'gros virus' et 'bagle'

Salut !

Commence déjà par virer tes logiciels/programes crackés...

Bon courage.

Télécharge FindyKill (par Chiquitine29) sur ton bureau :
http://sd-1.archive-host.com/membres/up/116615172019703188/FindyKill.exe

Ø Lance l'installation avec les paramètres par defaut

Ø Double-clique sur le raccourci FindyKill sur ton bureau

Ø Au menu principal, choisis l'option * 1 * (Recherche)

Ø Poste le rapport FindyKill.txt

Note : le rapport FindyKill.txt est sauvegardé à la racine du disque.

Salut,

===================POUR LES UTILISATEURS DE VISTA=========================
=>< Désactive le « contrôle des comptes utilisateurs = UAC »
(tu le réactiveras après ta désinfection): Ne pas oublier !!
Désactiver l'UAC est nécessaire pour pouvoir faire fonctionner certains programmes sous Vista.
- Vas dans Démarrer puis panneau de configuration
- Double Clique sur l'icône "Comptes d'utilisateurs"
- Clique ensuite sur désactiver et valide.

==>NOTE:
=><Avant tout emploi de logiciel, s’assurer que les protections de registres tel que le Tea Timer de spybot sont désactivées (notamment lors de l’emploi d’HijackThis)
Spybot=>mode avancé=> outils => résident
Décocher la case résident "tea timer"

Refermer Spybot.

télécharge hijackthis
-> enregistre la cible sous .... "le bureau"

-> Fais un double-clic sur "HJTInstall.exe" afin de lancer l'installation

-> Clique sur Install ensuite sur "I Accept"

-> Clique sur" Do a scan system and save log file"

-> Le bloc-notes s'ouvrira, fais un copier-coller de tout son contenu ici dans ta prochaine réponse

->Tuto hijackthis

Slt, c'est simpa de m'avoir repondu rapidement, merci.

Goldorak si tu lis bien mon message j'ai deja fait sa lol et bagle est senser 'mettre hors service les antivirus'.Peut etre que je tire une conclusion trop hative, ce n'est peut etre pas un bagle mais toute fois j'en avait déja eu un avant, et sa me fesait le meme message quand j'esseyer d'activer un antivirus.J'avais éliminé ce bagle avec elibagla mais la elibagla n'a rien detecter.

Jorginho, j'ai normalement supprimer tous les crack... d'ailleur il se peut que sa soit l'origine vu que j'ai telecharger un crack quelques temp avant... Mais le bagle est toujours la s: alors si tu a d'autres idées dit les moi stp, et aussi j'aimerais savoir si un bagle est infectueux... si il peux se dupliquer ou allez sur d'autre fichiers comme sa.

Merci, à bientot

Bye

Slt, j'ai telecharger findykill et voici le rapport :

----------------- FindyKill V4.700 ------------------

* User : HP_Administrateur - NOM-FB9B15D2723
* Emplacement : C:\Program Files\FindyKill
* Outils Mis a jours le 13/11/08 par Chiquitine29
* Recherche effectuée à 20:28:39 le 14/11/2008
* Windows XP - Internet Explorer 6.0.2900.2180

((((((((((((((((( *** Recherche *** ))))))))))))))))))

--------------- [ Processus actifs ] ----------------

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology Drivers\Elservice.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
C:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe
C:\HP\KBD\KBD.EXE
c:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\drivers\downld\3949343.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe

--------------- [ Processus infectieux stoppés ] ----------------

"C:\WINDOWS\system32\drivers\downld\3949343.exe" (2344)

--------------- [ Fichiers/Dossiers infectieux ] ----------------

»»»» Presence des fichiers dans C:

Found ! [13/11/2008 23:06] - "C:\Muestras"
Found ! [14/11/2008 20:16] - C:\InfoSat.txt

»»»» Presence des fichiers dans C:\WINDOWS

»»»» Presence des fichiers dans C:\WINDOWS\Prefetch

Found ! - C:\WINDOWS\prefetch\1185315157.EXE-0CEC3252.pf
Found ! - C:\WINDOWS\prefetch\1185318494.EXE-2CE0A5FE.pf
Found ! - C:\WINDOWS\Prefetch\W3XCDKEYGRABBER12201.EXE-2BA793EF.pf
Found ! - C:\WINDOWS\Prefetch\PATCHJRE.EXE-065EAC0D.pf

»»»» Presence des fichiers dans C:\WINDOWS\system32

Found ! [14/11/2008 19:13] - C:\WINDOWS\system32\mdelk.exe
Found ! [14/11/2008 19:13] - C:\WINDOWS\system32\wintems.exe

»»»» Presence des fichiers dans C:\WINDOWS\system32\drivers

Found ! [14/11/2008 19:10] - C:\WINDOWS\system32\drivers\srosa.sys
Found ! [14/11/2008 19:10] - C:\WINDOWS\system32\drivers\srosa2.sys
Found ! [15/07/2004 01:06] - C:\WINDOWS\system32\drivers\winfilse.exe
Found ! [14/11/2008 20:19] - "C:\WINDOWS\system32\drivers\downld"
Found ! [14/11/2008 20:19] C:\WINDOWS\system32\drivers\downld\100640.exe
Found ! [14/11/2008 20:19] C:\WINDOWS\system32\drivers\downld\103015.exe
Found ! [14/11/2008 20:19] C:\WINDOWS\system32\drivers\downld\105453.exe
Found ! [14/11/2008 20:19] C:\WINDOWS\system32\drivers\downld\109156.exe
Found ! [14/11/2008 20:19] C:\WINDOWS\system32\drivers\downld\110468.exe
Found ! [14/11/2008 20:19] C:\WINDOWS\system32\drivers\downld\113203.exe
Found ! [14/11/2008 20:19] C:\WINDOWS\system32\drivers\downld\114531.exe
Found ! [14/11/2008 20:19] C:\WINDOWS\system32\drivers\downld\1153781.exe
Found ! [14/11/2008 20:19] C:\WINDOWS\system32\drivers\downld\1156953.exe
Found ! [14/11/2008 20:19] C:\WINDOWS\system32\drivers\downld\1164906.exe
Found ! [14/11/2008 20:19] C:\WINDOWS\system32\drivers\downld\1168296.exe
Found ! [14/11/2008 20:19] C:\WINDOWS\system32\drivers\downld\1174453.exe
Found ! [14/11/2008 20:19] C:\WINDOWS\system32\drivers\downld\126796.exe
Found ! [14/11/2008 20:19] C:\WINDOWS\system32\drivers\downld\129484.exe
Found ! [14/11/2008 20:19] C:\WINDOWS\system32\drivers\downld\134671.exe
Found ! [14/11/2008 20:19] C:\WINDOWS\system32\drivers\downld\137531.exe
Found ! [14/11/2008 20:19] C:\WINDOWS\system32\drivers\downld\173140.exe
Found ! [14/11/2008 20:19] C:\WINDOWS\system32\drivers\downld\175031.exe
Found ! [14/11/2008 20:19] C:\WINDOWS\system32\drivers\downld\205250.exe
Found ! [14/11/2008 20:19] C:\WINDOWS\system32\drivers\downld\206187.exe
Found ! [14/11/2008 20:19] C:\WINDOWS\system32\drivers\downld\220140.exe
Found ! [14/11/2008 20:19] C:\WINDOWS\system32\drivers\downld\224656.exe
Found ! [14/11/2008 20:19] C:\WINDOWS\system32\drivers\downld\226843.exe
Found ! [14/11/2008 20:19] C:\WINDOWS\system32\drivers\downld\233859.exe
Found ! [14/11/2008 20:19] C:\WINDOWS\system32\drivers\downld\234937.exe
Found ! [14/11/2008 20:19] C:\WINDOWS\system32\drivers\downld\244187.exe
Found ! [14/11/2008 20:19] C:\WINDOWS\system32\drivers\downld\249406.exe
Found ! [14/11/2008 20:19] C:\WINDOWS\system32\drivers\downld\3941406.exe
Found ! [14/11/2008 20:19] C:\WINDOWS\system32\drivers\downld\3949343.exe
Found ! [14/11/2008 20:19] C:\WINDOWS\system32\drivers\downld\3952562.exe
Found ! [14/11/2008 20:19] C:\WINDOWS\system32\drivers\downld\4062468.exe
Found ! [14/11/2008 20:19] C:\WINDOWS\system32\drivers\downld\4104656.exe
Found ! [14/11/2008 20:19] C:\WINDOWS\system32\drivers\downld\59468.exe
Found ! [14/11/2008 20:19] C:\WINDOWS\system32\drivers\downld\61703.exe
Found ! [14/11/2008 20:19] C:\WINDOWS\system32\drivers\downld\65984.exe
Found ! [14/11/2008 20:19] C:\WINDOWS\system32\drivers\downld\67515.exe
Found ! [14/11/2008 20:19] C:\WINDOWS\system32\drivers\downld\70812.exe
Found ! [14/11/2008 20:19] C:\WINDOWS\system32\drivers\downld\71359.exe
Found ! [14/11/2008 20:19] C:\WINDOWS\system32\drivers\downld\72656.exe
Found ! [14/11/2008 20:19] C:\WINDOWS\system32\drivers\downld\88031.exe
Found ! [14/11/2008 20:19] C:\WINDOWS\system32\drivers\downld\89656.exe
Found ! [14/11/2008 20:19] C:\WINDOWS\system32\drivers\downld\89828.exe
Found ! [14/11/2008 20:19] C:\WINDOWS\system32\drivers\downld\91515.exe

»»»» Presence des fichiers dans C:\Documents and Settings\HP_Administrateur\Application Data

Found ! [14/11/2008 13:33] - "C:\Documents and Settings\HP_Administrateur\Application Data\m\flec006.exe"
Found ! [14/11/2008 19:14] - "C:\Documents and Settings\HP_Administrateur\Application Data\m\shared"
Found ! [14/11/2008 20:15] - "C:\Documents and Settings\HP_Administrateur\Application Data\m"

»»»» Presence des fichiers dans C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp

»»»» Presence des fichiers dans C:\Documents and Settings\HP_Administrateur\Local Settings\Temporary Internet Files\Content.IE5

Found ! - C:\Documents and Settings\HP_Administrateur\Local Settings\Temporary Internet Files\Content.IE5\6WDSPSD5\b64_2[1].jpg
Found ! - C:\Documents and Settings\HP_Administrateur\Local Settings\Temporary Internet Files\Content.IE5\6WDSPSD5\b64_3[1].jpg
Found ! - C:\Documents and Settings\HP_Administrateur\Local Settings\Temporary Internet Files\Content.IE5\6WDSPSD5\b64_3[2].jpg
Found ! - C:\Documents and Settings\HP_Administrateur\Local Settings\Temporary Internet Files\Content.IE5\6WDSPSD5\b64_3[3].jpg
Found ! - C:\Documents and Settings\HP_Administrateur\Local Settings\Temporary Internet Files\Content.IE5\7TTK7XFV\b64[1].jpg
Found ! - C:\Documents and Settings\HP_Administrateur\Local Settings\Temporary Internet Files\Content.IE5\7TTK7XFV\b64[2].jpg
Found ! - C:\Documents and Settings\HP_Administrateur\Local Settings\Temporary Internet Files\Content.IE5\7TTK7XFV\b64_2[1].jpg
Found ! - C:\Documents and Settings\HP_Administrateur\Local Settings\Temporary Internet Files\Content.IE5\7TTK7XFV\b64_3[1].jpg
Found ! - C:\Documents and Settings\HP_Administrateur\Local Settings\Temporary Internet Files\Content.IE5\7TTK7XFV\b64_3[2].jpg
Found ! - C:\Documents and Settings\HP_Administrateur\Local Settings\Temporary Internet Files\Content.IE5\7TTK7XFV\mxd[1].jpg
Found ! - C:\Documents and Settings\HP_Administrateur\Local Settings\Temporary Internet Files\Content.IE5\7TTK7XFV\mxd[2].jpg
Found ! - C:\Documents and Settings\HP_Administrateur\Local Settings\Temporary Internet Files\Content.IE5\9TT95YA8\b64_1[1].jpg
Found ! - C:\Documents and Settings\HP_Administrateur\Local Settings\Temporary Internet Files\Content.IE5\H37JLP8A\5ff65922d5b0f8b644e2614a957c7e13[1].jpg
Found ! - C:\Documents and Settings\HP_Administrateur\Local Settings\Temporary Internet Files\Content.IE5\H7F31TCA\1CF3A3855A5C486CC3A9B3EB64F[1].jpg
Found ! - C:\Documents and Settings\HP_Administrateur\Local Settings\Temporary Internet Files\Content.IE5\KZHRM635\b64_3[1].jpg
Found ! - C:\Documents and Settings\HP_Administrateur\Local Settings\Temporary Internet Files\Content.IE5\OE8TO3UH\6363482ACBA3F4149C3D5B7B643D3[1].jpg
Found ! - C:\Documents and Settings\HP_Administrateur\Local Settings\Temporary Internet Files\Content.IE5\OE8TO3UH\b64[1].jpg
Found ! - C:\Documents and Settings\HP_Administrateur\Local Settings\Temporary Internet Files\Content.IE5\OE8TO3UH\b64[2].jpg
Found ! - C:\Documents and Settings\HP_Administrateur\Local Settings\Temporary Internet Files\Content.IE5\OE8TO3UH\b64_2[1].jpg
Found ! - C:\Documents and Settings\HP_Administrateur\Local Settings\Temporary Internet Files\Content.IE5\OE8TO3UH\b64_3[1].jpg
Found ! - C:\Documents and Settings\HP_Administrateur\Local Settings\Temporary Internet Files\Content.IE5\OE8TO3UH\b64_3[2].jpg
Found ! - C:\Documents and Settings\HP_Administrateur\Local Settings\Temporary Internet Files\Content.IE5\OE8TO3UH\b64_3[3].jpg
Found ! - C:\Documents and Settings\HP_Administrateur\Local Settings\Temporary Internet Files\Content.IE5\OE8TO3UH\mxd[1].jpg
Found ! - C:\Documents and Settings\HP_Administrateur\Local Settings\Temporary Internet Files\Content.IE5\OXQNGTMB\mxd[1].jpg
Found ! - C:\Documents and Settings\HP_Administrateur\Local Settings\Temporary Internet Files\Content.IE5\XYNL5UWE\b64_1[1].jpg
Found ! - C:\Documents and Settings\HP_Administrateur\Local Settings\Temporary Internet Files\Content.IE5\XYNL5UWE\b64_1[2].jpg
Found ! - C:\Documents and Settings\HP_Administrateur\Local Settings\Temporary Internet Files\Content.IE5\XYNL5UWE\b64_1[3].jpg
Found ! - C:\Documents and Settings\HP_Administrateur\Local Settings\Temporary Internet Files\Content.IE5\XYNL5UWE\b64_3[1].jpg

--------------- [ Registre / Startup ] ----------------

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
ehTray REG_SZ C:\WINDOWS\ehome\ehtray.exe
ftutil2 REG_SZ rundll32.exe ftutil2.dll,SetWriteCacheMode
RTHDCPL REG_SZ RTHDCPL.EXE
IAAnotif REG_SZ C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
NvCplDaemon REG_SZ RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
nwiz REG_SZ nwiz.exe /installquiet /keeploaded /nodetect
DMAScheduler REG_SZ "c:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe"
Recguard REG_SZ C:\WINDOWS\SMINST\RECGUARD.EXE
PCDrProfiler REG_SZ
HPBootOp REG_SZ "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
HP Software Update REG_EXPAND_SZ C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
TkBellExe REG_SZ "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
avast! REG_SZ C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
SunJavaUpdateSched REG_SZ "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"

! REG.EXE VERSION 3.0

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
swg REG_SZ C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
MsnMsgr REG_SZ "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
SpybotSD TeaTimer REG_SZ C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

--------------- [ Registre / Clés infectieuses ] ----------------

Found ! - HKEY_USERS\S-1-5-21-3683770538-1594570906-772529547-1007\Software\Local AppWizard-Generated Applications\serial
Found ! - HKEY_USERS\S-1-5-21-3683770538-1594570906-772529547-1007\Software\Local AppWizard-Generated Applications\winfilse
Found ! - HKEY_USERS\S-1-5-21-3683770538-1594570906-772529547-1007\Software\bisoft
Found ! - HKEY_USERS\S-1-5-21-3683770538-1594570906-772529547-1007\Software\FFC
Found ! - HKEY_USERS\S-1-5-21-3683770538-1594570906-772529547-1007\Software\FirtR
Found ! - HKEY_USERS\S-1-5-21-3683770538-1594570906-772529547-1007\Software\MuleAppData
Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\serial
Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\winfilse
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SROSA
Found ! - HKEY_CURRENT_USER\Software\bisoft
Found ! - HKEY_CURRENT_USER\Software\FirtR
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sK9Ou0s
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sK9Ou0s
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sK9Ou0s

--------------- [ Etat / Services ] ----------------

Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot

- sans echec non fonctionnel !!

Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal

- sans echec non fonctionnel !!

Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network

- sans echec non fonctionnel !!

+- Services : [ Auto=2 / Demande=3 / Désactivé=4 ]

/!\ Ndisuio - Type de démarrage = 4

/!\ Ip6Fw - Type de démarrage = 4

SharedAccess - Type de démarrage = 2

wuauserv - Type de démarrage = 2

/!\ wscsvc - Type de démarrage = 4

--------------- [ Recherche dans supports amovibles] ----------------

+- Informations :

C: - Lecteur fixe

D: - Lecteur fixe

+- Contenu de l'autorun : D:\autorun.inf

[AUTORUN]
ShellExecute=Info.exe protect.ed 480 480

+- presence des fichiers :

Found ! [30/04/2004 00:01][--ahs----] - D:\autorun.inf
Found ! [29/11/2004 21:01][---hs----] - D:\info.exe

--------------- [ Registre / Mountpoint2 ] ----------------

-> Not found !

------------------- ! Fin du rapport ! --------------------

Bye

Relance findykill,

Ø Choisis cette fois ci l'option * 2 * (suppression)

il y aura 2 redémarrages, laisse travailler l'outil jusqu'a l'apparition du message "nettoyage effectué"

un rapport va s'ouvrir, poste le dans ta prochaine réponse stp

Note : le rapport FindyKill.txt est sauvegardé a la racine du disque

Slt, j'ai fais se que ta dit, mais une fois le 1er redemarrage il se passe pas grand chose s: .J'ai atendu une petite demi-heure et il n'y avait toujours rien(une demi-heure sans applications ouvertes)donc je voulait savoir si c'était normal ou si il fallait atendre plus longtemp lol.

Bye

laisse travailler l'outil jusqu'a l'apparition du message "nettoyage effectué"

Slt, ok lol, j'avais mal fait la supression, bon bref voici le resultat :

----------------- FindyKill V4.700 ------------------

* User : HP_Administrateur - NOM-FB9B15D2723
* executed from : C:\Program Files\FindyKill
* Update on 13/11/08 par Chiquitine29
* Start at 17:11:54 the 15/11/2008
* Windows XP - Internet Explorer 6.0.2900.2180

((((((((((((((( *** deleting *** ))))))))))))))))))

--------------- [ Active Processes ] ----------------

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology Drivers\Elservice.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\alg.exe

--------------- [ Infected files / folders ] ----------------

»»»» Supression files in C:

Deleted ! - "C:\Muestras"
Deleted ! - C:\InfoSat.txt

»»»» Supression files in C:\WINDOWS

»»»» Supression files in C:\WINDOWS\Prefetch

Deleted ! - C:\WINDOWS\prefetch\1185315157.EXE-0CEC3252.pf
Deleted ! - C:\WINDOWS\prefetch\1185318494.EXE-2CE0A5FE.pf
Deleted ! - C:\WINDOWS\prefetch\PATCHJRE.EXE-065EAC0D.pf
Deleted ! - C:\WINDOWS\prefetch\W3XCDKEYGRABBER12201.EXE-2BA793EF.pf

»»»» Supression files in C:\WINDOWS\system32

Deleted ! - C:\WINDOWS\system32\mdelk.exe
Deleted ! - C:\WINDOWS\system32\wintems.exe

»»»» Supression files in C:\WINDOWS\system32\drivers

Deleted ! - C:\WINDOWS\system32\drivers\srosa.sys
Deleted ! - C:\WINDOWS\system32\drivers\srosa2.sys
Deleted ! - C:\WINDOWS\system32\drivers\winfilse.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\100640.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\101468.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\103015.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\104078.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\104390.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\105453.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\108781.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\109156.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\110468.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\113203.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\113406.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\113578.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\114531.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\1153781.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\1156953.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\1164906.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\1168296.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\1174453.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\121625.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\126796.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\127718.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\129484.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\134671.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\137531.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\172781.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\173140.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\174359.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\175031.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\184375.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\18600812.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\18612125.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\18613203.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\18623218.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\18628250.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\18630921.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\18633843.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\18640609.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\187937.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\189890.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\190890.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\194140.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\205109.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\205250.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\206187.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\211640.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\219531.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\220140.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\224656.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\226843.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\233859.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\234937.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\244187.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\249406.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\281156.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\309984.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\3941406.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\3949343.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\3952562.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\4062468.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\4104656.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\59468.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\60500.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\61703.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\65984.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\67515.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\68359.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\70812.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\71359.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\72656.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\73203.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\74640.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\87218.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\88031.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\89656.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\89828.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\90875.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\91515.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\91937.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\95734.exe
Deleted ! - C:\WINDOWS\system32\drivers\downld\98437.exe
Deleted ! - "C:\WINDOWS\system32\drivers\downld"

»»»» Supression files in C:\Documents and Settings\HP_Administrateur\Application Data

Deleted ! - "C:\Documents and Settings\HP_Administrateur\Application Data\m\flec006.exe"
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\3D_Mystic_Wind_Chimes_1.0.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\4Musics_MP3_to_WAV_Converter_4.0_Key.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\@PROMT_German-Russian_Professional_Translator_7.0_(Crack).zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Abac Camera 1.1.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Able_MIDI_Editor_1.3.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Address_Management_System_Personal_Edition_1.0_(Patch).zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\AjooBlast 1.0.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Alarm++_7.05.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Alarm_Master_Plus_4.21.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Alien_Stars_1.17.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\All Stars Icons Colorpack 1.0.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Alphabet Rhyme Time 1.1.1.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Apache2Triad 1.5.4.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Apple Math 1.0.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Apple_Multimedia_Update_1.0.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Ares Galaxy 2.0.9.3030.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Aspose.Editor_1.1.0_[Key].zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\AudioGrail_(formerly_K-MP3)_6.9.4.141_[With_Crack].zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Automatic_@Mail_System_3.0.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\AVS MP3 Disc Creator 3.8.1.23.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Awasu Advanced Edition 2.3 [Key+Serial].zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\BZB_Secure_Notes_1.0.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\CacheBoost Enterprise Edition 4.0.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Cajun Queen Font 1.0.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\CD Organizer 1.0.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\CenoPDF_2.3.8_Key.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\CheckQuota_1.7.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Chicken_Lickin'_2.1.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\CHScanner 0.9.6.2.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\ClipboardController_II_2.2.2.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Command_&_Conquer_Generals_-_Fight_for_Baghdad_map.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Command_&_Conquer_Generals_-_Mountain_Fortress_map.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\COM_Express_for_.NET_3.4.1_[Key+Serial].zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Contour_Inset_Plug-in_for_Adobe_Illustrator_18.3_Serial.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Cossacks_II_Napoleonic_Wars_demo.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\CuteDownloader 2.0.0.0.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\CuteUpload_Free_Edition_1.5.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\D'Accord_iChords_1.1.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Daily Calorie Requirements Calculator 1.0.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\DanceForce 1.0.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\DangleDate_1.0.4.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Daniusoft Digital Media Converter Pro 2.1.1.1.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\DelEmpty_1.1.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Dema_Image_Resizer_2005_with_B-Spline_5.0.16.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Digger_2.0.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\DigiMode NewVcd 1.7.0.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Dove And The Vine Screensaver 1.0.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\DrWEB-ES-429-Beta2-Serv-Win2k.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\DTM_Data_Modeler_1.05.01_KeyGen.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\E-mail Hunter! 1.0.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Eym_Barcode_Command_Line_Utility_1.0.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\FeedExplorer 1.1.7.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\generador.de.licencia.antivirus.avg.7.1.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\GetCookie 0.2.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Global Village K56flex Firmware PC Card Updater 1.120.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Glow_Worm_demo.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\GMSI.NET Alphanumeric LED Component 1.1.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\GPTEngine 1.2.0 (Patch).zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Guitar Scales Method 1.0.25.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\HanWJ Chinese Input Engine 3.94.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\HiddenFInder 1.4.3.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Huelix_ScreenPlay_2.0.15.9.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\iDump_1.1.1.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Image by image 1.0.2.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\IRCommand2 3.87.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\iSimple System 1.0.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Javascript HorizontalMenuBar 1.0.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Jenness_Unit_Converter_1.5.6_Patch.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Join_Split_Convert_Video_2.1_With_Crack.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Kauai Hotels Screensaver 1.0.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\ksTodolist 1.02.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Lavasoft_Personal_Firewall_2.0.1023.700_With_Crack.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Linera_Uninstall_Manager_Pro_1.3.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Love Expressions Screensaver.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Mediastork_0.25a.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\MedTime_1.5.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Mexico_Postal_Code_Database_(Basic_Edition)_November_2006_(Key).zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Midnight_Outlaws_Street_Drag_-_Nitro_Edition_1.0.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Mobile_Media_Center_2.5_R128.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Monkey's_Audio_4.01_Beta_2.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Morovia MICR CMC-7 Fontware 1.0.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\MultiComm_3.0.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Music_Transformation_1.00.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\MY iPod Cleaner 1.2.0.0.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\NATIONAL_ARCHIVE_1.0_(Cracked).zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\NFL_Pool_2005_1.99.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Nidesoft_DVD_Ripper_3.0.86_(Cracked).zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\NOD32 2.7.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Norms ScreenSaver 2006.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\PageCreator_1.0.0.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Panda.Platinum.Security.Internet.Security.2006.v10.02.00_Util_by.RoboCop_(SBFriends).zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Paq pdf2txt 2.01.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\PasteBinPost 1.0.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\PCDJ DEX 1.00.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\pcInternet Patrol 3.2.3.1 [Crack].zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\phpSHIELD PHP Encoder 3.0 Patch.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Play 99.6 1.0.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\PPPatchY! 1.0.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Radio_Mega_1.0.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\RemEx 1.0.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Roadkil's_Cipher_Text_1.1.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Snood_1.3.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\SoftPepper DVD to PSP Video Suite 1.0 Crack.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Spectre 1.5.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Symantec.Norton.Personal.Firewall.2005.+.KeyGen.by.Kajtek[PL].zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Television Online 1.0.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\The Pastor's Study 6.6.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\TheAvalancher_2.38_Crack.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\TheShareTracker_1.03.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\The_Body_Journal_1.5_(With_Crack).zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\TransDesktop_1.53_(Serial).zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\TuneZIP for iTunes 1.1.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Two Due 2.20.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Underworld Evolution 1.0.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Unreal_Tournament_2003_-_Whirlwind_1on1_deathmatch_map.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Valentine's Day 3D screensaver 1.0.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\VaryView 1.4.0002.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\VisitorVille_3.1.2.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\WapWebCam_1.03.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Warm & Fuzzy Holiday Clock 1.0.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\WhizKid JobChart 1.0.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Window_Media_Joiner_1.2.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\WinMHT 1.4.5.62.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\WireFusion_3.2.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\Wondershare iRiver Video Suite 3.2.48.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\XataSoft_SideBar!_1.0.zip
Deleted ! - C:\Documents and Settings\HP_Administrateur\Application Data\m\shared\XGrabber_1.0.1_[KeyGen].zip
Deleted ! - "C:\Documents and Settings\HP_Administrateur\Application Data\m\shared"
Deleted ! - "C:\Documents and Settings\HP_Administrateur\Application Data\m"

»»»» Supression files in C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp

»»»» Supression files in C:\Documents and Settings\HP_Administrateur\Local Settings\Temporary Internet Files\Content.IE5

Deleted ! - C:\Documents and Settings\HP_Administrateur\Local Settings\Temporary Internet Files\Content.IE5\012Z492V\b64[1].jpg
Deleted ! - C:\Documents and Settings\HP_Administrateur\Local Settings\Temporary Internet Files\Content.IE5\012Z492V\b64_2[1].jpg
Deleted ! - C:\Documents and Settings\HP_Administrateur\Local Settings\Temporary Internet Files\Content.IE5\KTUFWHU3\b64[1].jpg
Deleted ! - C:\Documents and Settings\HP_Administrateur\Local Settings\Temporary Internet Files\Content.IE5\KTUFWHU3\b64[2].jpg
Deleted ! - C:\Documents and Settings\HP_Administrateur\Local Settings\Temporary Internet Files\Content.IE5\KTUFWHU3\b64_1[1].jpg
Deleted ! - C:\Documents and Settings\HP_Administrateur\Local Settings\Temporary Internet Files\Content.IE5\W56J49MN\b64_1[1].jpg
Deleted ! - C:\Documents and Settings\HP_Administrateur\Local Settings\Temporary Internet Files\Content.IE5\W56J49MN\b64_3[1].jpg
Deleted ! - C:\Documents and Settings\HP_Administrateur\Local Settings\Temporary Internet Files\Content.IE5\W5ARKT2N\b64_2[1].jpg
Deleted ! - C:\Documents and Settings\HP_Administrateur\Local Settings\Temporary Internet Files\Content.IE5\W5ARKT2N\b64_3[1].jpg

--------------- [ Registry / Infected keys ] ----------------

Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SROSA
Deleted ! - HKEY_CURRENT_USER\Software\bisoft
Deleted ! - HKEY_CURRENT_USER\Software\FirtR
Deleted ! - HKEY_CURRENT_USER\Software\FFC
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SK9OU0S
Deleted ! - HKEY_USERS\S-1-5-21-3683770538-1594570906-772529547-1007\Software\Local AppWizard-Generated Applications\serial
Deleted ! - HKEY_USERS\S-1-5-21-3683770538-1594570906-772529547-1007\Software\Local AppWizard-Generated Applications\winfilse
Deleted ! - HKEY_USERS\S-1-5-21-3683770538-1594570906-772529547-1007\Software\MuleAppData

--------------- [ States / Restarting of services ] ----------------

+- Safe boot mode restored !

+- Services : [ Auto=2 / Request=3 / Disable=4 ]

Ndisuio - Type of startup = 3

Ip6Fw - Type of startup = 2

SharedAccess - Type of startup = 2

wuauserv - Type of startup = 2

wscsvc - Type of startup = 2

--------------- [ Cleaning removable drives ] ----------------

+- Informations :

C: - Lecteur fixe

D: - Lecteur fixe

+- deleting files :

Deleted ! - D:\autorun.inf
Deleted ! - D:\info.exe

--------------- [ Registry / Moutpoint2 ] ----------------

-> Not found !

--------------- [ Searching Cracks / Keygen ] ----------------

C:\Documents and Settings\HP_Administrateur\Bureau\Civilization III - Civilisation 3 - Complet - Cracké - Français - Image Nero - (by Duby).zip
C:\Documents and Settings\HP_Administrateur\Mes documents\julien\Avatars\Ressources\Pax Imperia Eminent Domain 1.0\cracked.nfo

---------------- ! End of report ! ------------------

Vire moi çà stp :

Civilization III - Civilisation 3
Imperia Eminent Domain 1.0


Essaye maintenant d'installer HJT

• Télécharge Hijackthis
Hijackthis (HJT) est un outil de diagnostic pour voir si tout va bien avec ton pc....

Ø Enregistre HJTInstall.exe sur ton bureau
Ø Double-clique sur HJTInstall.exe pour lancer le programme
*. Par défaut, il s'installera là C:\Program Files\Trend Micro\HijackThis
*. Accepte la license en cliquant sur le bouton "I Accept"
Ø Choisis l'option "Do a system scan and save a log file"
*. Clique sur "Save log" pour enregistrer le rapport qui s'ouvrira avec le bloc-note
*. Clique sur "Edition -> Sélectionner tout", puis sur "Edition -> Copier" pour copier tout le contenu du rapport
Ø Colle le rapport que tu viens de copier sur ce forum

Slt, j'ai supprimer les 2 crack et j'ai fais le rapport d'hijack :

Logfile of HijackThis v1.99.1
Scan saved at 17:51:19, on 15/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology Drivers\Elservice.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\MSN\Project Flood V 2.0 FOR Darkgoovyx.exe
C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/...
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/...
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/...
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/...
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [DMAScheduler] "c:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe"
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: AntiCrash 5.0.lnk = C:\Program Files\Jibreel Inc\AntiCrash\AntiCrash.exe
O4 - Global Startup: ZDWLan Utility.lnk = C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe
O8 - Extra context menu item: Télécharger avec &BitSpirit - C:\Program Files\BitSpirit\bsurl.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Intel(R) Quick Resume technology (ELService) - Intel Corporation - C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology Drivers\Elservice.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

Tu n'as plus d'Antivirus ( normal, bagle te l'a shooté )

télécharge AVIRA Antivir si tu veux l'esssayer sur le lien suivant.
https://www.clubic.com/telecharger-fiche10821-avira-antivir-personal-free-antivirus.html

Installe le.
TUTO D' installation par Malekal
Tuto D'instalation et de mise en Oeuvre
Encore un au cas ou...
Reconnecte toi, fais les mises à jours Antivir... tu seras mieux protégé !

Après l'installation, mets le à jour - si ton firewall fait une alerte.. accepte la connexion.
Assure toi qu'Antivir est bien à jour, ( clic droit sur le parapluie => Start Update ) et laisse faire la MàJ.

Redémarre en mode sans échec !
Pour cela, redémarre l'ordinateur, avant le logo Windows, tapote sur la touche F8, un menu va apparaître, choisis Mode sans échec et appuye sur la touche entrée du clavier.

- Ouvre Antivir par le menu Démarrer / Programmes
- Cliquez sur l'onglet Scanner.
- Sélectionne Manual Selection
- Sélectionne le disque C
- Lance le scan - Mets en quarantaine tous les éléments détectés.
- Une fois le scan terminé Enregistre le rapport.

Redémarre en mode normal.

Poste le rapport ici.

Slt, j'ai fais se que tu ma dit, voici le rapport :

Avira AntiVir Personal
Report file date: samedi 15 novembre 2008 19:15

Scanning for 1035635 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Boot mode: Save mode
Username: HP_Administrateur
Computer name: NOM-FB9B15D2723

Version information:
BUILD.DAT : 8.2.0.336 16933 Bytes 30/10/2008 11:40:00
AVSCAN.EXE : 8.1.4.7 315649 Bytes 26/06/2008 09:57:53
AVSCAN.DLL : 8.1.4.0 40705 Bytes 26/05/2008 08:56:40
LUKE.DLL : 8.1.4.5 164097 Bytes 12/06/2008 13:44:19
LUKERES.DLL : 8.1.4.0 12033 Bytes 26/05/2008 08:58:52
ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 27/10/2008 18:01:39
ANTIVIR1.VDF : 7.1.0.56 411136 Bytes 09/11/2008 18:01:41
ANTIVIR2.VDF : 7.1.0.57 2048 Bytes 09/11/2008 18:01:41
ANTIVIR3.VDF : 7.1.0.88 210944 Bytes 14/11/2008 18:01:43
Engineversion : 8.2.0.31
AEVDF.DLL : 8.1.0.6 102772 Bytes 15/11/2008 18:01:58
AESCRIPT.DLL : 8.1.1.15 332156 Bytes 15/11/2008 18:01:57
AESCN.DLL : 8.1.1.5 123251 Bytes 15/11/2008 18:01:56
AERDL.DLL : 8.1.1.3 438645 Bytes 15/11/2008 18:01:55
AEPACK.DLL : 8.1.3.4 393591 Bytes 15/11/2008 18:01:54
AEOFFICE.DLL : 8.1.0.30 196986 Bytes 15/11/2008 18:01:52
AEHEUR.DLL : 8.1.0.71 1487222 Bytes 15/11/2008 18:01:51
AEHELP.DLL : 8.1.1.3 119157 Bytes 15/11/2008 18:01:48
AEGEN.DLL : 8.1.1.0 319859 Bytes 15/11/2008 18:01:47
AEEMU.DLL : 8.1.0.9 393588 Bytes 15/11/2008 18:01:46
AECORE.DLL : 8.1.4.1 172405 Bytes 15/11/2008 18:01:45
AEBB.DLL : 8.1.0.3 53618 Bytes 15/11/2008 18:01:44
AVWINLL.DLL : 1.0.0.12 15105 Bytes 09/07/2008 09:40:05
AVPREF.DLL : 8.0.2.0 38657 Bytes 16/05/2008 10:28:01
AVREP.DLL : 8.0.0.2 98344 Bytes 15/11/2008 18:01:43
AVREG.DLL : 8.0.0.1 33537 Bytes 09/05/2008 12:26:40
AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 09:29:23
AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 12/06/2008 13:27:49
SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 18:28:02
SMTPLIB.DLL : 1.2.0.23 28929 Bytes 12/06/2008 13:49:40
NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 13:05:10
RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 12/06/2008 14:48:07
RCTEXT.DLL : 8.0.52.0 86273 Bytes 27/06/2008 14:34:37

Configuration settings for the scan:
Jobname..........................: Local Hard Disks
Configuration file...............: c:\program files\avira\antivir personaledition classic\alldiscs.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:, D:,
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: samedi 15 novembre 2008 19:15

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
11 processes with 11 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!
Master boot sector HD1
[INFO] No virus was found!
[WARNING] System error [21]: Le périphérique n'est pas prêt.
Master boot sector HD2
[INFO] No virus was found!
[WARNING] System error [21]: Le périphérique n'est pas prêt.
Master boot sector HD3
[INFO] No virus was found!
[WARNING] System error [21]: Le périphérique n'est pas prêt.
Master boot sector HD4
[INFO] No virus was found!
[WARNING] System error [21]: Le périphérique n'est pas prêt.

Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Boot sector 'D:\'
[INFO] No virus was found!

Starting to scan the registry.
The registry was scanned ( '66' files ).

Starting the file scan:

Begin scan in 'C:\' <HP_PAVILION>
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\AdBreak4.zip
[DETECTION] Contains suspicious code GEN/PwdZIP
[NOTE] The detection was classified as suspicious.
[NOTE] The file was moved to '49611491.qua'!
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\AdBreak6.zip
[DETECTION] Contains suspicious code GEN/PwdZIP
[NOTE] The detection was classified as suspicious.
[NOTE] The file was moved to '49611496.qua'!
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\AdBreak7.zip
[DETECTION] Contains suspicious code GEN/PwdZIP
[NOTE] The detection was classified as suspicious.
[NOTE] The file was moved to '4961149f.qua'!
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\SmitfraudC2.zip
[DETECTION] Contains suspicious code GEN/PwdZIP
[NOTE] The detection was classified as suspicious.
[NOTE] The file was moved to '498814a8.qua'!
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\SmitfraudC3.zip
[DETECTION] Contains suspicious code GEN/PwdZIP
[NOTE] The detection was classified as suspicious.
[NOTE] The file was moved to '4809f331.qua'!
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\SmitfraudC4.zip
[DETECTION] Contains suspicious code GEN/PwdZIP
[NOTE] The detection was classified as suspicious.
[NOTE] The file was moved to '498814a9.qua'!
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\SmitfraudC5.zip
[DETECTION] Contains suspicious code GEN/PwdZIP
[NOTE] The detection was classified as suspicious.
[NOTE] The file was moved to '4809f332.qua'!
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\SmitfraudCgeneric.zip
[DETECTION] Contains suspicious code GEN/PwdZIP
[NOTE] The detection was classified as suspicious.
[NOTE] The file was moved to '498814ab.qua'!
C:\Documents and Settings\HP_Administrateur\Mes documents\julien\WOW\Installation\WoW-2.0.0-frFR-Installer\DirectX\BDA.cab
[0] Archive type: CAB (Microsoft)
--> kstvtune.ax
[WARNING] No further files can be extracted from this archive. The archive will be closed
C:\Program Files\Bodom-Child - RaBBi\RGSS\Standard\Graphics.exe
[0] Archive type: CAB SFX (self extracting)
--> Graphics\Animations\002-Action02.png
[WARNING] No further files can be extracted from this archive. The archive will be closed
[WARNING] No further files can be extracted from this archive. The archive will be closed
C:\Program Files\Pax Imperia\Pax Imperia2\Pax Imperia 2 - Eminent Domain.zip
[0] Archive type: ZIP
--> paxeminent.exe
[1] Archive type: ACE SFX (self extracting)
--> paxeminent\Data\HullData
[WARNING] No further files can be extracted from this archive. The archive will be closed
C:\Program Files\Pax Imperia\Pax Imperia2\paxeminent.exe
[0] Archive type: ACE SFX (self extracting)
--> paxeminent\Data\HullData
[WARNING] No further files can be extracted from this archive. The archive will be closed
[WARNING] No further files can be extracted from this archive. The archive will be closed
C:\RGSS\Standard\Graphics.exe
[0] Archive type: CAB SFX (self extracting)
--> Graphics\Animations\002-Action02.png
[WARNING] No further files can be extracted from this archive. The archive will be closed
[WARNING] No further files can be extracted from this archive. The archive will be closed
C:\Zelda\RGSS\Standard\Graphics.exe
[0] Archive type: CAB SFX (self extracting)
--> Graphics\Animations\002-Action02.png
[WARNING] No further files can be extracted from this archive. The archive will be closed
[WARNING] No further files can be extracted from this archive. The archive will be closed
Begin scan in 'D:\' <HP_RECOVERY>

End of the scan: samedi 15 novembre 2008 20:19
Used time: 1:04:01 Hour(s)

The scan has been done completely.

14966 Scanning directories
527125 Files were scanned
0 viruses and/or unwanted programs were found
8 Files were classified as suspicious:
0 files were deleted
0 files were repaired
8 files were moved to quarantine
0 files were renamed
5 Files cannot be scanned
527112 Files not concerned
17513 Archives were scanned
15 Warnings
8 Notes

vide la 40aine

https://www.malekal.com/avira-free-security-antivirus-gratuit/#mozTocId563382

Clique droit sur le parapluie => Strat Antivir => clique sur " Administration " et dans " quarantaine " pour chaque élément, clique sur la petite poubelle en haut.

Voila c'est fait

Oups, j'ai mal vu sur le précédent rapport HJT, il y a bien Avast qui traine.

Vire le .
Pour suppimer Avast correctement

ensuite, Refais moi un log HJT tout frais stp...

Ø Relance Hijackthis en double cliquant sur son raccourci sur le Bureau.
Choisis l'option "Do a system scan and save a log file"
Clique sur "Save log" pour enregistrer le rapport qui s'ouvrira avec le bloc-note
Clique sur "Edition" ->> "Sélectionner tout", puis sur "Edition" ->> Copier" pour copier tout le contenu du rapport ici

Ok, voila j'ai supprimer avast et voila le rapport d'hijack :

Logfile of HijackThis v1.99.1
Scan saved at 22:26:30, on 15/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology Drivers\Elservice.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
C:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe
C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe
C:\Program Files\Jibreel Inc\AntiCrash\AntiCrash.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
c:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://fr.search.yahoo.com/?fr=cb-hp06
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = https://fr.search.yahoo.com/?fr=cb-hp06
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://fr.search.yahoo.com/?fr=cb-hp06
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [DMAScheduler] "c:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe"
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: AntiCrash 5.0.lnk = C:\Program Files\Jibreel Inc\AntiCrash\AntiCrash.exe
O4 - Global Startup: ZDWLan Utility.lnk = C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe
O8 - Extra context menu item: Télécharger avec &BitSpirit - C:\Program Files\BitSpirit\bsurl.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Intel(R) Quick Resume technology (ELService) - Intel Corporation - C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology Drivers\Elservice.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

Ta version IE n'est pas à jour... Grosse faille de sécurité !!!
Internet Explorer v6.00 SP2 (6.00.2900.2180)
On en est a la 07

Clique ici pour la Mise à Jour
Pourquoi faire la MàJ ?
==================================================================

La console Java n'est pas à jour: Faille de sécurité !!!
Voir ici pourquoi
Clique sur Download Latest Version

Choisis la première ligne de téléchargement puis installe java.
En fin d'installation, revient sur la page pour vérifier ton installation.
Quand l'installation a réussi, ouvre le panneau de configuration >
Ajout/suppression de programmes et supprimes les anciennes versions (de java) afin d’éliminer les failles de sécurité présentes dans ces anciennes versions.
Fais cela pour chacune d'elle, une a une, fais redémarrer ton PC quand cela te le sera demandé .
Tu gardes la Java\1.6.0.10 !
===================================================

Pour finir.... tu peux le faire tranquilement, et tu me postes les rapports demain..
Ensuite, on nettoira les outils que je t'ai fait télécharger..

Afin de suivre la procédure correctement, je te conseille d'enregistrer la page en sélectionnant toutes les lignes puis de copier cette sélection dans un fichier texte sur ton PC pour pouvoir appliquer la procédure correctement.
Il faut exécuter toutes les étapes, sans interruption, dans l'ordre exact indiqué ci-dessous.
Si un élément te paraît obscur, demande des explications avant de commencer la désinfection.

1) Télécharge et installe ( si tu ne les a pas )

# CCleaner
https://www.ccleaner.com/ccleaner/download
Choisi la version SLIM-No Toolbar.
Installe-le en prenant soin de décocher les diverses options dont la barre Yahoo et la mise à jour.
Lance CCleaner puis Clique sur "Options", "Avancé" et décoche la case "Effacer uniquement les fichiers, du dossier Temp de Windows, plus vieux que 48 heures".
Pour les autres paramètres, laisse-le avec ses réglages par défaut.
Ferme le programme pour l’instant.

# Malwarebyte's Anti-Malware
http://www.malwarebytes.org/mbam/program/mbam-setup.exe
A la fin de l'installation, veille à ce que l'option « mettre a jour Malwarebyte's Anti-Malware » soit cochée. >>> clique sur OK
Lance Malwarebyte's Anti-Malware en double-cliquant sur l'icône sur ton Bureau.
Au premier lancement, une fenêtre t'annonce que la version est Free >>> clique sur OK
Laisse les Mises à jour se télécharger
Ferme le programme pour l’instant.

2) Scan avec Malwarebyte's Anti-Malware

Lance Malwarebyte's Anti-Malware
Onglet "Recherche" >>> coche Executer un examen rapide >>> Rechercher sélectionne tes disques durs puis clique sur Lancer l’examen
A la fin du scan >>> clique sur Afficher les résultats puis sur Enregistrer le rapport
Suppression des éléments détectés >>>> clique sur Supprimer la sélection
S'il t'es demandé de redémarrer >>> clique sur "Yes"

Un rapport de scan s'ouvre, enregistre sur ton Bureau.
Puis ferme Malwarebyte's Anti-Malware

3) Suppression de fichiers inutiles avec CCleaner

Lance CCleaner en double-cliquant sur son raccourci sur le bureau.
Puis dans le menu Nettoyeur
Clique sur Analyse (laisser travailler cela peut durer longtemps la 1ere fois)
Clique sur le bouton Lancer le nettoyage.
Clique une seconde fois sur le bouton Lancer le nettoyage puis ferme CCleaner.

4) Rapports

Poste en réponse :
* Un nouveau rapport HijackThis
* Le rapport de Malwarebyte's Anti-Malware que tu as sauvegardé sur ton Bureau.

Slt, beaucoup de scan a faire lol, bon j'ai fais tout ce que tu ma dit voila le scan d'hijackthis :

Logfile of HijackThis v1.99.1
Scan saved at 12:23:23, on 16/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology Drivers\Elservice.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
C:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe
C:\Program Files\Jibreel Inc\AntiCrash\AntiCrash.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\HP\KBD\KBD.EXE
c:\windows\system\hpsysdrv.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://fr.search.yahoo.com/?fr=cb-hp06
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = https://fr.search.yahoo.com/?fr=cb-hp06
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [DMAScheduler] "c:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe"
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: AntiCrash 5.0.lnk = C:\Program Files\Jibreel Inc\AntiCrash\AntiCrash.exe
O4 - Global Startup: ZDWLan Utility.lnk = C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe
O8 - Extra context menu item: Télécharger avec &BitSpirit - C:\Program Files\BitSpirit\bsurl.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Intel(R) Quick Resume technology (ELService) - Intel Corporation - C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology Drivers\Elservice.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

--------------------------------------------------------------------------------------------------------------------------------------------------------

Et voila le scan de de Malwerebytes :

Malwarebytes' Anti-Malware 1.30
Version de la base de données: 1401
Windows 5.1.2600 Service Pack 2

16/11/2008 12:15:24
mbam-log-2008-11-16 (12-15-20).txt

Type de recherche: Examen rapide
Eléments examinés: 53718
Temps écoulé: 5 minute(s), 16 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{df780f87-ff2b-4df8-92d0-73db16a1543a} (Adware.PopCap) -> No action taken.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\WINDOWS\system32\drivers\downld (Trojan.Agent) -> No action taken.

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

Faut suivre les indications...

Relance MBAM par double clic.

* Dans l'onglet analyse, vérifie que "Exécuter un examen RAPIDE" soit coché et clique sur le bouton Rechercher pour démarrer l'analyse.

MBAM analyse ton ordinateur. L'analyse peut prendre un certain temps. Il suffit de vérifier de temps en temps son avancement.

A la fin de l'analyse, un message s'affiche indiquant la fin de l'analyse. Clique sur OK pour poursuivre.

* Si des malwares ont été détectés, leur liste s'affiche.

Coche tous les éléments détectés par Malwarebytes' Anti-Malware puis clique sur Supprimer la sélection afin d'éradiquer les malwares détectés.
/!\ (a faire impérativement sous peine de recommencer le scan) /!\ , MBAM va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.

MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Ferme le Bloc-notes. (Le rapport peut être retrouvé sous l'onglet Rapports/logs)

Ferme MBAM en cliquant sur Quitter.

Poste le rapport dans ta réponse