\ ~> Systemdrive: C:\

                  IE: 7.0.5730.11

                  --------- [ PROCESSES ] ---------

                  C:\WINDOWS\System32\smss.exe
                  C:\WINDOWS\system32\winlogon.exe
                  C:\WINDOWS\system32\services.exe
                  C:\WINDOWS\system32\lsass.exe
                  C:\WINDOWS\system32\svchost.exe
                  C:\WINDOWS\System32\svchost.exe
                  C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                  C:\Program Files\Alwil Software\Avast4\ashServ.exe
                  C:\WINDOWS\system32\spoolsv.exe
                  C:\WINDOWS\system32\ctfmon.exe
                  C:\Program Files\Microsoft ActiveSync\wcescomm.exe
                  C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
                  c:\program files\a-squared free\a2service.exe
                  C:\PROGRA~1\MI3AA1~1\rapimgr.exe
                  C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                  C:\Program Files\Bonjour\mDNSResponder.exe
                  C:\WINDOWS\system32\drivers\CDAC11BA.EXE
                  C:\Program Files\Micro Application\Les 4 Dictionnaires Utiles\MediaDICO4Ut.EXE
                  C:\Program Files\Digital Media Center\DMGateway.exe
                  C:\Program Files\Digital Media Center\WSR\DIGITAL MEDIA RECORDER SERVICE.EXE
                  C:\Program Files\Digital Media Center\httpd\bin\httpd.exe
                  C:\Program Files\Micro Application\Les 4 Dictionnaires Utiles\Rac4Ut.EXE
                  C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
                  C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE
                  C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
                  C:\WINDOWS\System32\svchost.exe
                  C:\Program Files\Digital Media Center\httpd\bin\httpd.exe
                  C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                  C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                  C:\Program Files\Digital Media Center\DigitalMediaCenter.exe
                  C:\Program Files\FinePixViewer\QuickDCF2.exe
                  C:\WINDOWS\System32\svchost.exe
                  C:\Program Files\Digital Media Center\WgLaucher.exe
                  C:\Program Files\Digital Media Center\AppServer.exe
                  C:\WINDOWS\system32\cmd.exe
                  C:\WINDOWS\System32\WScript.exe

                  ---------------------------- [~> 36]

                  +---------------------------------------------------------------------------+
                  +------------------------------- SERVICES DELETED
                  +---------------------------------------------------------------------------+

                  +---------------------------------------------------------------------------+
                  +------------------------------- REGISTRY ELEMENTS DELETED
                  +---------------------------------------------------------------------------+

                  "HKEY_LOCAL_MACHINE\SOFTWARE\EoRezo"
                  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\eoEngine_is1"
                  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64F56FC1-1272-44CD-BA6E-39723696E350}"
                  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run" /v "EoEngine"
                  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar" /v "{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}"
                  "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{64F56FC1-1272-44CD-BA6E-39723696E350}"
                  "HKEY_CURRENT_USER\SOFTWARE\EoRezo"
                  "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{64F56FC1-1272-44CD-BA6E-39723696E350}"
                  "HKEY_CLASSES_ROOT\EoRezoBHO.EoBho"
                  "HKEY_CLASSES_ROOT\EoRezoBHO.EoBho.1"
                  "HKEY_CLASSES_ROOT\Typelib\{B4C656C9-F2E9-4E77-B3F4-443DF2BD778F}"
                  "HKEY_CLASSES_ROOT\Interface\{B0D071A1-36B3-4757-A126-14C89C56013A}"

                  +---------------------------------------------------------------------------+
                  +------------------------------- FILES\FOLDERS DELETED
                  +---------------------------------------------------------------------------+

                  [14/10/2008 10:27|d--------] C:\Program Files\EoRezo
                  [09/11/2008 12:04|d--------] C:\Documents and Settings\CHRISTIAN\Application Data\EoRezo

                  (!) ---- Temp files deleted.

                  (!) ---- Recycle bin emptied in all drives.

                  +---------- Scanning prefs.js ... ( # Mozilla User Preferences )

                  ...\z02hh0h8.default\prefs.js :

                  Start Page : "http://www.lo.st"

                  +----------+

                  +---------- Added scan ...

                  +-----[HKLM\...\Run]

                  Adobe Reader Speed Launcher REG_SZ "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
                  QuickTime Task REG_SZ "C:\WINDOWS\system32\qttask.exe" -atboottime

                  +-----[HKCU\...\Run]

                  ctfmon.exe REG_SZ C:\WINDOWS\system32\ctfmon.exe
                  MediaDICO4Ut REG_SZ C:\Program Files\Micro Application\Les 4 Dictionnaires Utiles\LanceMediaDICO4Ut.exe Lancement
                  LogitechSoftwareUpdate REG_SZ "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
                  LDM REG_SZ \Program\
                  H/PC Connection Agent REG_SZ "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
                  BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} REG_SZ "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
                  Performance Center REG_SZ C:\Program Files\Ascentive\Performance Center\ApcMain.exe -m
                  PC SpeedScan Pro REG_SZ C:\Program Files\Ascentive\PC SpeedScan Pro\PCSpeedScan.exe -m

                  +-----[HKLM\...\Internet Explorer\MAIN]

                  Start Page : hxxp://www.live.com/\0\0
                  Start Page : hxxp://fr.msn.com/

                  +-----[HKCU\...\Internet Explorer\MAIN]

                  Start Page : hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

                  +---------------------------------------------------------------------------+
                  +------------------------------- [ EOF - 103 lines ]
                  +---------------------------------------------------------------------------+
                  1. Destrio5 Modérateur
                    ---> Télécharge Malwarebytes' Anti-Malware (MBAM) sur ton Bureau.
                    ---> Double-clique sur le fichier téléchargé pour lancer le processus d'installation.
                    ---> Dans l'onglet Mise à jour, clique sur le bouton Recherche de mise à jour : si le pare-feu demande l'autorisation à MBAM de se connecter à Internet, accepte.
                    ---> Une fois la mise à jour terminée, rends-toi dans l'onglet Recherche.
                    ---> Sélectionne Exécuter un examen rapide.
                    ---> Clique sur Rechercher. L'analyse démarre.

                    A la fin de l'analyse, un message s'affiche :

                    L'examen s'est terminé normalement. Cliquez sur 'Afficher les résultats' pour afficher tous les objets trouvés.

                    ---> Clique sur OK pour poursuivre. Si MBAM n'a rien trouvé, il te le dira aussi.
                    ---> Ferme tes navigateurs.
                    Si des malwares ont été détectés, clique sur Afficher les résultats.
                    ---> Sélectionne tout (ou laisse coché) et clique sur Supprimer la sélection, MBAM va détruire les fichiers et clés de registre infectés et en mettre une copie dans la quarantaine.
                    ---> MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Copie-colle ce rapport dans ta prochaine réponse.
                    1. petitgalop Auteur
                      salut, voila le rapport de MBA, il a troué 25 malwares.

                      Malwarebytes' Anti-Malware 1.30
                      Version de la base de données: 1375
                      Windows 5.1.2600 Service Pack 2

                      09/11/2008 14:31:55
                      mbam-log-2008-11-09 (14-31-55).txt

                      Type de recherche: Examen rapide
                      Eléments examinés: 55610
                      Temps écoulé: 6 minute(s), 28 second(s)

                      Processus mémoire infecté(s): 0
                      Module(s) mémoire infecté(s): 0
                      Clé(s) du Registre infectée(s): 7
                      Valeur(s) du Registre infectée(s): 4
                      Elément(s) de données du Registre infecté(s): 0
                      Dossier(s) infecté(s): 3
                      Fichier(s) infecté(s): 11

                      Processus mémoire infecté(s):
                      (Aucun élément nuisible détecté)

                      Module(s) mémoire infecté(s):
                      (Aucun élément nuisible détecté)

                      Clé(s) du Registre infectée(s):
                      HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{5929cd6e-2062-44a4-b2c5-2c7e78fbab38} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
                      HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{944864a5-3916-46e2-96a9-a2e84f3f1208} (Adware.Accoona) -> Quarantined and deleted successfully.
                      HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{364b6276-c6c1-40b6-a6d7-6c48871fd707} (Adware.Accoona) -> Quarantined and deleted successfully.
                      HKEY_CLASSES_ROOT\TypeLib\{497dddb6-6eee-4561-9621-b77dc82c1f84} (Rogue.AscentivePerformance) -> Quarantined and deleted successfully.
                      HKEY_CLASSES_ROOT\Interface\{4e980492-027b-47f1-a7ab-ab086dacbb9e} (Rogue.AscentivePerformance) -> Quarantined and deleted successfully.
                      HKEY_CLASSES_ROOT\Interface\{5ead8321-fcbb-4c3f-888c-ac373d366c3f} (Rogue.AscentivePerformance) -> Quarantined and deleted successfully.
                      HKEY_CLASSES_ROOT\CLSID\{31f3cf6e-a71a-4daa-852b-39ac230940b4} (Rogue.AscentivePerformance) -> Quarantined and deleted successfully.

                      Valeur(s) du Registre infectée(s):
                      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINDOWS\system32\ConTest.dll (Rogue.AscentivePerformance) -> Quarantined and deleted successfully.
                      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINDOWS\system32\SysRestore.dll (Rogue.AscentivePerformance) -> Quarantined and deleted successfully.
                      HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PC SpeedScan Pro (Rogue.PCSpeedScan) -> Quarantined and deleted successfully.
                      HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Performance Center (Rogue.PCSpeedScan) -> Quarantined and deleted successfully.

                      Elément(s) de données du Registre infecté(s):
                      (Aucun élément nuisible détecté)

                      Dossier(s) infecté(s):
                      C:\Program Files\Ascentive (Rogue.Multiple) -> Quarantined and deleted successfully.
                      C:\Program Files\Ascentive\PC SpeedScan Pro (Rogue.Multiple) -> Quarantined and deleted successfully.
                      C:\Program Files\Ascentive\Performance Center (Rogue.Multiple) -> Quarantined and deleted successfully.

                      Fichier(s) infecté(s):
                      C:\WINDOWS\system32\ConTest.dll (Rogue.AscentivePerformance) -> Quarantined and deleted successfully.
                      C:\WINDOWS\system32\SysRestore.dll (Rogue.AscentivePerformance) -> Quarantined and deleted successfully.
                      C:\Program Files\Ascentive\Performance Centertemp.htm (Rogue.Multiple) -> Quarantined and deleted successfully.
                      C:\Program Files\Ascentive\PC SpeedScan Pro\PCSpeedScan.exe (Rogue.Multiple) -> Quarantined and deleted successfully.
                      C:\Program Files\Ascentive\PC SpeedScan Pro\SSRes.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
                      C:\Program Files\Ascentive\Performance Center\GUID (Rogue.Multiple) -> Quarantined and deleted successfully.
                      C:\Program Files\Setup.exe (Rogue.Installer) -> Quarantined and deleted successfully.
                      C:\WINDOWS\system32\oosoywo_navps.dat (Adware.NaviPromo) -> Quarantined and deleted successfully.
                      C:\WINDOWS\system32\oosoywo_nav.dat (Adware.NaviPromo) -> Quarantined and deleted successfully.
                      C:\WINDOWS\system32\nvs2.inf (Adware.EGDAccess) -> Quarantined and deleted successfully.
                      C:\Documents and Settings\All Users\Bureau\Spyware Striker Update.url (Rogue.Multiple) -> Quarantined and deleted successfully.
                      1. Destrio5 Modérateur
                        ---> Relance MBAM, va dans Quarantaine et supprime tout.

                        - Télécharge Navilog1 (de IL-MAFIOSO) et enregistre-le sur le bureau :
                        http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe

                        - Double-clique sur Navilog1.exe afin de lancer l'installation

                        - Si le fix ne se lance pas automatiquement après son installation, double-clique sur Navilog1 présent sur le bureau

                        - Appuie sur F ou f puis valide par Entrée

                        - Appuie sur une touche de ton clavier à chaque fois que cela est demandé, tu arriveras au menu des options

                        - Choisis l'option 1 et appuie sur la touche Entrée pour valider ton choix

                        - Patiente jusqu'au message : *** Analyse terminée le ..... ***

                        - Le scan fini, le bloc-notes contenant le rapport sera affiché, poste le contenu de ce rapport dans ta prochaine réponse

                        - Si le résultat du scan ne s'affiche pas, tu le trouveras dans C:\fixnavi.txt

                        N'utilise pas l'option 2, 3 et 4 sans notre accord, des fichiers légitimes peuvent être inclus dans ce scan.
                        1. petitgalop Auteur
                          bonjour, j'ai un peu de retard, mais voila le rapport de navilo1

                          Search Navipromo version 3.5.5 commencé le 10/11/2008 à 12:30:58,56

                          !!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
                          !!! Postez ce rapport sur le forum pour le faire analyser !!!
                          !!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

                          Outil exécuté depuis C:\Program Files\navilog1
                          Session actuelle : "CHRISTIAN"

                          Mise à jour le 29.04.2008 à 20h00 par IL-MAFIOSO

                          Microsoft Windows XP [version 5.1.2600]
                          Internet Explorer : 7.0.5730.11
                          Système de fichiers : NTFS

                          Executé en mode normal

                          *** Recherche Programmes installés ***

                          *** Recherche dossiers dans "C:\WINDOWS" ***

                          *** Recherche dossiers dans "C:\Program Files" ***

                          *** Recherche dossiers dans "c:\docume~1\alluse~1\applic~1" ***

                          *** Recherche dossiers dans "c:\docume~1\alluse~1\menudm~1\progra~1" ***

                          *** Recherche dossiers dans "C:\Documents and Settings\CHRISTIAN\applic~1" ***

                          *** Recherche dossiers dans "C:\Documents and Settings\CHRISTIAN\locals~1\applic~1" ***

                          *** Recherche dossiers dans "C:\Documents and Settings\CHRISTIAN\menudm~1\progra~1" ***

                          ...\WebMediaPlayer trouvé !

                          *** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
                          pour + d'infos : http://www.gmer.net

                          Aucun Fichier trouvé

                          *** Recherche avec GenericNaviSearch ***
                          !!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
                          !!! A vérifier impérativement avant toute suppression manuelle !!!

                          * Recherche dans "C:\WINDOWS\system32" *

                          * Recherche dans "C:\Documents and Settings\CHRISTIAN\locals~1\applic~1" *

                          *** Recherche fichiers ***

                          C:\WINDOWS\pack.epk trouvé !

                          *** Recherche clés spécifiques dans le Registre ***

                          HKEY_CURRENT_USER\Software\Lanconfig trouvé !

                          *** Module de Recherche complémentaire ***
                          (Recherche fichiers spécifiques)

                          1)Recherche nouveaux fichiers Instant Access :

                          2)Recherche Heuristique :

                          * Dans "C:\WINDOWS\system32" :

                          lrbnzazqk_navfx.dat trouvé !
                          oosoywo.dat trouvé !

                          * Dans "C:\Documents and Settings\CHRISTIAN\locals~1\applic~1" :

                          3)Recherche Certificats :

                          Certificat Egroup trouvé !
                          Certificat Electronic-Group trouvé !
                          Certificat OOO-Favorit trouvé !
                          Certificat Sunny-Day-Design-Ltd absent !

                          4)Recherche fichiers connus :

                          *** Analyse terminée le 10/11/2008 à 12:40:49,39 ***
                          1. Destrio5 Modérateur
                            ---> Relance Navilog1, fais l'option 2 et poste le rapport.
                            1. petitgalop Auteur
                              salut , ci-joint rapport après phase 2

                              Clean Navipromo version 3.5.5 commencé le 10/11/2008 à 13:46:09,37

                              Outil exécuté depuis C:\Program Files\navilog1
                              Session actuelle : "CHRISTIAN"

                              Mise à jour le 29.04.2008 à 20h00 par IL-MAFIOSO

                              Microsoft Windows XP [version 5.1.2600]
                              Internet Explorer : 7.0.5730.11
                              Système de fichiers : NTFS

                              Mode suppression automatique
                              avec prise en charge résultats Catchme et GNS

                              *** fsbl1.txt non trouvé ***
                              (Assurez-vous que Catchme n'avait rien trouvé lors de la recherche)

                              *** Suppression avec sauvegardes résultats GenericNaviSearch ***

                              * Suppression dans "C:\WINDOWS\System32" *

                              * Suppression dans "C:\Documents and Settings\CHRISTIAN\locals~1\applic~1" *

                              *** Suppression dossiers dans "C:\WINDOWS" ***

                              *** Suppression dossiers dans "C:\Program Files" ***

                              *** Suppression dossiers dans "c:\docume~1\alluse~1\applic~1" ***

                              *** Suppression dossiers dans "c:\docume~1\alluse~1\menudm~1\progra~1" ***

                              *** Suppression dossiers dans "C:\Documents and Settings\CHRISTIAN\applic~1" ***

                              *** Suppression dossiers dans "C:\Documents and Settings\CHRISTIAN\locals~1\applic~1" ***

                              *** Suppression dossiers dans "C:\Documents and Settings\CHRISTIAN\menudm~1\progra~1" ***

                              ...\WebMediaPlayer ...suppression...
                              ...\WebMediaPlayer supprimé !

                              *** Suppression fichiers ***

                              C:\WINDOWS\pack.epk supprimé !

                              *** Suppression fichiers temporaires ***

                              Nettoyage contenu C:\WINDOWS\Temp effectué !
                              Nettoyage contenu C:\Documents and Settings\CHRISTIAN\locals~1\Temp effectué !

                              *** Traitement Recherche complémentaire ***
                              (Recherche fichiers spécifiques)

                              1)Suppression avec sauvegardes nouveaux fichiers Instant Access :

                              2)Recherche, création sauvegardes et suppression Heuristique :

                              * Dans "C:\WINDOWS\system32" *

                              oosoywo.dat trouvé !
                              Copie oosoywo.dat réalisée avec succès !
                              oosoywo.dat supprimé !

                              lrbnzazqk_navfx.dat trouvé !
                              Copie lrbnzazqk_navfx.dat réalisée avec succès !
                              lrbnzazqk_navfx.dat supprimé !

                              * Dans "C:\Documents and Settings\CHRISTIAN\locals~1\applic~1" *

                              *** Sauvegarde du Registre vers dossier Safebackup ***

                              sauvegarde du Registre réalisée avec succès !

                              *** Nettoyage Registre ***

                              Nettoyage Registre Ok

                              *** Certificats ***

                              Certificat Egroup supprimé !
                              Certificat Electronic-Group supprimé !
                              Certificat OOO-Favorit supprimé !
                              Certificat Sunny-Day-Design-Ltdt absent !

                              *** Nettoyage terminé le 10/11/2008 à 13:51:58,28 ***
                              1. Destrio5 Modérateur
                                Tu n'utilises pas la dernière version de Navilog1.

                                ---> Désinstalle Navilog1.

                                - Télécharge Navilog1 (de IL-MAFIOSO) et enregistre-le sur le bureau :
                                http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe

                                - Double-clique sur Navilog1.exe afin de lancer l'installation

                                - Si le fix ne se lance pas automatiquement après son installation, double-clique sur Navilog1 présent sur le bureau

                                - Appuie sur F ou f puis valide par Entrée

                                - Appuie sur une touche de ton clavier à chaque fois que cela est demandé, tu arriveras au menu des options

                                - Choisis l'option 1 et appuie sur la touche Entrée pour valider ton choix

                                - Patiente jusqu'au message : *** Analyse terminée le ..... ***

                                - Le scan fini, le bloc-notes contenant le rapport sera affiché, poste le contenu de ce rapport dans ta prochaine réponse

                                - Si le résultat du scan ne s'affiche pas, tu le trouveras dans C:\fixnavi.txt

                                N'utilise pas l'option 2, 3 et 4 sans notre accord, des fichiers légitimes peuvent être inclus dans ce scan.
                                1. petitgalop Auteur
                                  bonjour, voila le scan avec la derniere version de navilo1

                                  Search Navipromo version 3.6.9 commencé le 11/11/2008 à 11:33:37,21

                                  !!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
                                  !!! Postez ce rapport sur le forum pour le faire analyser !!!
                                  !!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

                                  Outil exécuté depuis C:\Program Files\navilog1
                                  Session actuelle : "CHRISTIAN"

                                  Mise à jour le 05.11.2008 à 21h00 par IL-MAFIOSO

                                  Microsoft Windows XP [version 5.1.2600]
                                  Internet Explorer : 7.0.5730.11
                                  Système de fichiers : NTFS

                                  Recherche executé en mode normal

                                  *** Recherche Programmes installés ***

                                  *** Recherche dossiers dans "C:\WINDOWS" ***

                                  *** Recherche dossiers dans "C:\Program Files" ***

                                  *** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" ***

                                  *** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1" ***

                                  *** Recherche dossiers dans "c:\docume~1\alluse~1\applic~1" ***

                                  *** Recherche dossiers dans "C:\Documents and Settings\CHRISTIAN\applic~1" ***

                                  *** Recherche dossiers dans "C:\Documents and Settings\CHRISTIAN\locals~1\applic~1" ***

                                  *** Recherche dossiers dans "C:\Documents and Settings\CHRISTIAN\menudm~1\progra~1" ***

                                  *** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
                                  pour + d'infos : http://www.gmer.net

                                  *** Recherche avec GenericNaviSearch ***
                                  !!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
                                  !!! A vérifier impérativement avant toute suppression manuelle !!!

                                  * Recherche dans "C:\WINDOWS\system32" *

                                  * Recherche dans "C:\Documents and Settings\CHRISTIAN\locals~1\applic~1" *

                                  *** Recherche fichiers ***

                                  *** Recherche clés spécifiques dans le Registre ***

                                  *** Module de Recherche complémentaire ***
                                  (Recherche fichiers spécifiques)

                                  1)Recherche nouveaux fichiers Instant Access :

                                  2)Recherche Heuristique :

                                  * Dans "C:\WINDOWS\system32" :

                                  * Dans "C:\Documents and Settings\CHRISTIAN\locals~1\applic~1" :

                                  3)Recherche Certificats :

                                  Certificat Egroup absent !
                                  Certificat Electronic-Group absent !
                                  Certificat Montorgueil absent !
                                  Certificat OOO-Favorit absent !
                                  Certificat Sunny-Day-Design-Ltd absent !

                                  4)Recherche fichiers connus :

                                  *** Analyse terminée le 11/11/2008 à 11:44:18,21 ***
                                  2. petitgalop Auteur
                                    salut, voila le rapportdu scan avec RSIT.

                                    Logfile of random's system information tool 1.04 (written by random/random)
                                    Run by CHRISTIAN at 2008-11-11 21:51:36
                                    Microsoft Windows XP Professionnel Service Pack 2
                                    System drive C: has 118 GB (49%) free of 239 GB
                                    Total RAM: 1279 MB (57% free)

                                    Logfile of Trend Micro HijackThis v2.0.2
                                    Scan saved at 21:51:58, on 11/11/2008
                                    Platform: Windows XP SP2 (WinNT 5.01.2600)
                                    MSIE: Internet Explorer v7.00 (7.00.6000.16544)
                                    Boot mode: Normal

                                    Running processes:
                                    C:\WINDOWS\System32\smss.exe
                                    C:\WINDOWS\system32\winlogon.exe
                                    C:\WINDOWS\system32\services.exe
                                    C:\WINDOWS\system32\lsass.exe
                                    C:\WINDOWS\system32\svchost.exe
                                    C:\WINDOWS\System32\svchost.exe
                                    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                                    C:\Program Files\Alwil Software\Avast4\ashServ.exe
                                    C:\WINDOWS\Explorer.EXE
                                    C:\WINDOWS\system32\spoolsv.exe
                                    C:\WINDOWS\system32\ctfmon.exe
                                    C:\Program Files\Microsoft ActiveSync\wcescomm.exe
                                    C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
                                    C:\Program Files\Digital Media Center\DigitalMediaCenter.exe
                                    C:\Program Files\FinePixViewer\QuickDCF2.exe
                                    C:\PROGRA~1\MI3AA1~1\rapimgr.exe
                                    c:\program files\a-squared free\a2service.exe
                                    C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                                    C:\Program Files\Micro Application\Les 4 Dictionnaires Utiles\MediaDICO4Ut.EXE
                                    C:\Program Files\Bonjour\mDNSResponder.exe
                                    C:\WINDOWS\system32\drivers\CDAC11BA.EXE
                                    C:\Program Files\Digital Media Center\DMGateway.exe
                                    C:\Program Files\Micro Application\Les 4 Dictionnaires Utiles\Rac4Ut.EXE
                                    C:\Program Files\Digital Media Center\WSR\DIGITAL MEDIA RECORDER SERVICE.EXE
                                    C:\Program Files\Digital Media Center\httpd\bin\httpd.exe
                                    C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
                                    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE
                                    C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
                                    C:\WINDOWS\System32\svchost.exe
                                    C:\Program Files\Digital Media Center\httpd\bin\httpd.exe
                                    C:\Program Files\Digital Media Center\WgLaucher.exe
                                    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                                    C:\Program Files\Digital Media Center\AppServer.exe
                                    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                                    C:\WINDOWS\System32\svchost.exe
                                    C:\Documents and Settings\CHRISTIAN\Bureau\RSIT.exe
                                    C:\Program Files\trend micro\CHRISTIAN.exe

                                    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://actus.sfr.fr
                                    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
                                    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://actus.sfr.fr
                                    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                                    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
                                    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://actus.sfr.fr
                                    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
                                    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = https://support.microsoft.com/en-US/topic/internet-explorer-downloads-d49e1f0d-571c-9a7b-d97e-be248806ca70
                                    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
                                    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
                                    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
                                    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                                    O1 - Hosts: 66.98.148.65 auto.search.msn.com
                                    O1 - Hosts: 66.98.148.65 auto.search.msn.es
                                    O1 - Hosts: 127.255.255.255 serial.alcohol-soft.com
                                    O1 - Hosts: 127.255.255.255 www.alcohol-soft.com
                                    O1 - Hosts: 127.255.255.255 images.alcohol-soft.com
                                    O2 - BHO: (no name) - {0EEDB912-C5FA-486F-8334-57288578C627} - (no file)
                                    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
                                    O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
                                    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
                                    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
                                    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
                                    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                                    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                                    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                                    O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
                                    O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
                                    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
                                    O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\system32\qttask.exe" -atboottime
                                    O4 - HKLM\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t
                                    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                                    O4 - HKCU\..\Run: [MediaDICO4Ut] C:\Program Files\Micro Application\Les 4 Dictionnaires Utiles\LanceMediaDICO4Ut.exe Lancement
                                    O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
                                    O4 - HKCU\..\Run: [LDM] \Program\
                                    O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
                                    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
                                    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
                                    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                                    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
                                    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
                                    O4 - Global Startup: Digital Media Center.lnk = C:\Program Files\Digital Media Center\DigitalMediaCenter.exe
                                    O4 - Global Startup: ExifLauncher2.lnk = C:\Program Files\FinePixViewer\QuickDCF2.exe
                                    O4 - Global Startup: Postit Renkar.exe
                                    O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
                                    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
                                    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
                                    O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
                                    O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
                                    O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
                                    O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
                                    O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll
                                    O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
                                    O9 - Extra button: Organise-notes - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Researcher\EROPROJ.DLL
                                    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                                    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                                    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                                    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                                    O16 - DPF: {3A226D85-574D-4272-B73C-DBCAECF709B3} (TNSClickerb.Clicker) - http://www.consoclicker.com/TNSClickrb.CAB
                                    O16 - DPF: {48DF87EE-F2DE-11D8-BE7F-302050C10812} (FlyLoader Class) - http://www.flysuite.com/flycalc/loadercalc_win_fr.cab
                                    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
                                    O16 - DPF: {70A5EBDC-3EA6-464A-9FF7-084BC150C417} (TNSClickera.Clicker) - http://www.consoclicker.com/TNSClickra.CAB
                                    O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
                                    O16 - DPF: {B79A53C0-1DAC-4636-BACE-FD086A7A79BF} (AdSignerLCContrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
                                    O17 - HKLM\System\CCS\Services\Tcpip\..\{7F5FB5C4-FE4D-466B-813A-40D7E57CEF88}: Domain = chu-besancon.priv
                                    O17 - HKLM\System\CCS\Services\Tcpip\..\{7F5FB5C4-FE4D-466B-813A-40D7E57CEF88}: NameServer = 192.168.229.200,192.168.129.33
                                    O18 - Protocol: bw+0 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw+0s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw-0 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw-0s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw00 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw00s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw10 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw10s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw20 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw20s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw30 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw30s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw40 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw40s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw50 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw50s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw60 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw60s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw70 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw70s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw80 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw80s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw90 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bw90s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwa0 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwa0s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwb0 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwb0s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwc0 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwc0s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwd0 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwd0s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwe0 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwe0s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwf0 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwf0s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
                                    O18 - Protocol: bwg0 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwg0s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwh0 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwh0s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwi0 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwi0s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwj0 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwj0s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwk0 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwk0s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwl0 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwl0s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwm0 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwm0s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwn0 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwn0s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwo0 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwo0s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwp0 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwp0s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwq0 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwq0s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwr0 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwr0s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bws0 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bws0s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwt0 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwt0s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwu0 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwu0s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwv0 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwv0s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bww0 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bww0s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwx0 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwx0s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwy0 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwy0s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwz0 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: bwz0s - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: offline-8876480 - {9AD2CFE4-66C0-4F66-B687-41B13C36AA72} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
                                    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
                                    O21 - SSODL: died - {7fa55359-7223-410f-bc82-efb3e3ded07f} - (no file)
                                    O22 - SharedTaskScheduler: died - {7fa55359-7223-410f-bc82-efb3e3ded07f} - (no file)
                                    O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - c:\program files\a-squared free\a2service.exe
                                    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
                                    O23 - Service: ADSLAutoconnect - Unknown owner - C:\Program Files\ADSL Autoconnect\ADSL Autoconnect.exe
                                    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                                    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                                    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                                    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                                    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                                    O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
                                    O23 - Service: C-DillaCdaC11BA - C-Dilla Ltd - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
                                    O23 - Service: Digital Media Gateway - Worldsat - C:\Program Files\Digital Media Center\DMGateway.exe
                                    O23 - Service: Digital Media Recorder Service - WorldSat - C:\Program Files\Digital Media Center\WSR\DIGITAL MEDIA RECORDER SERVICE.EXE
                                    O23 - Service: Digital Media HTTPd (DigitalMediaHTTPd) - Apache Software Foundation - C:\Program Files\Digital Media Center\httpd\bin\httpd.exe
                                    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
                                    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                                    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
                                    O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
                                    O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
                                    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE
                                    O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
                                    1. petitgalop Auteur
                                      bonjour, j'ai fait les etapes 1 et 2 avant de poster ce rapport.ci-joint le rapport de smitfraudfix, si tu pouvais m'expliquer brievement ce qui arrive a mon pc, cela serai bien, autrement, merci pour tout.
                                      SmitFraudFix v2.374

                                      Rapport fait à 10:35:54,90, 12/11/2008
                                      Executé à partir de C:\Documents and Settings\CHRISTIAN\Bureau\SmitfraudFix
                                      OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
                                      Le type du système de fichiers est NTFS
                                      Fix executé en mode normal

                                      »»»»»»»»»»»»»»»»»»»»»»»» Process

                                      C:\WINDOWS\System32\smss.exe
                                      C:\WINDOWS\system32\winlogon.exe
                                      C:\WINDOWS\system32\services.exe
                                      C:\WINDOWS\system32\lsass.exe
                                      C:\WINDOWS\system32\svchost.exe
                                      C:\WINDOWS\System32\svchost.exe
                                      C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                                      C:\Program Files\Alwil Software\Avast4\ashServ.exe
                                      C:\WINDOWS\Explorer.EXE
                                      C:\WINDOWS\system32\spoolsv.exe
                                      C:\WINDOWS\system32\ctfmon.exe
                                      C:\Program Files\Microsoft ActiveSync\wcescomm.exe
                                      C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
                                      C:\Program Files\Digital Media Center\DigitalMediaCenter.exe
                                      C:\Program Files\FinePixViewer\QuickDCF2.exe
                                      c:\program files\a-squared free\a2service.exe
                                      C:\PROGRA~1\MI3AA1~1\rapimgr.exe
                                      C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                                      C:\Program Files\Bonjour\mDNSResponder.exe
                                      C:\Program Files\Micro Application\Les 4 Dictionnaires Utiles\MediaDICO4Ut.EXE
                                      C:\WINDOWS\system32\drivers\CDAC11BA.EXE
                                      C:\Program Files\Digital Media Center\DMGateway.exe
                                      C:\Program Files\Digital Media Center\WSR\DIGITAL MEDIA RECORDER SERVICE.EXE
                                      C:\Program Files\Micro Application\Les 4 Dictionnaires Utiles\Rac4Ut.EXE
                                      C:\Program Files\Digital Media Center\httpd\bin\httpd.exe
                                      C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
                                      C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE
                                      C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
                                      C:\WINDOWS\System32\svchost.exe
                                      C:\Program Files\Digital Media Center\httpd\bin\httpd.exe
                                      C:\Program Files\Digital Media Center\WgLaucher.exe
                                      C:\Program Files\Digital Media Center\AppServer.exe
                                      C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                                      C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
                                      C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                                      C:\WINDOWS\System32\svchost.exe
                                      C:\WINDOWS\system32\wuauclt.exe
                                      C:\Documents and Settings\CHRISTIAN\Bureau\SmitfraudFix\Policies.exe
                                      C:\WINDOWS\system32\cmd.exe

                                      »»»»»»»»»»»»»»»»»»»»»»»» hosts

                                      »»»»»»»»»»»»»»»»»»»»»»»» C:\

                                      C:\autorun.inf PRESENT !

                                      »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

                                      »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

                                      »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

                                      »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

                                      »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

                                      »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\CHRISTIAN

                                      »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\CHRIST~1\LOCALS~1\Temp

                                      »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\CHRISTIAN\Application Data

                                      »»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

                                      »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\CHRIST~1\Favoris

                                      »»»»»»»»»»»»»»»»»»»»»»»» Bureau

                                      »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

                                      »»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

                                      »»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

                                      [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
                                      "Source"="About:Home"
                                      "SubscribedURL"="About:Home"
                                      "FriendlyName"="Ma page d'accueil"

                                      »»»»»»»»»»»»»»»»»»»»»»»» o4Patch
                                      !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                                      o4Patch
                                      Credits: Malware Analysis & Diagnostic
                                      Code: S!Ri

                                      »»»»»»»»»»»»»»»»»»»»»»»» IEDFix
                                      !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                                      IEDFix
                                      Credits: Malware Analysis & Diagnostic
                                      Code: S!Ri

                                      »»»»»»»»»»»»»»»»»»»»»»»» VACFix
                                      !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                                      VACFix
                                      Credits: Malware Analysis & Diagnostic
                                      Code: S!Ri

                                      »»»»»»»»»»»»»»»»»»»»»»»» 404Fix
                                      !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                                      404Fix
                                      Credits: Malware Analysis & Diagnostic
                                      Code: S!Ri

                                      »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
                                      !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                                      SrchSTS.exe by S!Ri
                                      Search SharedTaskScheduler's .dll

                                      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
                                      "{7fa55359-7223-410f-bc82-efb3e3ded07f}"="died"

                                      »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
                                      !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                                      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
                                      "AppInit_DLLs"=""

                                      »»»»»»»»»»»»»»»»»»»»»»»» Winlogon
                                      !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                                      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
                                      "Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
                                      "System"=""

                                      »»»»»»»»»»»»»»»»»»»»»»»» RK

                                      »»»»»»»»»»»»»»»»»»»»»»»» DNS

                                      Description: Broadcom NetXtreme Gigabit Ethernet - Miniport d'ordonnancement de paquets
                                      DNS Server Search Order: 192.168.229.200
                                      DNS Server Search Order: 192.168.129.33

                                      Description: Broadcom NetXtreme Gigabit Ethernet - Miniport d'ordonnancement de paquets
                                      DNS Server Search Order: 192.168.1.1

                                      HKLM\SYSTEM\CCS\Services\Tcpip\..\{044B9C21-DF7F-402B-8FD4-6271B249F426}: DhcpNameServer=192.168.1.1
                                      HKLM\SYSTEM\CCS\Services\Tcpip\..\{7F5FB5C4-FE4D-466B-813A-40D7E57CEF88}: NameServer=192.168.229.200,192.168.129.33
                                      HKLM\SYSTEM\CS1\Services\Tcpip\..\{044B9C21-DF7F-402B-8FD4-6271B249F426}: DhcpNameServer=192.168.1.1
                                      HKLM\SYSTEM\CS1\Services\Tcpip\..\{7F5FB5C4-FE4D-466B-813A-40D7E57CEF88}: NameServer=192.168.229.200,192.168.129.33
                                      HKLM\SYSTEM\CS3\Services\Tcpip\..\{044B9C21-DF7F-402B-8FD4-6271B249F426}: DhcpNameServer=192.168.1.1
                                      HKLM\SYSTEM\CS3\Services\Tcpip\..\{7F5FB5C4-FE4D-466B-813A-40D7E57CEF88}: NameServer=192.168.229.200,192.168.129.33
                                      HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
                                      HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
                                      HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1

                                      »»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

                                      »»»»»»»»»»»»»»»»»»»»»»»» Fin
                                      1. petitgalop Auteur
                                        salut, voila le rapport phse 2 de smitfraudfix. En redemarrant le pc en mode mormal, l'imade de fond a dispurrue, et les icônes ont une taille plus petites.

                                        SmitFraudFix v2.374

                                        Rapport fait à 14:07:30,78, 12/11/2008
                                        Executé à partir de C:\Documents and Settings\CHRISTIAN\Bureau\SmitfraudFix
                                        OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
                                        Le type du système de fichiers est NTFS
                                        Fix executé en mode sans echec

                                        »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
                                        !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                                        SrchSTS.exe by S!Ri
                                        Search SharedTaskScheduler's .dll

                                        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
                                        "{7fa55359-7223-410f-bc82-efb3e3ded07f}"="died"

                                        »»»»»»»»»»»»»»»»»»»»»»»» Arret des processus

                                        »»»»»»»»»»»»»»»»»»»»»»»» hosts

                                        127.0.0.1 localhost

                                        »»»»»»»»»»»»»»»»»»»»»»»» VACFix

                                        VACFix
                                        Credits: Malware Analysis & Diagnostic
                                        Code: S!Ri

                                        »»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

                                        S!Ri's WS2Fix: LSP not Found.
                                        »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

                                        GenericRenosFix by S!Ri

                                        »»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés

                                        Problème suppression C:\autorun.inf

                                        »»»»»»»»»»»»»»»»»»»»»»»» IEDFix

                                        IEDFix
                                        Credits: Malware Analysis & Diagnostic
                                        Code: S!Ri

                                        »»»»»»»»»»»»»»»»»»»»»»»» 404Fix

                                        404Fix
                                        Credits: Malware Analysis & Diagnostic
                                        Code: S!Ri

                                        »»»»»»»»»»»»»»»»»»»»»»»» RK

                                        »»»»»»»»»»»»»»»»»»»»»»»» DNS

                                        HKLM\SYSTEM\CCS\Services\Tcpip\..\{044B9C21-DF7F-402B-8FD4-6271B249F426}: DhcpNameServer=192.168.1.1
                                        HKLM\SYSTEM\CCS\Services\Tcpip\..\{7F5FB5C4-FE4D-466B-813A-40D7E57CEF88}: NameServer=192.168.229.200,192.168.129.33
                                        HKLM\SYSTEM\CS1\Services\Tcpip\..\{044B9C21-DF7F-402B-8FD4-6271B249F426}: DhcpNameServer=192.168.1.1
                                        HKLM\SYSTEM\CS1\Services\Tcpip\..\{7F5FB5C4-FE4D-466B-813A-40D7E57CEF88}: NameServer=192.168.229.200,192.168.129.33
                                        HKLM\SYSTEM\CS3\Services\Tcpip\..\{044B9C21-DF7F-402B-8FD4-6271B249F426}: DhcpNameServer=192.168.1.1
                                        HKLM\SYSTEM\CS3\Services\Tcpip\..\{7F5FB5C4-FE4D-466B-813A-40D7E57CEF88}: NameServer=192.168.229.200,192.168.129.33
                                        HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
                                        HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
                                        HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1

                                        »»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires

                                        »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
                                        !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                                        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
                                        "System"=""

                                        »»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre

                                        Nettoyage terminé.

                                        »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Après SmitFraudFix
                                        !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                                        SrchSTS.exe by S!Ri
                                        Search SharedTaskScheduler's .dll

                                        »»»»»»»»»»»»»»»»»»»»»»»» Fin
                                        • 1
                                        • 2

                                        Discussions similaires

                                        Ouvrir un fichier .pub sans Publisher
                                        baissaoui

                                        0 réponse
                                        Lire, afficher, exécuter un fichier *.pub sans Publisher
                                        jeannoellaurenti

                                        1 réponse
                                        Ouvrir document Publisher sans Publisher
                                        Curtis Hayes

                                        7 réponses
                                        Publicité "Bidru n'en peut plus"
                                        _Ritchi_

                                        5 réponses
                                        musique de pub
                                        zabou

                                        7 réponses