virus msn virtumondeRésolu/Fermé

Question

Bonjour,

je suis infectée par virtumonde, j'ai désinfecté comme indiqué mas je ne sais pas si tout est revenu dans l'ordre, pouvez vous m'aider?

merci

stef26011981 · Answer

voici les blocs notes Malwarebytes' Anti-Malware 1.30 Version de la base de données: 1454 Windows 5.1.2600 Service Pack 3 03/12/2008 21:58:53 mbam-log-2008-12-03 (21-58-53).txt Type de recherche: Examen complet (C:\|D:\|E:\|) Eléments examinés: 157619 Temps écoulé: 44 minute(s), 22 second(s) Processus mémoire infecté(s): 0 Module(s) mémoire infecté(s): 0 Clé(s) du Registre infectée(s): 36 Valeur(s) du Registre infectée(s): 0 Elément(s) de données du Registre infecté(s): 0 Dossier(s) infecté(s): 13 Fichier(s) infecté(s): 168 Processus mémoire infecté(s): (Aucun élément nuisible détecté) Module(s) mémoire infecté(s): (Aucun élément nuisible détecté) Clé(s) du Registre infectée(s): HKEY_CLASSES_ROOT\videoegg.activexloader (Adware.VideoEgg) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{168dc258-1455-4e61-8590-9dac2f27b675} (Adware.VideoEgg) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{1a8642f1-dc80-4edc-a39d-0fb62a58b455} (Adware.VideoEgg) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{3f91eb90-ef62-44ee-a685-fac29af111cd} (Adware.VideoEgg) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{5c29c7e4-5321-4cad-be2e-877666bed5df} (Adware.VideoEgg) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{83dfb6ee-ab18-41b5-86d4-b544a141d67e} (Adware.VideoEgg) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{88d6cf0e-cf70-4c24-bf6e-e4e414bc649c} (Adware.VideoEgg) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{8f6a82a2-d7b1-443e-bb9f-f7dc887dd618} (Adware.VideoEgg) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{9856e2d8-ffb2-4fe5-8cad-d5ad6a35a804} (Adware.VideoEgg) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{a3d06987-c35e-49e4-8fe2-ac67b9fbfb4c} (Adware.VideoEgg) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{a58c497b-3ee2-45e7-9594-daca6be2a0d0} (Adware.VideoEgg) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{ad0a3058-fd49-4f98-a514-fd055201835e} (Adware.VideoEgg) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{ad5915ea-b61a-4dba-b5c8-ef4b2df0a3c7} (Adware.VideoEgg) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{af2e62b6-f9e1-4d4f-a10a-9dc8e6dcbcc0} (Adware.VideoEgg) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{af2e62b6-f9e1-4d4f-a10a-9dc8e6dcbcc0} (Adware.VideoEgg) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{bb187c0d-6f53-4f3e-9590-98fd3a7364a2} (Adware.VideoEgg) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{c5041fd9-4819-4dc4-b20e-c950b5b03d2a} (Adware.VideoEgg) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{d17726cc-d4dd-4c4a-9671-471d56e413b5} (Adware.VideoEgg) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{db8cce99-59c6-4552-8bfc-058feb38d6ce} (Adware.VideoEgg) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{dc3a04ee-cdd7-4407-915c-a5502f97eecd} (Adware.VideoEgg) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{e1a63484-a022-4d42-830a-fbd411514440} (Adware.VideoEgg) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{e282c728-189d-419e-8ee2-1601f4b39ba5} (Adware.VideoEgg) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\videoegg.activexloader.1 (Adware.VideoEgg) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{e1d20694-74d9-472d-af03-08c26173a67f} (Adware.EGDAccess) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{90b5a95a-afd5-4d11-b9bd-a69d53d22226} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8109fd3d-d891-4f80-8339-50a4913ace6f} (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\videoegg (Adware.VideoEgg) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Instant Access (Adware.InstantAccess) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\VideoEgg (Adware.VideoEgg) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@videoegg.com/publisher,version=1.5 (Adware.VideoEgg) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\VideoEgg (Adware.VideoEgg) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\MozillaPlugins\@videoegg.com/publisher,version=1.5 (Adware.VideoEgg) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully. Valeur(s) du Registre infectée(s): (Aucun élément nuisible détecté) Elément(s) de données du Registre infecté(s): (Aucun élément nuisible détecté) Dossier(s) infecté(s): D:\Documents and Settings\Stéf'\Application Data\VideoEgg (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Data (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Loader (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Loader\4665 (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\messages (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4665 (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Updater (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Updater\4665 (Adware.VideoEgg) -> Quarantined and deleted successfully. Fichier(s) infecté(s): D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Loader\4665 pvideoegg-loader.dll (Adware.VideoEgg) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP948\A0222087.exe (Backdoor.Bot) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP955\A0225493.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP955\A0225494.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\fxstaller.MSNFix (Backdoor.Bot) -> Quarantined and deleted successfully. C:\WINDOWS\system32\ghfwxrwv.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\mygvza.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32 ivsijpo.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32 rz5.tmp (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32 rzD.tmp (Trojan.Vundo) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\Desktopicon\eBayShortcuts.exe (Trojan.Agent) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Updater\updater.exe (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Updater\VideoEggBroker.exe (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Updater\VideoEggBroker.exe.old (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP947\A0221934.com (Backdoor.Bot) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\DataLOCKED (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Uninstall.exe (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Data eport.log (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Loader\loader.ver (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\publisher.ver (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520\avcodec.dll (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520\crashRpt.dll (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520\FLVEncoder.dll (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520\lame_enc.dll (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520\LevelMeter.ax (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520\libcurlve.dll (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520\libpng.dll (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 pvideoegg-publisher.dll (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520\VideoEgg_FLVWriter.ax (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520\zlib.dll (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\aol_watermark.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\audio_combo.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\audio_source.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\big_gray_logo.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\big_logo_cropped.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\blank_slide.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\button_browse_down.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\button_browse_over.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\button_browse_up.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\camcorders_title.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\camcorder_btn_highlighted.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\camcorder_slide.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\corners_bottom_left.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\corners_bottom_left_curve.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\corners_bottom_right.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\corners_top_right.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\done.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\done_capture.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\done_capture_down.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\done_capture_over.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\done_down.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\done_over.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\dropshadow_bottom_left.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\dropshadow_horiz.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\dropshadow_vertical.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\dropzone.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\dv_fast_forward.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\dv_pause.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\dv_play.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\dv_rewind.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\dv_stop.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\email_instructions.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\email_sent.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\email_sent_down.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\email_sent_over.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\eraser.CUR (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\eraser_cursor.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\file_btn_highlighted.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\file_slide.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\help.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\icon_camcorder.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\icon_camcorders.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\icon_camcorder_dark.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\icon_camcorder_light.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\icon_ff.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\icon_file_dark.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\icon_file_light.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\icon_pause.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\icon_phone_dark.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\icon_phone_light.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\icon_play.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\icon_rewind.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\icon_stop.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\icon_webcam.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\icon_webcams.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\icon_webcam_dark.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\icon_webcam_light.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\loading.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\loading_movie.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\locating.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\logo.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\logo_bottom.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\logo_middle.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\logo_top.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\mobile_btn_highlighted.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\mobile_slide.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\mobile_slide_disabled.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\movie_placeholder.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\ok.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\ok_down.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\ok_over.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\player_fast_forward.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\player_fast_forward_disabled.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\player_fill.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\player_pause.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\player_play.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\player_rewind.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\player_rewind_disabled.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\player_rewind_to_start.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\playhead.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\powered_by.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\progress.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images efresh_list_down.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images efresh_list_over.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images efresh_list_up.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images estart.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images estart_over.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\start_capture.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\start_capture_disabled.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\start_capture_down.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\start_capture_over.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\start_over.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\start_over_highlight.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\start_slider.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\stop_capture.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\stop_capture_disabled.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\stop_capture_down.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\stop_capture_over.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\stop_slider.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images ab_slide_deselected.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images ape_control.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images ext_camcorder.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images ext_camcorder_highlight.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images ext_file.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images ext_file_highlight.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images ext_phone.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images ext_phone_highlight.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images ext_webcam.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images ext_webcam_highlight.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images itle.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\upload.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\uploading.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\uploading_fill.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\uploading_high.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\uploading_low.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\uploading_medium.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\uploading_thumbnail.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\upload_down.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\upload_from.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\upload_over.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\volume_gray.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\volume_green.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\volume_high.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\volume_low.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\volume_orange.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\volume_red.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\volume_slider.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\waiting_for_email.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\webcams_title.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\webcam_btn_highlighted.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\images\webcam_slide.png (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Publisher\4520 esources\VideoEgg\messages\messages.en-US.bundle (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Updater\updater.ver (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Updater\4665\libcurlve.dll (Adware.VideoEgg) -> Quarantined and deleted successfully. D:\Documents and Settings\Stéf'\Application Data\VideoEgg\Updater\4665\updater.dll (Adware.VideoEgg) -> Quarantined and deleted successfully. C:\WINDOWS mlpcert2007 (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\WINDOWS\system32\kokuhnszk_navps.dat (Adware.NaviPromo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\kokuhnszk_nav.dat (Adware.NaviPromo) -> Quarantined and deleted successfully. ComboFix 08-12-02.02 - Stéf' 2008-12-03 22:02:21.1 - NTFSx86 Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.526 [GMT 1:00] Lancé depuis: d:\documents and settings\Stéf'\Bureau\ComboFix.exe * Un nouveau point de restauration a été créé . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\psuvGfhk.ini c:\windows\system32\psuvGfhk.ini2 c:\windows\system32\Sp3.dll D:\Autorun.inf . ((((((((((((((((((((((((((((( Fichiers créés du 2008-11-03 au 2008-12-03 )))))))))))))))))))))))))))))))))))) . 2008-12-03 21:11 . 2008-12-03 21:11 d-------- d:\documents and settings\Stéf'\Application Data\Malwarebytes 2008-12-03 21:11 . 2008-12-03 21:11 d-------- d:\documents and settings\All Users\Application Data\Malwarebytes 2008-12-03 21:11 . 2008-12-03 21:11 d-------- c:\program files\Malwarebytes' Anti-Malware 2008-12-03 21:11 . 2008-10-22 16:10 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys 2008-12-03 21:11 . 2008-10-22 16:10 15,504 --a------ c:\windows\system32\drivers\mbam.sys 2008-12-03 16:39 . 2008-12-03 16:39 d-------- c:\program files\Trend Micro 2008-12-03 16:03 . 2008-12-03 16:03 d-------- C:\MSNFix 2008-12-03 16:03 . 2008-12-03 15:31 792,618 --a------ C:\MSNFix.zip 2008-12-03 15:27 . 2008-12-03 15:58 d-------- c:\program files\MSNFix 2008-12-02 21:57 . 2008-12-02 21:57 d--hs---- d:\documents and settings\NetworkService.AUTORITE NT 2008-12-02 21:57 . 2008-12-02 21:57 d--hs---- d:\documents and settings\LocalService.AUTORITE NT 2008-12-01 15:09 . 2008-12-01 15:15 d-------- c:\program files\PokerStars 2008-12-01 10:45 . 2008-12-01 14:09 0 --a------ c:\windows\system32\mcrh.MSNFix 2008-11-27 11:26 . 2008-11-27 11:26 d-------- d:\documents and settings\Stf' 2008-11-13 09:50 . 2008-09-04 18:16 1,106,944 --------- c:\windows\system32\dllcache\msxml3.dll 2008-11-13 09:50 . 2008-10-24 12:21 455,296 --------- c:\windows\system32\dllcache\mrxsmb.sys . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-03 15:59 --------- d-----w d:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2008-12-02 20:20 --------- d-----w c:\program files\AxBx 2008-11-30 21:48 --------- d-----w c:\program files\CCleaner 2008-11-20 10:47 --------- d-----w c:\program files\Fichiers communs\Adobe 2008-11-17 12:55 --------- d-----w c:\program files\Wanadoo 2008-11-13 09:42 --------- d-----w c:\program files\Spybot - Search & Destroy 2008-11-03 12:30 --------- d-----w c:\program files\Free Easy Burner 2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys 2008-10-21 07:43 --------- d--h--w c:\program files\InstallShield Installation Information 2008-10-21 07:43 --------- d-----w c:\program files\SAGEM 2008-10-09 08:58 --------- d-----w c:\program files\Orange HSS 2008-10-09 08:32 --------- d-----w c:\program files\Securitoo 2008-03-07 21:22 10,644,472 ----a-w c:\program files\dreamweaver2.zip 2006-07-05 19:59 58,264 ----a-w d:\documents and settings\Stéf'\Application Data\GDIPFONTCACHEV1.DAT . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000] "Anniversaires"="c:\anuman interactive\Le journal de votre naissance\anniv.exe" [2008-03-30 765952] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-08-02 7110656] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-01-19 98304] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\OPXPGina] 2005-08-12 17:01 49152 c:\apps\Softex\OmniPass\OPXPGina.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.dvacm"= c:\progra~1\FICHIE~1\ULEADS~1\Vio\Dvacm.acm "msacm.ulmp3acm"= c:\progra~1\FICHIE~1\ULEADS~1\MPEG\ulmp3acm.acm "msacm.mpegacm"= c:\progra~1\FICHIE~1\ULEADS~1\MPEG\mpegacm.acm [HKLM\~\startupfolder\D:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Démarrage rapide du logiciel HP Image Zone.lnk] path=d:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Démarrage rapide du logiciel HP Image Zone.lnk backup=c:\windows\pss\Démarrage rapide du logiciel HP Image Zone.lnkCommon Startup [HKLM\~\startupfolder\D:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Event Reminder.lnk] path=d:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Event Reminder.lnk backup=c:\windows\pss\Event Reminder.lnkCommon Startup [HKLM\~\startupfolder\D:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^HP Digital Imaging Monitor.lnk] path=d:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\HP Digital Imaging Monitor.lnk backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKLM\~\startupfolder\D:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Logitech Desktop Messenger.lnk] path=d:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Logitech Desktop Messenger.lnk backup=c:\windows\pss\Logitech Desktop Messenger.lnkCommon Startup [HKLM\~\startupfolder\D:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Pense-bête.lnk] path=d:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Pense-bête.lnk backup=c:\windows\pss\Pense-bête.lnkCommon Startup [HKLM\~\startupfolder\D:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter.lnk] path=d:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter.lnk backup=c:\windows\pss\Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATSwpNav] c:\program files\Fingerprint Sensor\ATSwpNav -run [X] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2008-10-15 01:04 39792 c:\program files\Adobe\Reader 8.0\Reader eader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] --a------ 2008-04-14 03:33 15360 c:\windows\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] --a--c--- 2005-02-16 22:11 49152 c:\program files\HP\HP Software Update\hpwuSchd2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1] --a--c--- 2004-08-05 14:00 208952 c:\windows\ime\IMJP8_1\imjpmig.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LDM] --a------ 2007-02-27 11:01 67128 c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechSoftwareUpdate] --a--c--- 2004-10-08 12:06 196608 c:\program files\Logitech\Video\ManifestEngine.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoRepair] --a--c--- 2004-10-08 12:31 458752 c:\program files\Logitech\Video\ISStart.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoTray] --a--c--- 2004-10-08 12:24 217088 c:\program files\Logitech\Video\LogiTray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LVCOMSX] --a------ 2004-10-08 11:52 221184 c:\windows\system32\LVCOMSX.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MM_MODULE] --a------ 2005-07-12 07:58 90112 c:\program files\MIC\HAWAII\Hawaii.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] --a------ 2005-08-02 16:35 7110656 c:\windows\system32 vcpl.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] --a------ 2005-08-02 16:35 86016 c:\windows\system32 vmctray.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OmniPass] --a--c--- 2005-08-12 18:05 1859584 c:\apps\Softex\OmniPass\scureapp.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService] --a--c--- 2005-05-11 13:48 127118 c:\apps\Powercinema\PCMService.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\pdfw] --a--c--- 2004-03-24 22:56 32768 c:\program files\Amic Utilities\PDF Writer Pro\pdfwload.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A] --a--c--- 2004-08-05 14:00 455168 c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync] --a--c--- 2004-08-05 14:00 455168 c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2006-01-19 05:47 98304 c:\program files\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmpcSys] --a------ 2005-11-17 09:51 975360 c:\apps\SMP\SMPSYS.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer] -rahs---- 2008-09-16 11:16 1833296 c:\program files\Spybot - Search & Destroy\TeaTimer.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a--c--- 2008-03-25 03:28 144784 c:\program files\Java\jre1.6.0_06\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SweetIM] -ra--c--- 2008-01-02 20:15 103712 c:\program files\Macrogaming\SweetIM\SweetIM.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] --a------ 2008-03-01 11:54 171448 c:\program files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] --a------ 2006-01-19 05:53 180269 c:\program files\Fichiers communs\Real\Update_OB ealsched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ulead AutoDetector v2] --a--c--- 2004-11-26 11:43 90112 c:\program files\Fichiers communs\Ulead Systems\AutoDetector\Monitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant] --a--c--- 2008-05-02 05:15 15872 c:\program files\Unlocker\UnlockerAssistant.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VadeRetro Desktop] --a--c--- 2008-05-26 11:19 1078272 c:\program files\Goto Software\Vade Retro\Vaderetro_mgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOKIT] --a------ 2004-08-23 13:50 122880 c:\progra~1\Wanadoo\Shell.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOTASKBARICON] --------- 2004-10-14 15:55 32768 c:\progra~1\Wanadoo\GestMAJ.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOWATCH] --------- 2004-08-23 13:49 20480 c:\progra~1\Wanadoo\Watch.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NECHotkey] --a------ 2006-01-11 10:29 548864 c:\windows\mHotkey.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg wiz] --a------ 2005-08-02 16:35 1519616 c:\windows\system32 wiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan] --a------ 2005-10-24 14:45 90112 c:\windows\soundman.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%ProgramFiles%\AOL 9.0\aol.exe"= "%ProgramFiles%\UBISOFT\Splinter Cell Pandora Tomorrow\logo_ubi.exe"= "%ProgramFiles%\UBISOFT\Splinter Cell Pandora Tomorrow\pandora.exe"= "%windir%\system32\sessmgr.exe"= "c:\APPS\Inventime\my.exe"= "c:\APPS\skype\phone\Skype.exe"= "c:\Program Files\eMule\emule.exe"= "%windir%\Network Diagnostic\xpnetdiag.exe"= "c:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe"= "c:\WINDOWS\system32\dpvsetup.exe"= "c:\Program Files\Windows Live\Messenger\msnmsgr.exe"= "c:\Program Files\Windows Live\Messenger\livecall.exe"= R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-04-01 111184] R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-04-01 20560] R3 3xHybrid;3xHybrid service;c:\windows\system32\DRIVERS\3xHybrid.sys [2006-01-19 799744] R3 MosIrUsb;MosIrUsb.sys;c:\windows\system32\DRIVERS\MosIrUsb.sys [1980-01-01 20736] S3 ZDCndis5;ZDCndis5 Protocol Driver;\??\c:\windows\system32\ZDCndis5.SYS [] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D] \Shell\AutoRun\command - D:\setupSNK.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fb71eb8e-343d-11dc-982a-0060b30a0622}] \Shell\AutoRun\command - WD_Windows_Tools\setup.exe . Contenu du dossier 'Tâches planifiées' 2008-12-03 c:\windows\Tasks\Extension de garantie.job - c:\apps\SMP\PBCARNOT.EXE [2005-11-09 13:55] 2008-12-02 c:\windows\Tasks\HPpromotions journeysoftware.job - c:\program files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe [2005-04-22 16:36] 2008-12-03 c:\windows\Tasks\Master CD_DVD Creator.job - c:\apps\SMP\MCDCHECK.EXE [2005-11-08 15:26] 2008-12-01 c:\windows\Tasks\Norton Internet Security 2005.job - c:\progra~1\FICHIE~1\SYMANT~1\NMain.exe [] 2006-07-02 c:\windows\Tasks\Rappel d'enregistrement 3.job - c:\windows\system32\OOBE\oobebaln.exe [2008-04-14 03:34] . - - - - ORPHELINS SUPPRIMES - - - - BHO-{B72D8F30-2229-4806-BB65-FC0430E3841A} - c:\windows\system32\khfGvusp.dll MSConfigStartUp-Adobe Photo Downloader - c:\program files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe MSConfigStartUp-slide - c:\program files\slide\slide.exe MSConfigStartUp-updateMgr - c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe . ------- Examen supplémentaire ------- . FireFox -: Profile - d:\documents and settings\Stéf'\Application Data\Mozilla\Firefox\Profiles\iax3gkjn.default\ FF -: plugin - c:\program files\Viewpoint\Viewpoint Experience Technology pViewpoint.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-03 22:06:25 Windows 5.1.2600 Service Pack 3 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MysqlInventime] "ImagePath"="c:\apps\INVENT~1\mysql\bin\mysqld-nt --defaults-file=c:\apps\Inventime\mysql\my.ini MysqlInventime" . --------------------- DLLs chargées dans les processus actifs --------------------- - - - - - - - > 'winlogon.exe'(552) c:\apps\Softex\OmniPass\opxpgina.dll . ------------------------ Autres processus actifs ------------------------ . c:\program files\Alwil Software\Avast4\aswUpdSv.exe c:\program files\Alwil Software\Avast4\ashServ.exe c:\progra~1\FICHIE~1\AOL\ACS\AOLacsd.exe c:\apps\Powercinema\Kernel\TV\CLCapSvc.exe c:\program files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe c:\program files\Executive Software\DiskeeperLite\DKService.exe c:\program files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe c:\windows\system32\FTRTSVC.exe c:\apps\HIDSERVICE\HidService.exe c:\program files\Fichiers communs\Microsoft Shared\VS7Debug\MDM.EXE c:\windows\system32 vsvc32.exe c:\apps\Softex\OmniPass\OmniServ.exe c:\windows\system32\HPZipm12.exe c:\program files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe c:\apps\Powercinema\Kernel\TV\CLSched.exe c:\program files\Alwil Software\Avast4\ashMaiSv.exe c:\program files\Alwil Software\Avast4\ashWebSv.exe c:\apps\Softex\OmniPass\OPXPApp.exe . ************************************************************************** . Heure de fin: 2008-12-03 22:08:48 - La machine a redémarré ComboFix-quarantined-files.txt 2008-12-03 21:08:41 Avant-CF: 140 115 468 288 octets libres Après-CF: 140,010,872,832 octets libres 249 --- E O F --- 2008-11-13 21:00:33

stef26011981 · Answer

bonjour!

merci pour ta réponse, j'ai tout fait et voilà le rapport!

alors d'après toi? il est parti ce vilain virus???

en tous cas merci beaucoup!



[b]SDFix: Version 1.240 [/b]
Run by St‚f' on 04/12/2008 at 13:55

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


[b]Checking Files [/b]: 

No Trojan Files Found






Removing Temp Files

[b]ADS Check [/b]:
 


                                 [b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-04 14:04:18
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

D:\Documents and Settings\Stéf'\polices
D:\Documents and Settings\Stéf'\polices\batman_beat_the_hel.zip 76580 bytes
D:\Documents and Settings\Stéf'\polices\bubble_gum_rock.zip 36810 bytes
D:\Documents and Settings\Stéf'\polices\candles.zip 104336 bytes
D:\Documents and Settings\Stéf'\polices\children_bats.zip 180698 bytes
D:\Documents and Settings\Stéf'\polices\clowners.zip 124594 bytes
D:\Documents and Settings\Stéf'\polices\eyesis.zip 12075 bytes
D:\Documents and Settings\Stéf'\polices\germs.zip 22069 bytes
D:\Documents and Settings\Stéf'\polices\mickey.zip 35660 bytes
D:\Documents and Settings\Stéf'\polices\oliver.zip 30093 bytes
D:\Documents and Settings\Stéf'\polices\pad_thai.zip 18343 bytes
D:\Documents and Settings\Stéf'\polices\pamela.zip 74151 bytes
D:\Documents and Settings\Stéf'\polices\smartie.zip 28997 bytes

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 13


[b]Remaining Services [/b]:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%ProgramFiles%\AOL 9.0\aol.exe"="%ProgramFiles%\AOL 9.0\aol.exe:*:Enabled:AOL"
"%ProgramFiles%\UBISOFT\Splinter Cell Pandora Tomorrow\logo_ubi.exe"="%ProgramFiles%\UBISOFT\Splinter Cell Pandora Tomorrow\logo_ubi.exe:*:Enabled:SPLINTER CELL PANDORA"
"%ProgramFiles%\UBISOFT\Splinter Cell Pandora Tomorrow\pandora.exe"="%ProgramFiles%\UBISOFT\Splinter Cell Pandora Tomorrow\pandora.exe:*:Enabled:PANDORA"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\APPS\Inventime\my.exe"="C:\APPS\Inventime\my.exe:*:Enabled:INVENTIME"
"C:\APPS\skype\phone\Skype.exe"="C:\APPS\skype\phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\eMule\emule.exe"="C:\Program Files\eMule\emule.exe:*:Enabled:eMule"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger"
"C:\WINDOWS\system32\dpvsetup.exe"="C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\AOL 9.0\waol.exe"="C:\Program Files\AOL 9.0\waol.exe:*:Enabled:AOL 9.0"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[b]Remaining Files [/b]:



[b]Files with Hidden Attributes [/b]:

Thu 19 Jan 2006           215 A.SHR --- "C:\BOOT.BAK"
Wed 22 Oct 2008       949,072 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\advcheck.dll"
Mon 15 Sep 2008     1,562,960 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll"
Wed 30 Jul 2008     1,429,840 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe"
Wed 30 Jul 2008     4,891,984 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
Tue 16 Sep 2008     1,833,296 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
Wed 22 Oct 2008       962,896 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\Tools.dll"
Tue 31 May 2005       106,496 A..H. --- "C:\Program Files\Fichiers communs\aolshare\shell\fr\shellext.dll"

[b]Finished![/b]

stef26011981 · Answer

voilà le rapport :




Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:54:38, on 04/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\WINDOWS\System32\FTRTSVC.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Apps\Softex\OmniPass\Omniserv.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Apps\Softex\OmniPass\OPXPApp.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Anuman Interactive\Le journal de votre naissance\anniv.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Goto Software\Vade Retro\Vaderetro_Mgr.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\Fichiers communs\Ulead Systems\AutoDetector\monitor.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Apps\Powercinema\PCMService.exe
C:\WINDOWS\mHotkey.exe
C:\Program Files\MIC\HAWAII\Hawaii.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Fingerprint Sensor\ATSwpNav.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\APPS\SMP\SmpSys.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\WISPTIS.EXE
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\PROGRA~1\Wanadoo\Watch.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://home.sweetim.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Online_TV toolbar - {40d1c3a7-4ffb-4443-b3a0-a64b2df7fc3b} - C:\Program Files\Online_TV	bOnli.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Barre d'outils MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.2607.0\fr\msntb.dll (file missing)
O3 - Toolbar: Online_TV toolbar - {40d1c3a7-4ffb-4443-b3a0-a64b2df7fc3b} - C:\Program Files\Online_TV	bOnli.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Anniversaires] C:\Anuman Interactive\Le journal de votre naissance\anniv.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [VadeRetro Desktop] C:\Program Files\Goto Software\Vade Retro\Vaderetro_Mgr.exe
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [Ulead AutoDetector v2] C:\Program Files\Fichiers communs\Ulead Systems\AutoDetector\monitor.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [pdfw] C:\Program Files\Amic Utilities\PDF Writer Pro\pdfwload.exe
O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
O4 - HKLM\..\Run: [OmniPass] C:\Apps\Softex\OmniPass\scureapp.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NECHotkey] mHotkey.exe
O4 - HKLM\..\Run: [MM_MODULE] C:\Program Files\MIC\HAWAII\Hawaii.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe 
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [ATSwpNav] "C:\Program Files\Fingerprint Sensor\ATSwpNav" -run
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SmpcSys] C:\APPS\SMP\SmpSys.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Event Reminder.lnk = C:\Program Files\Broderbund\PrintMaster\PMremind.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Pense-bête.lnk = C:\Program Files\Broderbund\PrintMaster\PMREMIND.EXE
O4 - Global Startup: Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=https://fr.creative.com/
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://download.microsoft.com/download/C/B/F/CBF23A2C-3E55-4664-BC5C-762780D79BA0/OGAControl.cab
O16 - DPF: {05CDEE1D-D109-4992-B72B-6D4F5E2AB731} (PhotoBox uploader) - https://secure.photobox.com/assets/aurigma/ImageUploader4.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2EF3FB47-7B1E-4536-BA4D-51427BD45DFA} - https://www.snapfish.fr/2/home
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} (JordanUploader Class) - http://photoservice.fujicolor.de/ips-opdata/objects/jordan.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://copainsdavant.linternaute.com/...
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {8731163E-77B9-4F91-9122-F112521C28AF} (MMSPlayerX Class) - http://mmt.bouyguestelecom.fr/mmawap/jsp/composer/player/mmsPlayer.cab
O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {AF2E62B6-F9E1-4D4F-A10A-9DC8E6DCBCC0} - 
O16 - DPF: {BA162249-F2C5-4851-8ADC-FC58CB424243} (Image Uploader Control) - http://copainsdavant.linternaute.com/html_include_bibliotheque/objimageuploader/5.0.15.0/ImageUploader5.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class) - https://www.photobox.fr/?channel=1005
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: MysqlInventime - Unknown owner - C:\Apps\INVENT~1\mysql\bin\mysqld-nt.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Softex Inc. - C:\Apps\Softex\OmniPass\Omniserv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe

stef26011981 · Answer

voilà le rapport :




Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:54:38, on 04/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\WINDOWS\System32\FTRTSVC.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Apps\Softex\OmniPass\Omniserv.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Apps\Softex\OmniPass\OPXPApp.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Anuman Interactive\Le journal de votre naissance\anniv.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Goto Software\Vade Retro\Vaderetro_Mgr.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\Fichiers communs\Ulead Systems\AutoDetector\monitor.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Apps\Powercinema\PCMService.exe
C:\WINDOWS\mHotkey.exe
C:\Program Files\MIC\HAWAII\Hawaii.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Fingerprint Sensor\ATSwpNav.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\APPS\SMP\SmpSys.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\WISPTIS.EXE
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\PROGRA~1\Wanadoo\Watch.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://home.sweetim.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Online_TV toolbar - {40d1c3a7-4ffb-4443-b3a0-a64b2df7fc3b} - C:\Program Files\Online_TV	bOnli.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Barre d'outils MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.2607.0\fr\msntb.dll (file missing)
O3 - Toolbar: Online_TV toolbar - {40d1c3a7-4ffb-4443-b3a0-a64b2df7fc3b} - C:\Program Files\Online_TV	bOnli.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Anniversaires] C:\Anuman Interactive\Le journal de votre naissance\anniv.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [VadeRetro Desktop] C:\Program Files\Goto Software\Vade Retro\Vaderetro_Mgr.exe
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [Ulead AutoDetector v2] C:\Program Files\Fichiers communs\Ulead Systems\AutoDetector\monitor.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [pdfw] C:\Program Files\Amic Utilities\PDF Writer Pro\pdfwload.exe
O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
O4 - HKLM\..\Run: [OmniPass] C:\Apps\Softex\OmniPass\scureapp.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NECHotkey] mHotkey.exe
O4 - HKLM\..\Run: [MM_MODULE] C:\Program Files\MIC\HAWAII\Hawaii.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe 
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [ATSwpNav] "C:\Program Files\Fingerprint Sensor\ATSwpNav" -run
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SmpcSys] C:\APPS\SMP\SmpSys.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Event Reminder.lnk = C:\Program Files\Broderbund\PrintMaster\PMremind.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Pense-bête.lnk = C:\Program Files\Broderbund\PrintMaster\PMREMIND.EXE
O4 - Global Startup: Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=https://fr.creative.com/
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://download.microsoft.com/download/C/B/F/CBF23A2C-3E55-4664-BC5C-762780D79BA0/OGAControl.cab
O16 - DPF: {05CDEE1D-D109-4992-B72B-6D4F5E2AB731} (PhotoBox uploader) - https://secure.photobox.com/assets/aurigma/ImageUploader4.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2EF3FB47-7B1E-4536-BA4D-51427BD45DFA} - https://www.snapfish.fr/2/home
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} (JordanUploader Class) - http://photoservice.fujicolor.de/ips-opdata/objects/jordan.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://copainsdavant.linternaute.com/...
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {8731163E-77B9-4F91-9122-F112521C28AF} (MMSPlayerX Class) - http://mmt.bouyguestelecom.fr/mmawap/jsp/composer/player/mmsPlayer.cab
O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.1.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {AF2E62B6-F9E1-4D4F-A10A-9DC8E6DCBCC0} - 
O16 - DPF: {BA162249-F2C5-4851-8ADC-FC58CB424243} (Image Uploader Control) - http://copainsdavant.linternaute.com/html_include_bibliotheque/objimageuploader/5.0.15.0/ImageUploader5.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class) - https://www.photobox.fr/?channel=1005
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: MysqlInventime - Unknown owner - C:\Apps\INVENT~1\mysql\bin\mysqld-nt.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Softex Inc. - C:\Apps\Softex\OmniPass\Omniserv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe

stef26011981 · Answer

et voilà!

 
--------- Logfile of AD-Remover 1.0.5.9 by C_XX ---------
 
# START at: 22:14:14 | 04/12/2008 ON Microsoft® Windows XP ™ v5.1.2600
# BOOT MODE: Normal
 
# OPTION: Scan
# EXECUTED FROM: C:\Program Files\Ad-remover\AD-Remover.bat
 
# PC: PC2222 | USER: St‚f' ( Current user is an administrator )
 
# DRIVE(S):  C:\
# Systemdrive: C:\ (NTFS)
# Internet Explorer v6.0.2900.5512
 
--------- [ RUNNING PROCESSES: 61 ] --------- 

\SystemRoot\System32\smss.exe 
\??\C:\WINDOWS\system32\csrss.exe 
\??\C:\WINDOWS\system32\winlogon.exe 
C:\WINDOWS\system32\services.exe 
C:\WINDOWS\system32\lsass.exe 
C:\WINDOWS\system32\svchost.exe 
C:\WINDOWS\system32\svchost.exe 
C:\WINDOWS\System32\svchost.exe 
C:\WINDOWS\system32\svchost.exe 
C:\WINDOWS\system32\svchost.exe 
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe 
C:\Program Files\Alwil Software\Avast4\ashServ.exe 
C:\WINDOWS\system32\spoolsv.exe 
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe 
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe 
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe 
C:\Program Files\Executive Software\DiskeeperLite\DKService.exe 
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe 
C:\WINDOWS\System32\FTRTSVC.exe 
c:\APPS\HIDSERVICE\HIDSERVICE.exe 
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe 
C:\WINDOWS\system32
vsvc32.exe 
C:\Apps\Softex\OmniPass\Omniserv.exe 
C:\WINDOWS\system32\HPZipm12.exe 
C:\WINDOWS\system32\svchost.exe 
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe 
c:\APPS\Powercinema\Kernel\TV\CLSched.exe 
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe 
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe 
C:\Apps\Softex\OmniPass\OPXPApp.exe 
C:\WINDOWS\System32\alg.exe 
C:\WINDOWS\Explorer.EXE 
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe 
C:\Anuman Interactive\Le journal de votre naissance\anniv.exe 
C:\Program Files\QuickTime\qttask.exe 
C:\Program Files\Goto Software\Vade Retro\Vaderetro_Mgr.exe 
C:\Program Files\Unlocker\UnlockerAssistant.exe 
C:\Program Files\Fichiers communs\Ulead Systems\AutoDetector\monitor.exe 
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe 
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe 
C:\WINDOWS\SOUNDMAN.EXE 
C:\Apps\Powercinema\PCMService.exe 
C:\WINDOWS\mHotkey.exe 
C:\Program Files\MIC\HAWAII\Hawaii.exe 
C:\WINDOWS\system32\LVCOMSX.EXE 
C:\Program Files\Logitech\Video\LogiTray.exe 
C:\Program Files\Fingerprint Sensor\ATSwpNav.exe 
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe 
C:\Program Files\Macrogaming\SweetIM\SweetIM.exe 
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe 
C:\APPS\SMP\SmpSys.exe 
C:\WINDOWS\system32\ctfmon.exe 
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe 
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe 
C:\Program Files\Logitech\Video\FxSvr2.exe 
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe 
C:\Program Files\Windows Live\Messenger\usnsvc.exe 
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe 
C:\Program Files\Java\jre6\bin\jqs.exe 
C:\WINDOWS\system32\wbem\wmiapsrv.exe 
C:\WINDOWS\system32\WISPTIS.EXE 
 
----------------------------------- 

 
+---------------------------------------------------------------------------+
+------------------------------- SERVICES FOUND ..
+---------------------------------------------------------------------------+ 

 
+---------------------------------------------------------------------------+
+------------------------------- REGISTRY ELEMENTS FOUND ..
+---------------------------------------------------------------------------+ 

"HKEY_CLASSES_ROOT\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}"
"HKEY_CLASSES_ROOT\Installer\UpgradeCodes\789034A89BAC50E4782F0A7BDBF75632"
"HKEY_CLASSES_ROOT\MgMediaPlayer.GifAnimator"
"HKEY_CLASSES_ROOT\MgMediaPlayer.GifAnimator.1"
"HKEY_CURRENT_USER\SOFTWARE\SWEETIE"
"HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersionun" /v "SweetIM"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Macrogaming"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\789034A89BAC50E4782F0A7BDBF75632"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\07D5290CDBDAE4242926B8E6CA650501"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08E33F7B61DEFF24BB9673ED7D467636"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E3D8A5B48622A445A7DF73FEFF32C3F"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1AC67655DD68F8240B2860F2D511EBD8"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4318DF19719275242801CBE292063A4C"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\45FC115D1FEAEF849A4E1610D6EC8BF0"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\46A5861A389ADB844AF89E31BC9DF0A1"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49B0E1A6FF50BBE4289E4E23DE6EA0C7"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4CCCAC049F34D0540AAC13011398BEDB"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5C4389D0BFB302C479DE4178BD5D9EBA"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5D19F074C042AD34BAB463D4175A062E"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5D2B09BDEF4FE54418E6F3373CDBC7AC"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\61B65D3397A1FBF4CB1571B5E4F6B5B0"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\68E8A05C60DD9254591DBD16C94EDDBF"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\697E782CF574CC34CBB9566440BA12BC"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6AE27A8613CF7EA4782F2886F67295E5"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7CE172051F585E04187BCB97570BFA74"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86A901BA5265452499DCBF719C378EE3"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\88ABD1CD5C40EC84789A7F6EF86DAC5E"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\980289C22F80A7C4BB9323DC61255E4E"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9A4B7EF3789F871419D9302583B20C15"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A6C53B0F76C44004A8F36716213017DB"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B59F2D8189784CC46A4597F2842480B0"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BD746FB95FB8E5B45BF66BE54D5FD91F"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CCF399FCD6D2D3F46BF02A1378654FC9"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D149C1355C98DE24E82CEFBD996FE06A"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DB8DAD19CFBCC2049A4477183787E8C5"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E337925F629CF4C4FB08F3D9674DD839"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F327D0C73C0973644A21E8CC852267A0"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FA96423FE2B98E248A3B23548D1E22D9"
 
+---------------------------------------------------------------------------+
+------------------------------- FILES\FOLDERS FOUND ..
+---------------------------------------------------------------------------+ 

[20/08/2006 20:28|d--------] C:\Program Files\Macrogaming
 
+---------------------------------------------------------------------------+
+------------------------------- ADDED SCAN ..
+---------------------------------------------------------------------------+ 

 
 
+---------- Scanning prefs.js ... ( # Mozilla User Preferences )
 
...\iax3gkjn.default\prefs.js :
 
~~~~ Mozilla FireFox version 3.0.4 ~~~~

 
+----------+ 

 
+---------------------------------------------------------------------------+ 

+--[HKEY_CURRENT_USER\...\Run] 

msnmsgr	REG_SZ	"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
WOOKIT	REG_SZ	C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
swg	REG_SZ	C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
SweetIM	REG_SZ	C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
SpybotSD TeaTimer	REG_SZ	C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
SmpcSys	REG_SZ	C:\APPS\SMP\SmpSys.exe
LogitechSoftwareUpdate	REG_SZ	"C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
LDM	REG_SZ	C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
ctfmon.exe	REG_SZ	C:\WINDOWS\system32\ctfmon.exe
 
+--[HKEY_LOCAL_MACHINE\...\Run] 

avast!	REG_SZ	C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
Anniversaires	REG_SZ	C:\Anuman Interactive\Le journal de votre naissance\anniv.exe
NvCplDaemon	REG_SZ	RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
QuickTime Task	REG_SZ	"C:\Program Files\QuickTime\qttask.exe" -atboottime
Adobe Reader Speed Launcher	REG_SZ	"C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
WOOWATCH	REG_SZ	C:\PROGRA~1\Wanadoo\Watch.exe
WOOTASKBARICON	REG_SZ	C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
VadeRetro Desktop	REG_SZ	C:\Program Files\Goto Software\Vade Retro\Vaderetro_Mgr.exe
UnlockerAssistant	REG_SZ	"C:\Program Files\Unlocker\UnlockerAssistant.exe"
Ulead AutoDetector v2	REG_SZ	C:\Program Files\Fichiers communs\Ulead Systems\AutoDetector\monitor.exe
TkBellExe	REG_SZ	"C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
SunJavaUpdateSched	REG_SZ	"C:\Program Files\Java\jre6\bin\jusched.exe"
SoundMan	REG_SZ	SOUNDMAN.EXE
PHIME2002ASync	REG_SZ	C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
PHIME2002A	REG_SZ	C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
pdfw	REG_SZ	C:\Program Files\Amic Utilities\PDF Writer Pro\pdfwload.exe
PCMService	REG_SZ	"c:\Apps\Powercinema\PCMService.exe"
OmniPass	REG_SZ	C:\Apps\Softex\OmniPass\scureapp.exe
nwiz	REG_SZ	nwiz.exe /install
NvMediaCenter	REG_SZ	RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
NECHotkey	REG_SZ	mHotkey.exe
MM_MODULE	REG_SZ	C:\Program Files\MIC\HAWAII\Hawaii.exe
LVCOMSX	REG_SZ	C:\WINDOWS\system32\LVCOMSX.EXE
LogitechVideoTray	REG_SZ	C:\Program Files\Logitech\Video\LogiTray.exe
LogitechVideoRepair	REG_SZ	C:\Program Files\Logitech\Video\ISStart.exe 
IMJPMIG8.1	REG_SZ	"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
HP Software Update	REG_SZ	C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
ATSwpNav	REG_SZ	"C:\Program Files\Fingerprint Sensor\ATSwpNav" -run
 
+--[HKEY_USERS\.DEFAULT\...\Run] 

CTFMON.EXE	REG_SZ	C:\WINDOWS\system32\CTFMON.EXE
 
+--[HKEY_CURRENT_USER\...\Internet Explorer\MAIN] 

Start Page : hxxp://www.google.fr/
 
+--[HKEY_LOCAL_MACHINE\...\Internet Explorer\MAIN] 

Start Page : hxxp://home.sweetim.com
 
+---------------------------------------------------------------------------+
+------------------------------- [ E.O.F - 195 lines ]
+---------------------------------------------------------------------------+ 

- "C:\AD-report-04.12.2008.log" (12340 octets) 

[ END at: 22:14:35 | 04/12/2008 ] - [ Time elapsed: 20.7 seconds  ]

stef26011981 · Answer

--------- Logfile of AD-Remover 1.0.5.9 by C_XX ---------
 
*** Limited to ***
 
Boonty/BoontyGames 
Eorezo 
Everest Poker 
Funwebproduct/MyWay/MyWebsearch 
Messenger Skinner 
Sweetim 
 
******************
 
# START at: 22:28:14 | 04/12/2008 ON Microsoft® Windows XP ™ v5.1.2600
# BOOT MODE: Normal
 
# OPTION: Scan
# EXECUTED FROM: C:\Program Files\Ad-remover\AD-Remover.bat
 
# PC: PC2222 | USER: St‚f' ( Current user is an administrator )
 
# DRIVE(S):  C:\
# Systemdrive: C:\ (NTFS)
# Internet Explorer v6.0.2900.5512
 
--------- [ RUNNING PROCESSES: 68 ] --------- 

\SystemRoot\System32\smss.exe 
\??\C:\WINDOWS\system32\csrss.exe 
\??\C:\WINDOWS\system32\winlogon.exe 
C:\WINDOWS\system32\services.exe 
C:\WINDOWS\system32\lsass.exe 
C:\WINDOWS\system32\svchost.exe 
C:\WINDOWS\system32\svchost.exe 
C:\WINDOWS\System32\svchost.exe 
C:\WINDOWS\system32\svchost.exe 
C:\WINDOWS\system32\svchost.exe 
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe 
C:\Program Files\Alwil Software\Avast4\ashServ.exe 
C:\WINDOWS\system32\spoolsv.exe 
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe 
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe 
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe 
C:\Program Files\Executive Software\DiskeeperLite\DKService.exe 
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe 
C:\WINDOWS\System32\FTRTSVC.exe 
c:\APPS\HIDSERVICE\HIDSERVICE.exe 
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe 
C:\WINDOWS\system32
vsvc32.exe 
C:\Apps\Softex\OmniPass\Omniserv.exe 
C:\WINDOWS\system32\HPZipm12.exe 
C:\WINDOWS\system32\svchost.exe 
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe 
c:\APPS\Powercinema\Kernel\TV\CLSched.exe 
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe 
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe 
C:\Apps\Softex\OmniPass\OPXPApp.exe 
C:\WINDOWS\System32\alg.exe 
C:\WINDOWS\Explorer.EXE 
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe 
C:\Anuman Interactive\Le journal de votre naissance\anniv.exe 
C:\Program Files\QuickTime\qttask.exe 
C:\Program Files\Goto Software\Vade Retro\Vaderetro_Mgr.exe 
C:\Program Files\Unlocker\UnlockerAssistant.exe 
C:\Program Files\Fichiers communs\Ulead Systems\AutoDetector\monitor.exe 
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe 
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe 
C:\WINDOWS\SOUNDMAN.EXE 
C:\Apps\Powercinema\PCMService.exe 
C:\WINDOWS\mHotkey.exe 
C:\Program Files\MIC\HAWAII\Hawaii.exe 
C:\WINDOWS\system32\LVCOMSX.EXE 
C:\Program Files\Logitech\Video\LogiTray.exe 
C:\Program Files\Fingerprint Sensor\ATSwpNav.exe 
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe 
C:\Program Files\Macrogaming\SweetIM\SweetIM.exe 
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe 
C:\APPS\SMP\SmpSys.exe 
C:\WINDOWS\system32\ctfmon.exe 
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe 
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe 
C:\Program Files\Logitech\Video\FxSvr2.exe 
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe 
C:\Program Files\Windows Live\Messenger\usnsvc.exe 
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe 
C:\Program Files\Java\jre6\bin\jqs.exe 
C:\WINDOWS\system32\wbem\wmiapsrv.exe 
C:\WINDOWS\system32\WISPTIS.EXE 
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe 
C:\PROGRA~1\Wanadoo\ComComp.exe 
C:\PROGRA~1\Wanadoo\Toaster.exe 
C:\PROGRA~1\Wanadoo\Inactivity.exe 
C:\PROGRA~1\Wanadoo\PollingModule.exe 
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE 
C:\PROGRA~1\Wanadoo\Watch.exe 
 
----------------------------------- 

(!) ---- IE start pages reset
 
+---------------------------------------------------------------------------+
+------------------------------- SERVICES DELETED ..
+---------------------------------------------------------------------------+ 

 
+---------------------------------------------------------------------------+
+------------------------------- REGISTRY ELEMENTS DELETED ..
+---------------------------------------------------------------------------+ 

"HKEY_CLASSES_ROOT\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}"
"HKEY_CLASSES_ROOT\Installer\UpgradeCodes\789034A89BAC50E4782F0A7BDBF75632"
"HKEY_CLASSES_ROOT\MgMediaPlayer.GifAnimator"
"HKEY_CLASSES_ROOT\MgMediaPlayer.GifAnimator.1"
"HKEY_CURRENT_USER\SOFTWARE\SWEETIE"
"HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersionun" /v "SweetIM"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Macrogaming"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\789034A89BAC50E4782F0A7BDBF75632"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\07D5290CDBDAE4242926B8E6CA650501"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08E33F7B61DEFF24BB9673ED7D467636"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E3D8A5B48622A445A7DF73FEFF32C3F"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1AC67655DD68F8240B2860F2D511EBD8"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4318DF19719275242801CBE292063A4C"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\45FC115D1FEAEF849A4E1610D6EC8BF0"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\46A5861A389ADB844AF89E31BC9DF0A1"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49B0E1A6FF50BBE4289E4E23DE6EA0C7"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4CCCAC049F34D0540AAC13011398BEDB"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5C4389D0BFB302C479DE4178BD5D9EBA"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5D19F074C042AD34BAB463D4175A062E"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5D2B09BDEF4FE54418E6F3373CDBC7AC"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\61B65D3397A1FBF4CB1571B5E4F6B5B0"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\68E8A05C60DD9254591DBD16C94EDDBF"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\697E782CF574CC34CBB9566440BA12BC"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6AE27A8613CF7EA4782F2886F67295E5"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7CE172051F585E04187BCB97570BFA74"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86A901BA5265452499DCBF719C378EE3"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\88ABD1CD5C40EC84789A7F6EF86DAC5E"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\980289C22F80A7C4BB9323DC61255E4E"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9A4B7EF3789F871419D9302583B20C15"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A6C53B0F76C44004A8F36716213017DB"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B59F2D8189784CC46A4597F2842480B0"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BD746FB95FB8E5B45BF66BE54D5FD91F"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CCF399FCD6D2D3F46BF02A1378654FC9"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D149C1355C98DE24E82CEFBD996FE06A"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DB8DAD19CFBCC2049A4477183787E8C5"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E337925F629CF4C4FB08F3D9674DD839"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F327D0C73C0973644A21E8CC852267A0"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FA96423FE2B98E248A3B23548D1E22D9"
 
+---------------------------------------------------------------------------+
+------------------------------- FILES\FOLDERS DELETED ..
+---------------------------------------------------------------------------+ 

/!\ NOT DELETED - [20/08/2006 20:28|d--------] C:\Program Files\Macrogaming 
 
(!) ---- Temp files deleted.
(!) ---- Recycle bin emptied in all drives. 

 
************* /!\ File(s)/Folder(s) Not Deleted /!\ *************
 
"C:\Program Files\Macrogaming"
 
Second run ...

"C:\Program Files\Macrogaming" - RESIST !

 
+---------------------------------------------------------------------------+
+------------------------------- ADDED SCAN ..
+---------------------------------------------------------------------------+ 

 
 
+---------- Scanning prefs.js ... ( # Mozilla User Preferences )
 
...\iax3gkjn.default\prefs.js :
 
~~~~ Mozilla FireFox version 3.0.4 ~~~~

 
+----------+ 

+--[HKEY_CURRENT_USER\...\Run] 

msnmsgr	REG_SZ	"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
WOOKIT	REG_SZ	C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
swg	REG_SZ	C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
SpybotSD TeaTimer	REG_SZ	C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
SmpcSys	REG_SZ	C:\APPS\SMP\SmpSys.exe
LogitechSoftwareUpdate	REG_SZ	"C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
LDM	REG_SZ	C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
ctfmon.exe	REG_SZ	C:\WINDOWS\system32\ctfmon.exe
 
+--[HKEY_LOCAL_MACHINE\...\Run] 

avast!	REG_SZ	C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
Anniversaires	REG_SZ	C:\Anuman Interactive\Le journal de votre naissance\anniv.exe
NvCplDaemon	REG_SZ	RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
QuickTime Task	REG_SZ	"C:\Program Files\QuickTime\qttask.exe" -atboottime
Adobe Reader Speed Launcher	REG_SZ	"C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
WOOWATCH	REG_SZ	C:\PROGRA~1\Wanadoo\Watch.exe
WOOTASKBARICON	REG_SZ	C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
VadeRetro Desktop	REG_SZ	C:\Program Files\Goto Software\Vade Retro\Vaderetro_Mgr.exe
UnlockerAssistant	REG_SZ	"C:\Program Files\Unlocker\UnlockerAssistant.exe"
Ulead AutoDetector v2	REG_SZ	C:\Program Files\Fichiers communs\Ulead Systems\AutoDetector\monitor.exe
TkBellExe	REG_SZ	"C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
SunJavaUpdateSched	REG_SZ	"C:\Program Files\Java\jre6\bin\jusched.exe"
SoundMan	REG_SZ	SOUNDMAN.EXE
PHIME2002ASync	REG_SZ	C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
PHIME2002A	REG_SZ	C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
pdfw	REG_SZ	C:\Program Files\Amic Utilities\PDF Writer Pro\pdfwload.exe
PCMService	REG_SZ	"c:\Apps\Powercinema\PCMService.exe"
OmniPass	REG_SZ	C:\Apps\Softex\OmniPass\scureapp.exe
nwiz	REG_SZ	nwiz.exe /install
NvMediaCenter	REG_SZ	RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
NECHotkey	REG_SZ	mHotkey.exe
MM_MODULE	REG_SZ	C:\Program Files\MIC\HAWAII\Hawaii.exe
LVCOMSX	REG_SZ	C:\WINDOWS\system32\LVCOMSX.EXE
LogitechVideoTray	REG_SZ	C:\Program Files\Logitech\Video\LogiTray.exe
LogitechVideoRepair	REG_SZ	C:\Program Files\Logitech\Video\ISStart.exe 
IMJPMIG8.1	REG_SZ	"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
HP Software Update	REG_SZ	C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
ATSwpNav	REG_SZ	"C:\Program Files\Fingerprint Sensor\ATSwpNav" -run
 
+--[HKEY_USERS\.DEFAULT\...\Run] 

CTFMON.EXE	REG_SZ	C:\WINDOWS\system32\CTFMON.EXE
 
+--[HKEY_CURRENT_USER\...\Internet Explorer\MAIN] 

Start Page : hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
 
+--[HKEY_LOCAL_MACHINE\...\Internet Explorer\MAIN] 

Start Page : hxxp://fr.msn.com/
 
+---------------------------------------------------------------------------+
+------------------------------- [ E.O.F - 221 lines ]
+---------------------------------------------------------------------------+ 

- "C:\AD-report-04.12.2008.log" (12964 octets) 

[ END at: 22:30:41 | 04/12/2008 ] - [ Time elapsed: 2 minutes, 27 seconds  ]

stef26011981 · Answer

voilà, mon bureau et mes pages internet sont ENORMES!!!!!! ??? -------------- UsbFix V2.413.2 --------------- * User : St‚f' - PC2222 * Outils mis a jours le 01/12/2008 par Chiquitine29 et Chimay8 * Recherche effectuée à 22:49:58 le 04/12/2008 * Windows Xp - Internet Explorer 6.0.2900.5512 --------------- [ Processus actifs ] ---------------- C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe C:\Program Files\Executive Software\DiskeeperLite\DKService.exe C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe C:\WINDOWS\System32\FTRTSVC.exe c:\APPS\HIDSERVICE\HIDSERVICE.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32 vsvc32.exe C:\Apps\Softex\OmniPass\Omniserv.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe c:\APPS\Powercinema\Kernel\TV\CLSched.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Apps\Softex\OmniPass\OPXPApp.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\system32\userinit.exe C:\WINDOWS\system32\wbem\wmiprvse.exe D:\DOCUME~1\STF'~1\LOCALS~1\Temp\1.tmp\b2e.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe --------------- [ Informations lecteurs ] ---------------- C: - Lecteur fixe D: - Lecteur fixe E: - Lecteur de CD-ROM G: - Lecteur fixe +- Contenu de l'autorun : G:\autorun.inf [autorun] open=WD_Windows_Tools\setup.exe ICON=AUTORUN\WDLOGO.ICO --------------- [ Lecteur C ] ---------------- C: - Lecteur fixe +- Listing des fichiers présents : [05/08/2004 14:00][--a------] C:\NTDETECT.COM [04/12/2008 14:19][-rahs----] C:\BOOT.INI [29/06/2007 20:50][--a------] C:\AILog.txt [29/06/2007 20:50][--a------] C:\ComboFix.txt [29/06/2007 20:50][--a------] C:\DWNLOG.TXT [29/06/2007 20:50][--a------] C:\fixnavi.txt [29/06/2007 20:50][--a------] C:\SAUDIT.TXT [29/06/2007 20:50][--a------] C:\UsbFix.txt [19/01/2006 05:45][-rahs----] C:\IO.SYS [19/01/2006 05:45][-rahs----] C:\MSDOS.SYS [19/01/2006 05:45][-rahs----] C:\pagefile.sys --------------- [ Lecteur D ] ---------------- D: - Lecteur fixe +- Listing des fichiers présents : [03/08/2004 23:55][--a------] D:\setupSNK.exe --------------- [ Lecteur E ] ---------------- E: - Lecteur de CD-ROM +- Listing des fichiers présents : --------------- [ Lecteur G ] ---------------- G: - Lecteur fixe +- Listing des fichiers présents : [03/12/2008 15:14][--a------] G:\MSNFix.exe [17/11/2005 16:06][--ah-----] G:\autorun.inf --------------- [ Registre / Startup ] ---------------- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "Userinit"="C:\WINDOWS\system32\userinit.exe," [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "Search Page"="https://www.google.com/?gws_rd=ssl" "Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion un] msnmsgr="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background WOOKIT=C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx swg=C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe SpybotSD TeaTimer=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe SmpcSys=C:\APPS\SMP\SmpSys.exe LogitechSoftwareUpdate="C:\Program Files\Logitech\Video\ManifestEngine.exe" boot LDM=C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe ctfmon.exe=C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion un] avast!=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe Anniversaires=C:\Anuman Interactive\Le journal de votre naissance\anniv.exe NvCplDaemon=RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup QuickTime Task="C:\Program Files\QuickTime\qttask.exe" -atboottime Adobe Reader Speed Launcher="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" WOOWATCH=C:\PROGRA~1\Wanadoo\Watch.exe WOOTASKBARICON=C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe VadeRetro Desktop=C:\Program Files\Goto Software\Vade Retro\Vaderetro_Mgr.exe UnlockerAssistant="C:\Program Files\Unlocker\UnlockerAssistant.exe" Ulead AutoDetector v2=C:\Program Files\Fichiers communs\Ulead Systems\AutoDetector\monitor.exe TkBellExe="C:\Program Files\Fichiers communs\Real\Update_OB ealsched.exe" -osboot SunJavaUpdateSched="C:\Program Files\Java\jre6\bin\jusched.exe" SoundMan=SOUNDMAN.EXE PHIME2002ASync=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC PHIME2002A=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName pdfw=C:\Program Files\Amic Utilities\PDF Writer Pro\pdfwload.exe PCMService="c:\Apps\Powercinema\PCMService.exe" OmniPass=C:\Apps\Softex\OmniPass\scureapp.exe nwiz=nwiz.exe /install NvMediaCenter=RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit NECHotkey=mHotkey.exe MM_MODULE=C:\Program Files\MIC\HAWAII\Hawaii.exe LVCOMSX=C:\WINDOWS\system32\LVCOMSX.EXE LogitechVideoTray=C:\Program Files\Logitech\Video\LogiTray.exe LogitechVideoRepair=C:\Program Files\Logitech\Video\ISStart.exe IMJPMIG8.1="C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 HP Software Update=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe ATSwpNav="C:\Program Files\Fingerprint Sensor\ATSwpNav" -run HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion un\OptionalComponents= = HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion un\OptionalComponents\IMAIL= Installed=1 = HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion un\OptionalComponents\MAPI= NoChange=1 Installed=1 = HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion un\OptionalComponents\MSFS= Installed=1 = --------------- [ Registre / Mountpoint2 ] ---------------- -> Recherche négative. --------------- [ Nettoyage des disques ] ---------------- Supprimé ! - [17/11/2005 16:06][--ah-----] G:\autorun.inf --------------- [ Resumé ] ---------------- -> /!\ Le resultat doit etre interprété par un spécialiste /!\ [05/08/2004 14:00][--a------] C:\NTDETECT.COM [04/12/2008 14:19][-rahs----] C:\BOOT.INI [03/08/2004 23:55][--a------] D:\setupSNK.exe [03/12/2008 15:14][--a------] G:\MSNFix.exe --------------- ! Fin du rapport ! ----------------

stef26011981 · Answer

1h30 plus tard!
pour l'apparence j'avais déjà fait mais le mode normal est tout de même énorme!!! hier cela l'a fait et après cela s'est réduit... un peu top même!!!

voilà le scan :



Malwarebytes' Anti-Malware 1.31
Version de la base de données: 1460
Windows 5.1.2600 Service Pack 3

05/12/2008 00:32:30
mbam-log-2008-12-05 (00-32-30).txt

Type de recherche: Examen complet (C:\|D:\|E:\|F:\|G:\|)
Eléments examinés: 175270
Temps écoulé: 1 hour(s), 23 minute(s), 34 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 3

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{af2e62b6-f9e1-4d4f-a10a-9dc8e6dcbcc0} (Adware.VideoEgg) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP955\A0225495.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP955\A0225496.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP955\A0225497.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

stef26011981 · Answer

j'ai oublié hier, il m'a détecté 3 cheval de troye


j'ai fit des imprims écran au cas ou!

stef26011981 · Answer

je t'envoie cela ce soir dès que je rentre! je pensais te l'avoir envoyé, j'essaie de le retrouver!

stef26011981 · Answer

le voici :

[ Rapport ToolsCleaner version 2.2.6 (par A.Rothstein & dj QUIOU) ]

-->- Recherche: 

D:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
D:\Documents and Settings\All Users\Menu Démarrer\Programmes\MsnFix: trouvé !
D:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
D:\Documents and Settings\All Users\Menu Démarrer\Programmes\MSNFix\MSNFix.lnk: trouvé !
D:\Documents and Settings\Stéf'\Bureau\SdFix.exe: trouvé !
D:\Documents and Settings\Stéf'\Bureau\HijackThis.lnk: trouvé !
D:\Documents and Settings\Stéf'\Bureau\ComboFix.exe: trouvé !
D:\Documents and Settings\Stéf'\Bureau\UsbFix.lnk: trouvé !
D:\Documents and Settings\Stéf'\Menu Démarrer\Programmes\UsbFix: trouvé !
D:\Documents and Settings\Stéf'\Menu Démarrer\Programmes\UsbFix\UsbFix.lnk: trouvé !

stef26011981 · Answer

non, il faut que je le fasse?
je relance le truc et je supprime?
merci!

stef26011981 · Answer

j'ai supprimé!
voilà ce que ça donne :



[ Rapport ToolsCleaner version 2.2.6 (par A.Rothstein & dj QUIOU) ]

-->- Recherche: 

D:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
D:\Documents and Settings\All Users\Menu Démarrer\Programmes\MsnFix: trouvé !
D:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
D:\Documents and Settings\All Users\Menu Démarrer\Programmes\MSNFix\MSNFix.lnk: trouvé !
D:\Documents and Settings\Stéf'\Bureau\SdFix.exe: trouvé !
D:\Documents and Settings\Stéf'\Bureau\HijackThis.lnk: trouvé !
D:\Documents and Settings\Stéf'\Bureau\ComboFix.exe: trouvé !
D:\Documents and Settings\Stéf'\Bureau\UsbFix.lnk: trouvé !
D:\Documents and Settings\Stéf'\Menu Démarrer\Programmes\UsbFix: trouvé !
D:\Documents and Settings\Stéf'\Menu Démarrer\Programmes\UsbFix\UsbFix.lnk: trouvé !

---------------------------------
-->- Suppression: 

D:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: supprimé !
D:\Documents and Settings\All Users\Menu Démarrer\Programmes\MSNFix\MSNFix.lnk: supprimé !
D:\Documents and Settings\Stéf'\Bureau\SdFix.exe: supprimé !
D:\Documents and Settings\Stéf'\Bureau\HijackThis.lnk: supprimé !
D:\Documents and Settings\Stéf'\Bureau\ComboFix.exe: ERREUR DE SUPPRESSION !!
D:\Documents and Settings\Stéf'\Bureau\UsbFix.lnk: supprimé !
D:\Documents and Settings\Stéf'\Menu Démarrer\Programmes\UsbFix\UsbFix.lnk: supprimé !
D:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: supprimé !
D:\Documents and Settings\All Users\Menu Démarrer\Programmes\MsnFix: supprimé !
D:\Documents and Settings\Stéf'\Menu Démarrer\Programmes\UsbFix: supprimé !

stef26011981 · Answer

c fait!!!

stef26011981 · Answer

c'est tout bon!

stef26011981 · Answer

écoute cela à l'air d'être pas mal, après je n'y connais rien en virus donc... mais ce qui clochait à l'air d'être parti (ex les MAJ auto qui affichaient dans ma barre des tâches que ça n'était pas activé alors que cela l'était dans le panneau de config)... etc... là il a l'air vraiment d'aller mieux, il est plus rapide!

Pour toi c'est parti?

stef26011981 · Answer

et bien écoute  je t'adresse un grand merci!
vraiment, et chapeau pour le boulot!
sur ce, je vais aller au dodo car demain boulot!
bonne soirée, merciiiiiiiiiiiiiiiiiiiiii pour tout!

Virus msn virtumonde

17 réponses

Discussions similaires

Newsletters