Trojan.zlob.G

Résolu
jstlovesnow -  
Bonjour,
j'ai un probleme avec le trojan.zlob.g j'ai éssayer de l'enlever avec plusieur anti-virus mais cela ne marche pas mon anti-virus est spyware doctor+anti-virus mais il ne le detect pas le virus me deconnect constament de mes pag intertnet et je ne peu rentré sur msconfig il redemarre toujour mon pc est-ce qu.il i a qu'elle qu'un qui pourrait maider ? merci
Configuration: Windows XP
Internet Explorer 7.0

33 réponses

Résumé de la discussion

Problème de sécurité lié au trojan.zlob.g sur Windows XP et Internet Explorer 7, qui provoque des déconnexions répétées, des redémarrages et empêche l'accès fiable au réseau, nécessitant une approche de nettoyage avancée. Des solutions variées apparaissent, incluant SmitfraudFix, RSIT et Lop S&D, puis des outils complémentaires et procédures conseillées pour scanner, analyser et nettoyer le système profondément. Plusieurs étapes guidées demandent de générer et partager des rapports d'analyse afin d'évaluer les résultats des scans et de suivre les recommandations spécifiques avant d'enchaîner les outils complémentaires. En outre, certaines propositions conseillent de démarrer en mode sans échec et d'interrompre les processus suspects, puis de redémarrer normalement après nettoyage pour limiter les risques de résidus et de réinfection.

Bobot (l’IA à votre service)
  1. Destrio5 Modérateur
    Salut,

    - Télécharge HijackThis v2.0.2 sur ton Bureau.

    - Double-clique sur HJTInstall afin de lancer l'installation.

    - Clique sur Install ensuite sur I Accept.

    - Clique sur Do a system scan and save a logfile.

    - Le bloc-notes s'ouvrira, fais un copier/coller de tout son contenu ici dans ton prochain message.
    1. Destrio5 Modérateur
      - Télécharge Random's System Information Tool (RSIT) (par random/random) sur ton Bureau.

      - Double-clique sur RSIT.exe afin de lancer le programme.

      - Clique sur Continue à l'écran Disclaimer.

      - Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.

      - Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (c'est celui qui apparaît à l'écran) ainsi que de info.txt (que tu verras dans la barre des tâches).

      Note : Les rapports sont sauvegardés dans le dossier C:\rsit.
      1. Destrio5 Modérateur
        ---> Télécharge Lop S&D sur ton Bureau.
        ---> Double-clique dessus pour lancer l'installation.
        ---> Puis double-clique sur le raccourci Lop S&D présent sur ton Bureau.
        ---> Sélectionne la langue souhaitée, puis choisis l'option 1 (Recherche).
        ---> Patiente jusqu'à la fin du scan.
        ---> Poste le rapport généré (C:\lopR.txt).
        1. Destrio5 Modérateur
          ---> Relance Lop S&D.
          ---> Choisis cette fois-ci l'option 2 (Suppression).
          ---> Ne ferme pas la fenêtre lors de la suppression !
          ---> Poste le rapport généré (C:\lopR.txt).

          (Si le Bureau ne réapparait pas, presse Ctrl+Alt+Suppr, Onglet Fichier, Nouvelle tâche, tape explorer.exe et valide)
          2. Destrio5 Modérateur
            ---> Télécharge Toolbar S&D (Team IDN) sur ton Bureau.
            * Lance l'installation du programme en exécutant le fichier téléchargé.
            * Double-clique maintenant sur le raccourci de Toolbar S&D.
            * Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.
            * Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche.
            * Poste le rapport généré. (C:\TB.txt)
            1. Destrio5 Modérateur
              ---> Relance ToolBar S&D, fais l'option 2 et poste le rapport.
              1. Destrio5 Modérateur
                - Télécharge SmitfraudFix (de de S!Ri, balltrap34 et moe31) sur ton Bureau.
                http://siri.urz.free.fr/Fix/SmitfraudFix.exe

                - Double-clique sur SmitfraudFix.exe et choisis l'option 1 puis Entrée.

                - Un rapport sera généré, poste-le dans ta prochaine réponse.

                [*] process.exe est détecté par certains antivirus comme étant un risktool. Il ne s'agit pas d'un virus mais d'un utilitaire destiné à mettre fin à des processus.[*]

                ** Ne fais l'étape 2 que si on te le demande, on doit d'abord examiner le premier rapport de SmitfraudFix.
                1. Destrio5 Modérateur
                  - Redémarre ton ordinateur en mode sans échec :
                  https://blog.sosordi.net/

                  - Double-clique sur SmitfraudFix.exe, choisis l'option 2 et Entrée.

                  - Réponds O (Oui) à ces deux questions si elles te sont posées :

                  Voulez-vous nettoyer le registre ?
                  Corriger le fichier infecté ?

                  - Un rapport sera généré, sauvegarde-le sur le Bureau.

                  - Redémarre en mode normal.

                  - Poste le rapport SmitfraudFix.
                  1. Destrio5 Modérateur
                    ---> Télécharge Malwarebytes' Anti-Malware (MBAM) sur ton Bureau.
                    ---> Double-clique sur le fichier téléchargé pour lancer le processus d'installation.
                    ---> Dans l'onglet Mise à jour, clique sur le bouton Recherche de mise à jour : si le pare-feu demande l'autorisation à MBAM de se connecter à Internet, accepte.
                    ---> Une fois la mise à jour terminée, rends-toi dans l'onglet Recherche.
                    ---> Sélectionne Exécuter un examen complet.
                    ---> Clique sur Rechercher. L'analyse démarre, le scan est relativement long, c'est normal.

                    A la fin de l'analyse, un message s'affiche :

                    L'examen s'est terminé normalement. Cliquez sur 'Afficher les résultats' pour afficher tous les objets trouvés.

                    ---> Clique sur OK pour poursuivre. Si MBAM n'a rien trouvé, il te le dira aussi.
                    ---> Ferme tes navigateurs.
                    Si des malwares ont été détectés, clique sur Afficher les résultats.
                    ---> Sélectionne tout (ou laisse coché) et clique sur Supprimer la sélection, MBAM va détruire les fichiers et clés de registre infectés et en mettre une copie dans la quarantaine.
                    ---> MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Copie-colle ce rapport dans ta prochaine réponse.
                    1. Destrio5 Modérateur
                      --> Télécharge UsbFix (de Chiquitine29) sur ton Bureau :
                      http://sd-1.archive-host.com/membres/up/116615172019703188/UsbFix.exe

                      --> Lance l'installation avec les paramètres par défaut.

                      --> Branche tes sources de données externes à ton PC (clé USB, disque dur externe, etc...) sans les ouvrir.

                      --> Double-clique sur le raccourci UsbFix sur ton Bureau.

                      --> Choisis l'option 1 (Nettoyage).

                      --> Le PC va redémarrer.

                      --> Après redémarrage, poste le rapport UsbFix.txt

                      Note : le rapport UsbFix.txt est sauvegardé à la racine du disque.

                      (Si le Bureau ne réapparait pas, presse Ctrl+Alt+Suppr, Onglet "Fichier", "Nouvelle tâche", tape explorer.exe et valide)
                      2. jstlovesnow Auteur
                        Logfile of Trend Micro HijackThis v2.0.2
                        Scan saved at 11:28:55, on 2008-12-10
                        Platform: Windows XP SP3 (WinNT 5.01.2600)
                        MSIE: Internet Explorer v7.00 (7.00.6000.20935)
                        Boot mode: Normal

                        Running processes:
                        C:\WINDOWS\System32\smss.exe
                        C:\WINDOWS\system32\csrss.exe
                        C:\WINDOWS\system32\winlogon.exe
                        C:\WINDOWS\system32\services.exe
                        C:\WINDOWS\system32\lsass.exe
                        C:\WINDOWS\system32\svchost.exe
                        C:\WINDOWS\system32\svchost.exe
                        C:\WINDOWS\System32\svchost.exe
                        C:\WINDOWS\system32\svchost.exe
                        C:\WINDOWS\system32\svchost.exe
                        C:\WINDOWS\Explorer.EXE
                        C:\WINDOWS\system32\spoolsv.exe
                        C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
                        C:\WINDOWS\SOUNDMAN.EXE
                        C:\Program Files\Java\jre6\bin\jusched.exe
                        C:\Program Files\Micro Innovations\Keyboard\kbdap32a.EXE
                        C:\Program Files\Micro Innovations\Mouse\mouse32a.exe
                        C:\Program Files\iTunes\iTunesHelper.exe
                        C:\WINDOWS\system32\RUNDLL32.EXE
                        C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
                        C:\Program Files\Logitech\QuickCam\Quickcam.exe
                        C:\Program Files\Spyware Doctor\pctsTray.exe
                        C:\WINDOWS\system32\ctfmon.exe
                        C:\Program Files\Messenger\msmsgs.exe
                        C:\Program Files\MétéoMédia\MétéoÉclair\WeatherEye.exe
                        C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
                        C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                        C:\Program Files\Bonjour\mDNSResponder.exe
                        C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                        C:\Program Files\Java\jre6\bin\jqs.exe
                        C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
                        C:\WINDOWS\system32\nvsvc32.exe
                        C:\WINDOWS\system32\PnkBstrA.exe
                        C:\Program Files\Spyware Doctor\pctsAuxs.exe
                        C:\Program Files\Spyware Doctor\pctsSvc.exe
                        C:\WINDOWS\system32\svchost.exe
                        C:\Program Files\iPod\bin\iPodService.exe
                        C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
                        C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
                        C:\WINDOWS\system32\wbem\wmiapsrv.exe
                        C:\WINDOWS\System32\alg.exe
                        C:\WINDOWS\System32\svchost.exe
                        C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe
                        C:\WINDOWS\system32\dwwin.exe
                        C:\Program Files\Windows Live\Messenger\msnmsgr.exe
                        C:\Program Files\Windows Live\Messenger\usnsvc.exe
                        C:\Program Files\iTunes\iTunes.exe
                        C:\Program Files\Internet Explorer\IEXPLORE.EXE
                        C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
                        C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
                        C:\WINDOWS\system32\wbem\wmiprvse.exe

                        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ca.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*https://ca.search.yahoo.com/
                        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.ca/
                        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://ca.yahoo.com/
                        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ca.rd.yahoo.com/customize/ie/defaults/su/msgr9/*https://ca.search.yahoo.com/
                        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ca.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*https://ca.search.yahoo.com/
                        R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://ca.yahoo.com/
                        R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://ca.rd.yahoo.com/customize/ie/defaults/su/msgr9/*https://ca.search.yahoo.com/
                        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                        R3 - URLSearchHook: TorrentMan Toolbar - {7c5c0f58-e061-457d-9033-77307f5ed00c} - C:\Program Files\TorrentMan\tbTor0.dll
                        R3 - URLSearchHook: Yahoo! Barre d'outils - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
                        O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
                        O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
                        O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
                        O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
                        O2 - BHO: TorrentMan Toolbar - {7c5c0f58-e061-457d-9033-77307f5ed00c} - C:\Program Files\TorrentMan\tbTor0.dll
                        O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                        O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                        O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
                        O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
                        O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
                        O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
                        O3 - Toolbar: TorrentMan Toolbar - {7c5c0f58-e061-457d-9033-77307f5ed00c} - C:\Program Files\TorrentMan\tbTor0.dll
                        O3 - Toolbar: Yahoo! Barre d'outils - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
                        O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
                        O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
                        O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
                        O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
                        O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
                        O4 - HKLM\..\Run: [OFFICEKB] C:\Program Files\Micro Innovations\Keyboard\kbdap32a.EXE
                        O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Micro Innovations\Mouse\mouse32a.exe
                        O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                        O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
                        O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
                        O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
                        O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
                        O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
                        O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
                        O4 - HKLM\..\Run: [SpyHunter Security Suite] C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe
                        O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                        O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
                        O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
                        O4 - HKCU\..\Run: [WeatherEye] C:\Program Files\MétéoMédia\MétéoÉclair\WeatherEye.exe
                        O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                        O4 - HKUS\S-1-5-19\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'SERVICE LOCAL')
                        O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                        O4 - HKUS\S-1-5-20\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'SERVICE RÉSEAU')
                        O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                        O4 - HKUS\S-1-5-18\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'SYSTEM')
                        O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                        O4 - HKUS\.DEFAULT\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'Default user')
                        O4 - Startup: Logitech . Enregistrement du produit.lnk = C:\Program Files\Logitech\QuickCam\eReg.exe
                        O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
                        O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
                        O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                        O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                        O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                        O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
                        O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
                        O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file:///C:/Program%20Files/Risk/Images/stg_drm.ocx
                        O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
                        O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
                        O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - https://www.eset.com/
                        O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
                        O16 - DPF: {5CB1506E-1DEA-4E63-89A7-E40E52AEA1FD} (OnagerCtrl Class) - http://fulfillment.puretracks.com/onager.cab
                        O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-CA/a-UNO1/GAME_UNO1.cab
                        O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
                        O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) - file:///C:/Program%20Files/Risk/Images/armhelper.ocx
                        O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
                        O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab
                        O17 - HKLM\System\CCS\Services\Tcpip\..\{89C58DB9-5E83-4CCE-82CF-D767D34179A5}: NameServer = 142.166.145.137 142.177.2.130
                        O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                        O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
                        O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                        O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
                        O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
                        O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
                        O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
                        O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
                        O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
                        O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
                        O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
                        1. jstlovesnow Auteur
                          Logfile of random's system information tool 1.04 (written by random/random)
                          Run by Jean-Sébastien at 2008-12-10 11:31:14
                          Microsoft Windows XP Professionnel Service Pack 3
                          System drive C: has 23 GB (32%) free of 74 GB
                          Total RAM: 1023 MB (37% free)

                          Logfile of Trend Micro HijackThis v2.0.2
                          Scan saved at 11:31:17, on 2008-12-10
                          Platform: Windows XP SP3 (WinNT 5.01.2600)
                          MSIE: Internet Explorer v7.00 (7.00.6000.20935)
                          Boot mode: Normal

                          Running processes:
                          C:\WINDOWS\System32\smss.exe
                          C:\WINDOWS\system32\csrss.exe
                          C:\WINDOWS\system32\winlogon.exe
                          C:\WINDOWS\system32\services.exe
                          C:\WINDOWS\system32\lsass.exe
                          C:\WINDOWS\system32\svchost.exe
                          C:\WINDOWS\system32\svchost.exe
                          C:\WINDOWS\System32\svchost.exe
                          C:\WINDOWS\system32\svchost.exe
                          C:\WINDOWS\system32\svchost.exe
                          C:\WINDOWS\Explorer.EXE
                          C:\WINDOWS\system32\spoolsv.exe
                          C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
                          C:\WINDOWS\SOUNDMAN.EXE
                          C:\Program Files\Java\jre6\bin\jusched.exe
                          C:\Program Files\Micro Innovations\Keyboard\kbdap32a.EXE
                          C:\Program Files\Micro Innovations\Mouse\mouse32a.exe
                          C:\Program Files\iTunes\iTunesHelper.exe
                          C:\WINDOWS\system32\RUNDLL32.EXE
                          C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
                          C:\Program Files\Logitech\QuickCam\Quickcam.exe
                          C:\Program Files\Spyware Doctor\pctsTray.exe
                          C:\WINDOWS\system32\ctfmon.exe
                          C:\Program Files\Messenger\msmsgs.exe
                          C:\Program Files\MétéoMédia\MétéoÉclair\WeatherEye.exe
                          C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
                          C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                          C:\Program Files\Bonjour\mDNSResponder.exe
                          C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                          C:\Program Files\Java\jre6\bin\jqs.exe
                          C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
                          C:\WINDOWS\system32\nvsvc32.exe
                          C:\WINDOWS\system32\PnkBstrA.exe
                          C:\Program Files\Spyware Doctor\pctsAuxs.exe
                          C:\Program Files\Spyware Doctor\pctsSvc.exe
                          C:\WINDOWS\system32\svchost.exe
                          C:\Program Files\iPod\bin\iPodService.exe
                          C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
                          C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
                          C:\WINDOWS\system32\wbem\wmiapsrv.exe
                          C:\WINDOWS\System32\alg.exe
                          C:\WINDOWS\System32\svchost.exe
                          C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe
                          C:\WINDOWS\system32\dwwin.exe
                          C:\Program Files\Windows Live\Messenger\msnmsgr.exe
                          C:\Program Files\Windows Live\Messenger\usnsvc.exe
                          C:\Program Files\iTunes\iTunes.exe
                          C:\Program Files\Internet Explorer\IEXPLORE.EXE
                          C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
                          C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
                          C:\WINDOWS\system32\NOTEPAD.EXE
                          C:\Documents and Settings\Jean-Sébastien\Local Settings\Temporary Internet Files\Content.IE5\N41Y0KRK\RSIT[1].exe
                          C:\WINDOWS\system32\wbem\wmiprvse.exe
                          C:\Program Files\Trend Micro\HijackThis\Jean-Sébastien.exe

                          R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ca.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*https://ca.search.yahoo.com/
                          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.ca/
                          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://ca.yahoo.com/
                          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ca.rd.yahoo.com/customize/ie/defaults/su/msgr9/*https://ca.search.yahoo.com/
                          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ca.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*https://ca.search.yahoo.com/
                          R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://ca.yahoo.com/
                          R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://ca.rd.yahoo.com/customize/ie/defaults/su/msgr9/*https://ca.search.yahoo.com/
                          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                          R3 - URLSearchHook: TorrentMan Toolbar - {7c5c0f58-e061-457d-9033-77307f5ed00c} - C:\Program Files\TorrentMan\tbTor0.dll
                          R3 - URLSearchHook: Yahoo! Barre d'outils - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
                          O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
                          O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
                          O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
                          O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
                          O2 - BHO: TorrentMan Toolbar - {7c5c0f58-e061-457d-9033-77307f5ed00c} - C:\Program Files\TorrentMan\tbTor0.dll
                          O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                          O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                          O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
                          O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
                          O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
                          O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
                          O3 - Toolbar: TorrentMan Toolbar - {7c5c0f58-e061-457d-9033-77307f5ed00c} - C:\Program Files\TorrentMan\tbTor0.dll
                          O3 - Toolbar: Yahoo! Barre d'outils - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
                          O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
                          O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
                          O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
                          O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
                          O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
                          O4 - HKLM\..\Run: [OFFICEKB] C:\Program Files\Micro Innovations\Keyboard\kbdap32a.EXE
                          O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Micro Innovations\Mouse\mouse32a.exe
                          O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                          O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
                          O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
                          O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
                          O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
                          O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
                          O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
                          O4 - HKLM\..\Run: [SpyHunter Security Suite] C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe
                          O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                          O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
                          O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
                          O4 - HKCU\..\Run: [WeatherEye] C:\Program Files\MétéoMédia\MétéoÉclair\WeatherEye.exe
                          O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                          O4 - HKUS\S-1-5-19\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'SERVICE LOCAL')
                          O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                          O4 - HKUS\S-1-5-20\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'SERVICE RÉSEAU')
                          O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                          O4 - HKUS\S-1-5-18\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'SYSTEM')
                          O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                          O4 - HKUS\.DEFAULT\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'Default user')
                          O4 - Startup: Logitech . Enregistrement du produit.lnk = C:\Program Files\Logitech\QuickCam\eReg.exe
                          O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
                          O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
                          O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                          O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                          O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                          O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                          O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
                          O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
                          O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file:///C:/Program%20Files/Risk/Images/stg_drm.ocx
                          O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
                          O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
                          O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - https://www.eset.com/
                          O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
                          O16 - DPF: {5CB1506E-1DEA-4E63-89A7-E40E52AEA1FD} (OnagerCtrl Class) - http://fulfillment.puretracks.com/onager.cab
                          O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-CA/a-UNO1/GAME_UNO1.cab
                          O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
                          O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) - file:///C:/Program%20Files/Risk/Images/armhelper.ocx
                          O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
                          O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab
                          O17 - HKLM\System\CCS\Services\Tcpip\..\{89C58DB9-5E83-4CCE-82CF-D767D34179A5}: NameServer = 142.166.145.137 142.177.2.130
                          O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                          O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
                          O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                          O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
                          O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
                          O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
                          O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
                          O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
                          O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
                          O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
                          O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
                          2. jstlovesnow Auteur
                            --------------------\\ Lop S&D 4.2.4-9c XP/Vista

                            Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
                            X86-based PC ( Uniprocessor Free : AMD Athlon(tm) 64 Processor 3000+ )
                            BIOS : Default System BIOS
                            USER : Jean-Sébastien ( Administrator )
                            BOOT : Normal boot
                            Antivirus : ESET NOD32 Antivirus 3.0 3.0 (Activated)
                            A:\ (USB)
                            C:\ (Local Disk) - NTFS - Total:72 Go (Free:22 Go)
                            D:\ (Local Disk) - NTFS - Total:2 Go (Free:2 Go)
                            E:\ (CD or DVD)

                            "C:\Lop SD" ( MAJ : 01-11-2008|16:30 )
                            Option : [1] ( 2008-12-10|11:36 )

                            --------------------\\ Listing des dossiers dans APPLIC~1

                            [2008-10-05|11:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
                            [2008-04-14|20:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
                            [2008-04-15|20:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
                            [2008-04-15|20:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
                            [2008-08-02|16:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Avg8
                            [2008-10-15|17:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Blizzard
                            [2008-07-30|15:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Cast ping base frag
                            [2008-04-14|20:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ESET
                            [2008-09-03|15:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
                            [2008-12-09|18:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google Updater
                            [2008-05-28|21:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\HipSoft
                            [2008-12-03|18:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Logishrd
                            [2008-12-01|21:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Logitech
                            [2008-12-07|16:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
                            [2008-04-29|19:58] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
                            [2008-10-21|22:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
                            [2008-04-15|17:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Motive
                            [2008-04-15|17:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MotiveSysIDs
                            [2008-09-18|19:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\NCH Swift Sound
                            [2008-11-12|17:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\NVIDIA
                            [2008-12-01|01:02] C:\DOCUME~1\ALLUSE~1\APPLIC~1\PC Drivers HeadQuarters
                            [2008-07-29|16:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\PC Tools
                            [2008-05-18|10:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ROBLOX
                            [2008-12-10|11:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
                            [2008-04-14|17:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
                            [2008-04-17|22:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
                            [2008-12-02|00:01] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo!
                            [2008-12-01|23:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo! Companion

                            [2008-04-14|17:30] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

                            [2008-04-28|21:16] C:\DOCUME~1\JEAN-S~1\APPLIC~1\Adobe
                            [2008-10-05|21:12] C:\DOCUME~1\JEAN-S~1\APPLIC~1\Apple Computer
                            [2008-09-14|18:22] C:\DOCUME~1\JEAN-S~1\APPLIC~1\DivX
                            [2008-12-06|20:30] C:\DOCUME~1\JEAN-S~1\APPLIC~1\Google
                            [2008-04-14|17:36] C:\DOCUME~1\JEAN-S~1\APPLIC~1\Identities
                            [2008-07-31|15:32] C:\DOCUME~1\JEAN-S~1\APPLIC~1\Itchfork
                            [2008-05-10|14:46] C:\DOCUME~1\JEAN-S~1\APPLIC~1\iWin
                            [2008-06-02|16:13] C:\DOCUME~1\JEAN-S~1\APPLIC~1\Leadertech
                            [2008-12-09|17:38] C:\DOCUME~1\JEAN-S~1\APPLIC~1\LimeWire
                            [2008-04-28|21:16] C:\DOCUME~1\JEAN-S~1\APPLIC~1\Macromedia
                            [2008-12-07|16:11] C:\DOCUME~1\JEAN-S~1\APPLIC~1\Malwarebytes
                            [2008-10-21|23:14] C:\DOCUME~1\JEAN-S~1\APPLIC~1\Microsoft
                            [2008-04-25|16:19] C:\DOCUME~1\JEAN-S~1\APPLIC~1\Nero
                            [2008-04-17|10:24] C:\DOCUME~1\JEAN-S~1\APPLIC~1\PC Tools
                            [2008-05-18|10:57] C:\DOCUME~1\JEAN-S~1\APPLIC~1\ROBLOX
                            [2008-05-10|14:46] C:\DOCUME~1\JEAN-S~1\APPLIC~1\SpinTop
                            [2008-04-14|20:12] C:\DOCUME~1\JEAN-S~1\APPLIC~1\Sun
                            [2008-06-16|13:02] C:\DOCUME~1\JEAN-S~1\APPLIC~1\Ventrilo
                            [2008-10-15|18:54] C:\DOCUME~1\JEAN-S~1\APPLIC~1\Vso
                            [2008-11-18|18:12] C:\DOCUME~1\JEAN-S~1\APPLIC~1\Yahoo!

                            [2008-05-06|08:23] C:\DOCUME~1\LOCALS~1\APPLIC~1\Adobe
                            [2008-05-06|08:22] C:\DOCUME~1\LOCALS~1\APPLIC~1\Google
                            [2008-08-02|16:27] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

                            [2008-08-02|16:27] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

                            --------------------\\ Tâches planifiées dans C:\WINDOWS\tasks

                            [2008-08-29 14:10][--a------] C:\WINDOWS\tasks\AppleSoftwareUpdate.job
                            [2008-12-10 11:00][--ah-----] C:\WINDOWS\tasks\AE4D8704918A3724.job
                            [2008-12-10 10:51][--ah-----] C:\WINDOWS\tasks\SA.DAT
                            [2002-08-30 08:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini

                            ( AE4D8704918A3724.job )=( c:\docume~1\jean-s~1\applic~1\itchfork\Holeslowtitle.exe )

                            --------------------\\ Listing des dossiers dans C:\Program Files

                            [2008-10-26|10:55] C:\Program Files\3.0.2.8916 PTR Installer US-MX
                            [2008-08-24|18:57] C:\Program Files\Adobe
                            [2008-05-13|21:25] C:\Program Files\Alwil Software
                            [2008-08-04|18:04] C:\Program Files\Apple Software Update
                            [2008-12-29|22:15] C:\Program Files\AutoRun
                            [2008-04-14|19:42] C:\Program Files\AvRack
                            [2008-12-30|11:38] C:\Program Files\Bonjour
                            [2008-12-07|16:27] C:\Program Files\CCleaner
                            [2008-05-27|16:09] C:\Program Files\Circle Developement
                            [2008-10-19|17:04] C:\Program Files\Common Files
                            [2008-11-03|21:20] C:\Program Files\Conduit
                            [2008-12-01|00:57] C:\Program Files\directx
                            [2008-12-01|16:15] C:\Program Files\DirectX9
                            [2008-04-14|19:08] C:\Program Files\Dr.Hardware 2007 english
                            [2008-10-22|18:25] C:\Program Files\EA GAMES
                            [2008-12-30|11:36] C:\Program Files\EA SPORTS
                            [2008-12-10|10:56] C:\Program Files\Enigma Software Group
                            [2008-12-10|11:08] C:\Program Files\EsetOnlineScanner
                            [2008-12-01|21:01] C:\Program Files\Fichiers communs
                            [2008-04-29|06:30] C:\Program Files\Fun Web Products
                            [2008-08-23|21:18] C:\Program Files\GamesCampus
                            [2008-10-14|21:52] C:\Program Files\Google
                            [2008-12-01|21:05] C:\Program Files\InstallShield Installation Information
                            [2008-12-10|10:36] C:\Program Files\Internet Explorer
                            [2008-10-05|11:33] C:\Program Files\iPod
                            [2008-06-22|22:26] C:\Program Files\Itchfork
                            [2008-10-05|11:34] C:\Program Files\iTunes
                            [2008-11-09|13:40] C:\Program Files\Java
                            [2008-11-09|13:38] C:\Program Files\LimeWire
                            [2008-12-02|13:50] C:\Program Files\Logitech
                            [2008-12-07|16:11] C:\Program Files\Malwarebytes' Anti-Malware
                            [2008-06-18|23:37] C:\Program Files\Manual
                            [2008-11-12|17:04] C:\Program Files\Messenger
                            [2008-09-03|15:09] C:\Program Files\Messenger Plus! Live
                            [2008-08-13|11:27] C:\Program Files\M‚t‚oM‚dia
                            [2008-04-21|18:58] C:\Program Files\Micro Innovations
                            [2008-04-18|19:44] C:\Program Files\Microsoft CAPICOM 2.1.0.2
                            [2008-04-14|17:30] C:\Program Files\microsoft frontpage
                            [2008-10-06|19:11] C:\Program Files\Microsoft Office
                            [2008-10-21|21:37] C:\Program Files\Microsoft Silverlight
                            [2008-11-12|18:01] C:\Program Files\Movie Maker
                            [2008-10-06|19:10] C:\Program Files\MSECache
                            [2008-04-14|17:25] C:\Program Files\MSN
                            [2008-04-14|17:25] C:\Program Files\MSN Gaming Zone
                            [2008-11-11|23:44] C:\Program Files\MSXML 4.0
                            [2008-04-14|17:29] C:\Program Files\MSXML 6.0
                            [2008-11-12|16:35] C:\Program Files\NetMeeting
                            [2008-04-14|17:26] C:\Program Files\Online Services
                            [2008-11-12|18:01] C:\Program Files\Outlook Express
                            [2008-12-01|01:02] C:\Program Files\PC Drivers HeadQuarters
                            [2008-11-11|16:46] C:\Program Files\QuickTime
                            [2008-04-14|19:42] C:\Program Files\Realtek AC97
                            [2008-04-14|19:42] C:\Program Files\Realtek Sound Manager
                            [2008-08-03|05:17] C:\Program Files\ReflexiveArcade
                            [2008-05-18|10:55] C:\Program Files\ROBLOX Corporation
                            [2008-10-05|11:25] C:\Program Files\Safari
                            [2008-04-14|17:28] C:\Program Files\Services en ligne
                            [2008-12-10|10:37] C:\Program Files\Spyware Doctor
                            [2008-08-11|23:53] C:\Program Files\Sun
                            [2008-12-29|22:16] C:\Program Files\Support
                            [2008-11-03|21:21] C:\Program Files\TorrentMan
                            [2008-12-07|16:04] C:\Program Files\Trend Micro
                            [2008-12-29|22:16] C:\Program Files\TSBin
                            [2008-12-29|22:17] C:\Program Files\TSData
                            [2008-04-14|17:36] C:\Program Files\Uninstall Information
                            [2008-06-16|12:57] C:\Program Files\Ventrilo
                            [2008-10-15|18:56] C:\Program Files\vso
                            [2008-04-17|22:13] C:\Program Files\Windows Live
                            [2008-04-14|17:26] C:\Program Files\Windows Media Connect 2
                            [2008-11-12|16:35] C:\Program Files\Windows Media Player
                            [2008-11-12|16:35] C:\Program Files\Windows NT
                            [2008-04-14|17:28] C:\Program Files\WindowsUpdate
                            [2008-04-14|18:20] C:\Program Files\WinRAR
                            [2008-12-09|23:06] C:\Program Files\World of Warcraft
                            [2008-11-12|17:15] C:\Program Files\World of Warcraft Public Test
                            [2008-04-16|13:58] C:\Program Files\World of Warcraft Trial
                            [2008-04-16|14:30] C:\Program Files\WoW-2.0.0-enUS-Installer
                            [2008-04-14|17:30] C:\Program Files\xerox
                            [2008-12-01|23:55] C:\Program Files\Yahoo!

                            --------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs

                            [2008-04-14|20:35] C:\Program Files\Fichiers communs\Adobe
                            [2008-04-15|20:49] C:\Program Files\Fichiers communs\Apple
                            [2008-11-11|14:55] C:\Program Files\Fichiers communs\Blizzard Entertainment
                            [2008-04-14|20:44] C:\Program Files\Fichiers communs\DESIGNER
                            [2008-04-14|21:12] C:\Program Files\Fichiers communs\InstallShield
                            [2008-04-14|20:01] C:\Program Files\Fichiers communs\Java
                            [2008-12-01|21:35] C:\Program Files\Fichiers communs\logishrd
                            [2008-12-01|21:30] C:\Program Files\Fichiers communs\Logitech
                            [2008-10-21|22:33] C:\Program Files\Fichiers communs\Microsoft Shared
                            [2008-04-14|17:27] C:\Program Files\Fichiers communs\MSSoap
                            [2008-12-30|11:20] C:\Program Files\Fichiers communs\Nero
                            [2008-04-14|13:54] C:\Program Files\Fichiers communs\ODBC
                            [2008-07-29|16:18] C:\Program Files\Fichiers communs\PC Tools
                            [2008-04-14|17:27] C:\Program Files\Fichiers communs\Services
                            [2008-04-14|13:54] C:\Program Files\Fichiers communs\SpeechEngines
                            [2008-10-28|18:41] C:\Program Files\Fichiers communs\Symantec Shared
                            [2008-11-12|16:35] C:\Program Files\Fichiers communs\System
                            [2008-04-17|22:13] C:\Program Files\Fichiers communs\WindowsLiveInstaller
                            [2008-06-16|12:56] C:\Program Files\Fichiers communs\Wise Installation Wizard

                            --------------------\\ Process

                            ( 57 Processes )

                            IEXPLORE.EXE ~ [PID:5944]

                            --------------------\\ Recherche avec S_Lop

                            C:\DOCUME~1\JEAN-S~1\LOCALS~1\Temp\bis107.exe
                            C:\DOCUME~1\JEAN-S~1\LOCALS~1\Temp\bis17.exe
                            C:\DOCUME~1\JEAN-S~1\LOCALS~1\Temp\bisF.exe

                            --------------------\\ Recherche de Fichiers / Dossiers Lop

                            C:\DOCUME~1\ALLUSE~1\APPLIC~1\Cast ping base frag
                            C:\DOCUME~1\JEAN-S~1\APPLIC~1\itchfork
                            C:\DOCUME~1\JEAN-S~1\APPLIC~1\itchfork\FAST BEEP SIXTH FLAP.exe
                            C:\DOCUME~1\JEAN-S~1\APPLIC~1\itchfork\ikivmdtb.exe
                            C:\DOCUME~1\JEAN-S~1\APPLIC~1\itchfork\kbwohozq.exe
                            C:\DOCUME~1\JEAN-S~1\APPLIC~1\itchfork\kgnaobxx.exe
                            C:\DOCUME~1\JEAN-S~1\APPLIC~1\itchfork\lhvdpgbe.exe
                            C:\DOCUME~1\JEAN-S~1\APPLIC~1\itchfork\rnepovkx.exe
                            C:\DOCUME~1\JEAN-S~1\APPLIC~1\itchfork\spjlslvq.exe
                            C:\DOCUME~1\JEAN-S~1\APPLIC~1\itchfork\umurfxly.exe
                            C:\DOCUME~1\JEAN-S~1\APPLIC~1\itchfork\xeros.exe
                            C:\DOCUME~1\JEAN-S~1\APPLIC~1\itchfork\zkyqmdfa.exe
                            C:\Program Files\itchfork
                            C:\DOCUME~1\JEAN-S~1\LOCALS~1\Temp\nsisdt.dll
                            C:\Program Files\Circle Developement
                            C:\WINDOWS\Tasks\AE4D8704918A3724.job

                            --------------------\\ Verification du Registre

                            [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

                            [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

                            ..... OK !

                            --------------------\\ Verification du fichier Hosts

                            Fichier Hosts MODIFIE

                            127.0.0.1 bin.errorprotector.com ## added by CiD
                            127.0.0.1 br.errorsafe.com ## added by CiD
                            127.0.0.1 br.winantivirus.com ## added by CiD
                            127.0.0.1 br.winfixer.com ## added by CiD
                            127.0.0.1 cdn.drivecleaner.com ## added by CiD
                            127.0.0.1 cdn.errorsafe.com ## added by CiD
                            127.0.0.1 cdn.winsoftware.com ## added by CiD
                            127.0.0.1 de.errorsafe.com ## added by CiD
                            127.0.0.1 de.winantivirus.com ## added by CiD
                            127.0.0.1 download.cdn.drivecleaner.com ## added by CiD
                            127.0.0.1 download.cdn.errorsafe.com ## added by CiD
                            127.0.0.1 download.cdn.winsoftware.com ## added by CiD
                            127.0.0.1 download.errorsafe.com ## added by CiD
                            127.0.0.1 download.systemdoctor.com ## added by CiD
                            127.0.0.1 download.winantispyware.com ## added by CiD
                            127.0.0.1 download.windrivecleaner.com ## added by CiD
                            127.0.0.1 download.winfixer.com ## added by CiD
                            127.0.0.1 drivecleaner.com ## added by CiD
                            127.0.0.1 dynamique.drivecleaner.com ## added by CiD
                            127.0.0.1 errorprotector.com ## added by CiD
                            127.0.0.1 errorsafe.com ## added by CiD
                            127.0.0.1 es.winantivirus.com ## added by CiD
                            127.0.0.1 fr.winantivirus.com ## added by CiD
                            127.0.0.1 fr.winfixer.com ## added by CiD
                            127.0.0.1 go.drivecleaner.com ## added by CiD
                            127.0.0.1 go.errorsafe.com ## added by CiD
                            127.0.0.1 go.winantispyware.com ## added by CiD
                            127.0.0.1 go.winantivirus.com ## added by CiD
                            127.0.0.1 hk.winantivirus.com ## added by CiD
                            127.0.0.1 instlog.errorsafe.com ## added by CiD
                            127.0.0.1 instlog.winantivirus.com ## added by CiD
                            127.0.0.1 instlog.winfixer.com ## added by CiD
                            127.0.0.1 jsp.drivecleaner.com ## added by CiD
                            127.0.0.1 kb.errorsafe.com ## added by CiD
                            127.0.0.1 kb.winantivirus.com ## added by CiD
                            127.0.0.1 nl.errorsafe.com ## added by CiD
                            127.0.0.1 se.errorsafe.com ## added by CiD
                            127.0.0.1 secure.drivecleaner.com ## added by CiD
                            127.0.0.1 secure.errorsafe.com ## added by CiD
                            127.0.0.1 secure.winantispam.com ## added by CiD
                            127.0.0.1 secure.winantispy.com ## added by CiD
                            127.0.0.1 secure.winantivirus.com ## added by CiD
                            127.0.0.1 support.winantivirus.com ## added by CiD
                            127.0.0.1 trial.updates.winsoftware.com ## added by CiD
                            127.0.0.1 ulog.winantivirus.com ## added by CiD
                            127.0.0.1 utils.errorsafe.com ## added by CiD
                            127.0.0.1 utils.winantivirus.com ## added by CiD
                            127.0.0.1 utils.winfixer.com ## added by CiD
                            127.0.0.1 winantispyware.com ## added by CiD
                            127.0.0.1 winantivirus.com ## added by CiD
                            127.0.0.1 winfixer.com ## added by CiD
                            127.0.0.1 winfixer2006.com ## added by CiD
                            127.0.0.1 winsoftware.com ## added by CiD
                            127.0.0.1 [i]ww/iw.drivecleaner.com ## added by CiD
                            127.0.0.1 [i]ww/iw.errorprotector.com ## added by CiD
                            127.0.0.1 [i]ww/iw.errorsafe.com ## added by CiD
                            127.0.0.1 [i]ww/iw.systemdoctor.com ## added by CiD
                            127.0.0.1 [i]ww/iw.utils.winfixer.com ## added by CiD
                            127.0.0.1 [i]ww/iw.win-anti-virus-pro.com ## added by CiD
                            127.0.0.1 [i]ww/iw.win-virus-pro.com ## added by CiD
                            127.0.0.1 [i]ww/iw.winantispam.com ## added by CiD
                            127.0.0.1 [i]ww/iw.winantispy.com ## added by CiD
                            127.0.0.1 [i]ww/iw.winantispyware.com ## added by CiD
                            127.0.0.1 [i]ww/iw.winantivirus.com ## added by CiD
                            127.0.0.1 [i]ww/iw.winantiviruspro.com ## added by CiD
                            127.0.0.1 [i]ww/iw.windrivecleaner.com ## added by CiD
                            127.0.0.1 [i]ww/iw.windrivesafe.com ## added by CiD
                            127.0.0.1 [i]ww/iw.winfixer.com ## added by CiD
                            127.0.0.1 [i]ww/iw.winfixer2006.com ## added by CiD
                            127.0.0.1 [i]ww/iw.winsoftware.com ## added by CiD

                            -> 72 [ 70 ## added by CiD ]

                            --------------------\\ Recherche de fichiers avec Catchme

                            catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                            Rootkit scan 2008-12-10 11:38:58
                            Windows 5.1.2600 Service Pack 3 NTFS
                            detected NTDLL code modification:
                            ZwClose
                            scanning hidden processes ...
                            scanning hidden files ...
                            scan completed successfully
                            hidden processes: 0
                            hidden files: 21

                            --------------------\\ Recherche d'autres infections

                            --------------------\\ Cracks & Keygens ..

                            C:\DOCUME~1\JEAN-S~1\Mes documents\LimeWire\Saved\eek-a-mouse - Crack Cocaine and Marijuana.mp3
                            C:\DOCUME~1\JEAN-S~1\Mes documents\LimeWire\Saved\Silverfall Earth Awakening Crack FIXED + Serial to Play Online PC
                            C:\DOCUME~1\JEAN-S~1\Mes documents\LimeWire\Saved\Silverfall Earth Awakening Crack FIXED + Serial to Play Online PC\Password instructions.html
                            C:\DOCUME~1\JEAN-S~1\Mes documents\LimeWire\Saved\Silverfall Earth Awakening Crack FIXED + Serial to Play Online PC\Password instructions.txt
                            C:\DOCUME~1\JEAN-S~1\Mes documents\LimeWire\Saved\Silverfall Earth Awakening Crack FIXED + Serial to Play Online PC\sfallEAfixed
                            C:\DOCUME~1\JEAN-S~1\Mes documents\LimeWire\Saved\Silverfall Earth Awakening Crack FIXED + Serial to Play Online PC\sfallEAfixed.rar

                            [F:2699][D:153]-> C:\DOCUME~1\JEAN-S~1\LOCALS~1\Temp
                            [F:83][D:0]-> C:\DOCUME~1\JEAN-S~1\Cookies
                            [F:454][D:9]-> C:\DOCUME~1\JEAN-S~1\LOCALS~1\TEMPOR~1\content.IE5

                            1 - "C:\Lop SD\LopR_1.txt" - 2008-12-10|11:41 - Option : [1]

                            --------------------\\ Fin du rapport a 11:41:17
                            1. jstlovesnow Auteur
                              --------------------\\ Lop S&D 4.2.4-9c XP/Vista

                              Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
                              X86-based PC ( Uniprocessor Free : AMD Athlon(tm) 64 Processor 3000+ )
                              BIOS : Default System BIOS
                              USER : Jean-Sébastien ( Administrator )
                              BOOT : Normal boot
                              Antivirus : ESET NOD32 Antivirus 3.0 3.0 (Activated)
                              A:\ (USB)
                              C:\ (Local Disk) - NTFS - Total:72 Go (Free:22 Go)
                              D:\ (Local Disk) - NTFS - Total:2 Go (Free:2 Go)
                              E:\ (CD or DVD)

                              "C:\Lop SD" ( MAJ : 01-11-2008|16:30 )
                              Option : [1] ( 2008-12-10|11:36 )

                              --------------------\\ Listing des dossiers dans APPLIC~1

                              [2008-10-05|11:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
                              [2008-04-14|20:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
                              [2008-04-15|20:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
                              [2008-04-15|20:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
                              [2008-08-02|16:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Avg8
                              [2008-10-15|17:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Blizzard
                              [2008-07-30|15:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Cast ping base frag
                              [2008-04-14|20:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ESET
                              [2008-09-03|15:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
                              [2008-12-09|18:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google Updater
                              [2008-05-28|21:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\HipSoft
                              [2008-12-03|18:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Logishrd
                              [2008-12-01|21:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Logitech
                              [2008-12-07|16:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
                              [2008-04-29|19:58] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
                              [2008-10-21|22:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
                              [2008-04-15|17:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Motive
                              [2008-04-15|17:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MotiveSysIDs
                              [2008-09-18|19:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\NCH Swift Sound
                              [2008-11-12|17:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\NVIDIA
                              [2008-12-01|01:02] C:\DOCUME~1\ALLUSE~1\APPLIC~1\PC Drivers HeadQuarters
                              [2008-07-29|16:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\PC Tools
                              [2008-05-18|10:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ROBLOX
                              [2008-12-10|11:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
                              [2008-04-14|17:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
                              [2008-04-17|22:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
                              [2008-12-02|00:01] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo!
                              [2008-12-01|23:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo! Companion

                              [2008-04-14|17:30] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

                              [2008-04-28|21:16] C:\DOCUME~1\JEAN-S~1\APPLIC~1\Adobe
                              [2008-10-05|21:12] C:\DOCUME~1\JEAN-S~1\APPLIC~1\Apple Computer
                              [2008-09-14|18:22] C:\DOCUME~1\JEAN-S~1\APPLIC~1\DivX
                              [2008-12-06|20:30] C:\DOCUME~1\JEAN-S~1\APPLIC~1\Google
                              [2008-04-14|17:36] C:\DOCUME~1\JEAN-S~1\APPLIC~1\Identities
                              [2008-07-31|15:32] C:\DOCUME~1\JEAN-S~1\APPLIC~1\Itchfork
                              [2008-05-10|14:46] C:\DOCUME~1\JEAN-S~1\APPLIC~1\iWin
                              [2008-06-02|16:13] C:\DOCUME~1\JEAN-S~1\APPLIC~1\Leadertech
                              [2008-12-09|17:38] C:\DOCUME~1\JEAN-S~1\APPLIC~1\LimeWire
                              [2008-04-28|21:16] C:\DOCUME~1\JEAN-S~1\APPLIC~1\Macromedia
                              [2008-12-07|16:11] C:\DOCUME~1\JEAN-S~1\APPLIC~1\Malwarebytes
                              [2008-10-21|23:14] C:\DOCUME~1\JEAN-S~1\APPLIC~1\Microsoft
                              [2008-04-25|16:19] C:\DOCUME~1\JEAN-S~1\APPLIC~1\Nero
                              [2008-04-17|10:24] C:\DOCUME~1\JEAN-S~1\APPLIC~1\PC Tools
                              [2008-05-18|10:57] C:\DOCUME~1\JEAN-S~1\APPLIC~1\ROBLOX
                              [2008-05-10|14:46] C:\DOCUME~1\JEAN-S~1\APPLIC~1\SpinTop
                              [2008-04-14|20:12] C:\DOCUME~1\JEAN-S~1\APPLIC~1\Sun
                              [2008-06-16|13:02] C:\DOCUME~1\JEAN-S~1\APPLIC~1\Ventrilo
                              [2008-10-15|18:54] C:\DOCUME~1\JEAN-S~1\APPLIC~1\Vso
                              [2008-11-18|18:12] C:\DOCUME~1\JEAN-S~1\APPLIC~1\Yahoo!

                              [2008-05-06|08:23] C:\DOCUME~1\LOCALS~1\APPLIC~1\Adobe
                              [2008-05-06|08:22] C:\DOCUME~1\LOCALS~1\APPLIC~1\Google
                              [2008-08-02|16:27] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

                              [2008-08-02|16:27] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

                              --------------------\\ Tâches planifiées dans C:\WINDOWS\tasks

                              [2008-08-29 14:10][--a------] C:\WINDOWS\tasks\AppleSoftwareUpdate.job
                              [2008-12-10 11:00][--ah-----] C:\WINDOWS\tasks\AE4D8704918A3724.job
                              [2008-12-10 10:51][--ah-----] C:\WINDOWS\tasks\SA.DAT
                              [2002-08-30 08:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini

                              ( AE4D8704918A3724.job )=( c:\docume~1\jean-s~1\applic~1\itchfork\Holeslowtitle.exe )

                              --------------------\\ Listing des dossiers dans C:\Program Files

                              [2008-10-26|10:55] C:\Program Files\3.0.2.8916 PTR Installer US-MX
                              [2008-08-24|18:57] C:\Program Files\Adobe
                              [2008-05-13|21:25] C:\Program Files\Alwil Software
                              [2008-08-04|18:04] C:\Program Files\Apple Software Update
                              [2008-12-29|22:15] C:\Program Files\AutoRun
                              [2008-04-14|19:42] C:\Program Files\AvRack
                              [2008-12-30|11:38] C:\Program Files\Bonjour
                              [2008-12-07|16:27] C:\Program Files\CCleaner
                              [2008-05-27|16:09] C:\Program Files\Circle Developement
                              [2008-10-19|17:04] C:\Program Files\Common Files
                              [2008-11-03|21:20] C:\Program Files\Conduit
                              [2008-12-01|00:57] C:\Program Files\directx
                              [2008-12-01|16:15] C:\Program Files\DirectX9
                              [2008-04-14|19:08] C:\Program Files\Dr.Hardware 2007 english
                              [2008-10-22|18:25] C:\Program Files\EA GAMES
                              [2008-12-30|11:36] C:\Program Files\EA SPORTS
                              [2008-12-10|10:56] C:\Program Files\Enigma Software Group
                              [2008-12-10|11:08] C:\Program Files\EsetOnlineScanner
                              [2008-12-01|21:01] C:\Program Files\Fichiers communs
                              [2008-04-29|06:30] C:\Program Files\Fun Web Products
                              [2008-08-23|21:18] C:\Program Files\GamesCampus
                              [2008-10-14|21:52] C:\Program Files\Google
                              [2008-12-01|21:05] C:\Program Files\InstallShield Installation Information
                              [2008-12-10|10:36] C:\Program Files\Internet Explorer
                              [2008-10-05|11:33] C:\Program Files\iPod
                              [2008-06-22|22:26] C:\Program Files\Itchfork
                              [2008-10-05|11:34] C:\Program Files\iTunes
                              [2008-11-09|13:40] C:\Program Files\Java
                              [2008-11-09|13:38] C:\Program Files\LimeWire
                              [2008-12-02|13:50] C:\Program Files\Logitech
                              [2008-12-07|16:11] C:\Program Files\Malwarebytes' Anti-Malware
                              [2008-06-18|23:37] C:\Program Files\Manual
                              [2008-11-12|17:04] C:\Program Files\Messenger
                              [2008-09-03|15:09] C:\Program Files\Messenger Plus! Live
                              [2008-08-13|11:27] C:\Program Files\M‚t‚oM‚dia
                              [2008-04-21|18:58] C:\Program Files\Micro Innovations
                              [2008-04-18|19:44] C:\Program Files\Microsoft CAPICOM 2.1.0.2
                              [2008-04-14|17:30] C:\Program Files\microsoft frontpage
                              [2008-10-06|19:11] C:\Program Files\Microsoft Office
                              [2008-10-21|21:37] C:\Program Files\Microsoft Silverlight
                              [2008-11-12|18:01] C:\Program Files\Movie Maker
                              [2008-10-06|19:10] C:\Program Files\MSECache
                              [2008-04-14|17:25] C:\Program Files\MSN
                              [2008-04-14|17:25] C:\Program Files\MSN Gaming Zone
                              [2008-11-11|23:44] C:\Program Files\MSXML 4.0
                              [2008-04-14|17:29] C:\Program Files\MSXML 6.0
                              [2008-11-12|16:35] C:\Program Files\NetMeeting
                              [2008-04-14|17:26] C:\Program Files\Online Services
                              [2008-11-12|18:01] C:\Program Files\Outlook Express
                              [2008-12-01|01:02] C:\Program Files\PC Drivers HeadQuarters
                              [2008-11-11|16:46] C:\Program Files\QuickTime
                              [2008-04-14|19:42] C:\Program Files\Realtek AC97
                              [2008-04-14|19:42] C:\Program Files\Realtek Sound Manager
                              [2008-08-03|05:17] C:\Program Files\ReflexiveArcade
                              [2008-05-18|10:55] C:\Program Files\ROBLOX Corporation
                              [2008-10-05|11:25] C:\Program Files\Safari
                              [2008-04-14|17:28] C:\Program Files\Services en ligne
                              [2008-12-10|10:37] C:\Program Files\Spyware Doctor
                              [2008-08-11|23:53] C:\Program Files\Sun
                              [2008-12-29|22:16] C:\Program Files\Support
                              [2008-11-03|21:21] C:\Program Files\TorrentMan
                              [2008-12-07|16:04] C:\Program Files\Trend Micro
                              [2008-12-29|22:16] C:\Program Files\TSBin
                              [2008-12-29|22:17] C:\Program Files\TSData
                              [2008-04-14|17:36] C:\Program Files\Uninstall Information
                              [2008-06-16|12:57] C:\Program Files\Ventrilo
                              [2008-10-15|18:56] C:\Program Files\vso
                              [2008-04-17|22:13] C:\Program Files\Windows Live
                              [2008-04-14|17:26] C:\Program Files\Windows Media Connect 2
                              [2008-11-12|16:35] C:\Program Files\Windows Media Player
                              [2008-11-12|16:35] C:\Program Files\Windows NT
                              [2008-04-14|17:28] C:\Program Files\WindowsUpdate
                              [2008-04-14|18:20] C:\Program Files\WinRAR
                              [2008-12-09|23:06] C:\Program Files\World of Warcraft
                              [2008-11-12|17:15] C:\Program Files\World of Warcraft Public Test
                              [2008-04-16|13:58] C:\Program Files\World of Warcraft Trial
                              [2008-04-16|14:30] C:\Program Files\WoW-2.0.0-enUS-Installer
                              [2008-04-14|17:30] C:\Program Files\xerox
                              [2008-12-01|23:55] C:\Program Files\Yahoo!

                              --------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs

                              [2008-04-14|20:35] C:\Program Files\Fichiers communs\Adobe
                              [2008-04-15|20:49] C:\Program Files\Fichiers communs\Apple
                              [2008-11-11|14:55] C:\Program Files\Fichiers communs\Blizzard Entertainment
                              [2008-04-14|20:44] C:\Program Files\Fichiers communs\DESIGNER
                              [2008-04-14|21:12] C:\Program Files\Fichiers communs\InstallShield
                              [2008-04-14|20:01] C:\Program Files\Fichiers communs\Java
                              [2008-12-01|21:35] C:\Program Files\Fichiers communs\logishrd
                              [2008-12-01|21:30] C:\Program Files\Fichiers communs\Logitech
                              [2008-10-21|22:33] C:\Program Files\Fichiers communs\Microsoft Shared
                              [2008-04-14|17:27] C:\Program Files\Fichiers communs\MSSoap
                              [2008-12-30|11:20] C:\Program Files\Fichiers communs\Nero
                              [2008-04-14|13:54] C:\Program Files\Fichiers communs\ODBC
                              [2008-07-29|16:18] C:\Program Files\Fichiers communs\PC Tools
                              [2008-04-14|17:27] C:\Program Files\Fichiers communs\Services
                              [2008-04-14|13:54] C:\Program Files\Fichiers communs\SpeechEngines
                              [2008-10-28|18:41] C:\Program Files\Fichiers communs\Symantec Shared
                              [2008-11-12|16:35] C:\Program Files\Fichiers communs\System
                              [2008-04-17|22:13] C:\Program Files\Fichiers communs\WindowsLiveInstaller
                              [2008-06-16|12:56] C:\Program Files\Fichiers communs\Wise Installation Wizard

                              --------------------\\ Process

                              ( 57 Processes )

                              IEXPLORE.EXE ~ [PID:5944]

                              --------------------\\ Recherche avec S_Lop

                              C:\DOCUME~1\JEAN-S~1\LOCALS~1\Temp\bis107.exe
                              C:\DOCUME~1\JEAN-S~1\LOCALS~1\Temp\bis17.exe
                              C:\DOCUME~1\JEAN-S~1\LOCALS~1\Temp\bisF.exe

                              --------------------\\ Recherche de Fichiers / Dossiers Lop

                              C:\DOCUME~1\ALLUSE~1\APPLIC~1\Cast ping base frag
                              C:\DOCUME~1\JEAN-S~1\APPLIC~1\itchfork
                              C:\DOCUME~1\JEAN-S~1\APPLIC~1\itchfork\FAST BEEP SIXTH FLAP.exe
                              C:\DOCUME~1\JEAN-S~1\APPLIC~1\itchfork\ikivmdtb.exe
                              C:\DOCUME~1\JEAN-S~1\APPLIC~1\itchfork\kbwohozq.exe
                              C:\DOCUME~1\JEAN-S~1\APPLIC~1\itchfork\kgnaobxx.exe
                              C:\DOCUME~1\JEAN-S~1\APPLIC~1\itchfork\lhvdpgbe.exe
                              C:\DOCUME~1\JEAN-S~1\APPLIC~1\itchfork\rnepovkx.exe
                              C:\DOCUME~1\JEAN-S~1\APPLIC~1\itchfork\spjlslvq.exe
                              C:\DOCUME~1\JEAN-S~1\APPLIC~1\itchfork\umurfxly.exe
                              C:\DOCUME~1\JEAN-S~1\APPLIC~1\itchfork\xeros.exe
                              C:\DOCUME~1\JEAN-S~1\APPLIC~1\itchfork\zkyqmdfa.exe
                              C:\Program Files\itchfork
                              C:\DOCUME~1\JEAN-S~1\LOCALS~1\Temp\nsisdt.dll
                              C:\Program Files\Circle Developement
                              C:\WINDOWS\Tasks\AE4D8704918A3724.job

                              --------------------\\ Verification du Registre

                              [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

                              [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

                              ..... OK !

                              --------------------\\ Verification du fichier Hosts

                              Fichier Hosts MODIFIE

                              127.0.0.1 bin.errorprotector.com ## added by CiD
                              127.0.0.1 br.errorsafe.com ## added by CiD
                              127.0.0.1 br.winantivirus.com ## added by CiD
                              127.0.0.1 br.winfixer.com ## added by CiD
                              127.0.0.1 cdn.drivecleaner.com ## added by CiD
                              127.0.0.1 cdn.errorsafe.com ## added by CiD
                              127.0.0.1 cdn.winsoftware.com ## added by CiD
                              127.0.0.1 de.errorsafe.com ## added by CiD
                              127.0.0.1 de.winantivirus.com ## added by CiD
                              127.0.0.1 download.cdn.drivecleaner.com ## added by CiD
                              127.0.0.1 download.cdn.errorsafe.com ## added by CiD
                              127.0.0.1 download.cdn.winsoftware.com ## added by CiD
                              127.0.0.1 download.errorsafe.com ## added by CiD
                              127.0.0.1 download.systemdoctor.com ## added by CiD
                              127.0.0.1 download.winantispyware.com ## added by CiD
                              127.0.0.1 download.windrivecleaner.com ## added by CiD
                              127.0.0.1 download.winfixer.com ## added by CiD
                              127.0.0.1 drivecleaner.com ## added by CiD
                              127.0.0.1 dynamique.drivecleaner.com ## added by CiD
                              127.0.0.1 errorprotector.com ## added by CiD
                              127.0.0.1 errorsafe.com ## added by CiD
                              127.0.0.1 es.winantivirus.com ## added by CiD
                              127.0.0.1 fr.winantivirus.com ## added by CiD
                              127.0.0.1 fr.winfixer.com ## added by CiD
                              127.0.0.1 go.drivecleaner.com ## added by CiD
                              127.0.0.1 go.errorsafe.com ## added by CiD
                              127.0.0.1 go.winantispyware.com ## added by CiD
                              127.0.0.1 go.winantivirus.com ## added by CiD
                              127.0.0.1 hk.winantivirus.com ## added by CiD
                              127.0.0.1 instlog.errorsafe.com ## added by CiD
                              127.0.0.1 instlog.winantivirus.com ## added by CiD
                              127.0.0.1 instlog.winfixer.com ## added by CiD
                              127.0.0.1 jsp.drivecleaner.com ## added by CiD
                              127.0.0.1 kb.errorsafe.com ## added by CiD
                              127.0.0.1 kb.winantivirus.com ## added by CiD
                              127.0.0.1 nl.errorsafe.com ## added by CiD
                              127.0.0.1 se.errorsafe.com ## added by CiD
                              127.0.0.1 secure.drivecleaner.com ## added by CiD
                              127.0.0.1 secure.errorsafe.com ## added by CiD
                              127.0.0.1 secure.winantispam.com ## added by CiD
                              127.0.0.1 secure.winantispy.com ## added by CiD
                              127.0.0.1 secure.winantivirus.com ## added by CiD
                              127.0.0.1 support.winantivirus.com ## added by CiD
                              127.0.0.1 trial.updates.winsoftware.com ## added by CiD
                              127.0.0.1 ulog.winantivirus.com ## added by CiD
                              127.0.0.1 utils.errorsafe.com ## added by CiD
                              127.0.0.1 utils.winantivirus.com ## added by CiD
                              127.0.0.1 utils.winfixer.com ## added by CiD
                              127.0.0.1 winantispyware.com ## added by CiD
                              127.0.0.1 winantivirus.com ## added by CiD
                              127.0.0.1 winfixer.com ## added by CiD
                              127.0.0.1 winfixer2006.com ## added by CiD
                              127.0.0.1 winsoftware.com ## added by CiD
                              127.0.0.1 [i]ww/iw.drivecleaner.com ## added by CiD
                              127.0.0.1 [i]ww/iw.errorprotector.com ## added by CiD
                              127.0.0.1 [i]ww/iw.errorsafe.com ## added by CiD
                              127.0.0.1 [i]ww/iw.systemdoctor.com ## added by CiD
                              127.0.0.1 [i]ww/iw.utils.winfixer.com ## added by CiD
                              127.0.0.1 [i]ww/iw.win-anti-virus-pro.com ## added by CiD
                              127.0.0.1 [i]ww/iw.win-virus-pro.com ## added by CiD
                              127.0.0.1 [i]ww/iw.winantispam.com ## added by CiD
                              127.0.0.1 [i]ww/iw.winantispy.com ## added by CiD
                              127.0.0.1 [i]ww/iw.winantispyware.com ## added by CiD
                              127.0.0.1 [i]ww/iw.winantivirus.com ## added by CiD
                              127.0.0.1 [i]ww/iw.winantiviruspro.com ## added by CiD
                              127.0.0.1 [i]ww/iw.windrivecleaner.com ## added by CiD
                              127.0.0.1 [i]ww/iw.windrivesafe.com ## added by CiD
                              127.0.0.1 [i]ww/iw.winfixer.com ## added by CiD
                              127.0.0.1 [i]ww/iw.winfixer2006.com ## added by CiD
                              127.0.0.1 [i]ww/iw.winsoftware.com ## added by CiD

                              -> 72 [ 70 ## added by CiD ]

                              --------------------\\ Recherche de fichiers avec Catchme

                              catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                              Rootkit scan 2008-12-10 11:38:58
                              Windows 5.1.2600 Service Pack 3 NTFS
                              detected NTDLL code modification:
                              ZwClose
                              scanning hidden processes ...
                              scanning hidden files ...
                              scan completed successfully
                              hidden processes: 0
                              hidden files: 21

                              --------------------\\ Recherche d'autres infections

                              --------------------\\ Cracks & Keygens ..

                              C:\DOCUME~1\JEAN-S~1\Mes documents\LimeWire\Saved\eek-a-mouse - Crack Cocaine and Marijuana.mp3
                              C:\DOCUME~1\JEAN-S~1\Mes documents\LimeWire\Saved\Silverfall Earth Awakening Crack FIXED + Serial to Play Online PC
                              C:\DOCUME~1\JEAN-S~1\Mes documents\LimeWire\Saved\Silverfall Earth Awakening Crack FIXED + Serial to Play Online PC\Password instructions.html
                              C:\DOCUME~1\JEAN-S~1\Mes documents\LimeWire\Saved\Silverfall Earth Awakening Crack FIXED + Serial to Play Online PC\Password instructions.txt
                              C:\DOCUME~1\JEAN-S~1\Mes documents\LimeWire\Saved\Silverfall Earth Awakening Crack FIXED + Serial to Play Online PC\sfallEAfixed
                              C:\DOCUME~1\JEAN-S~1\Mes documents\LimeWire\Saved\Silverfall Earth Awakening Crack FIXED + Serial to Play Online PC\sfallEAfixed.rar

                              [F:2699][D:153]-> C:\DOCUME~1\JEAN-S~1\LOCALS~1\Temp
                              [F:83][D:0]-> C:\DOCUME~1\JEAN-S~1\Cookies
                              [F:454][D:9]-> C:\DOCUME~1\JEAN-S~1\LOCALS~1\TEMPOR~1\content.IE5

                              1 - "C:\Lop SD\LopR_1.txt" - 2008-12-10|11:41 - Option : [1]

                              --------------------\\ Fin du rapport a 11:41:17
                              1. jstlovesnow Auteur
                                --------------------\\ Lop S&D 4.2.4-9c XP/Vista

                                Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
                                X86-based PC ( Uniprocessor Free : AMD Athlon(tm) 64 Processor 3000+ )
                                BIOS : Default System BIOS
                                USER : Jean-Sébastien ( Administrator )
                                BOOT : Normal boot
                                Antivirus : ESET NOD32 Antivirus 3.0 3.0 (Activated)
                                A:\ (USB)
                                C:\ (Local Disk) - NTFS - Total:72 Go (Free:22 Go)
                                D:\ (Local Disk) - NTFS - Total:2 Go (Free:2 Go)
                                E:\ (CD or DVD)

                                "C:\Lop SD" ( MAJ : 01-11-2008|16:30 )
                                Option : [2] ( 2008-12-10|11:45 )

                                \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ SUPPRESSION

                                Supprime! - C:\DOCUME~1\JEAN-S~1\APPLIC~1\itchfork\FAST BEEP SIXTH FLAP.exe
                                Supprime! - C:\DOCUME~1\JEAN-S~1\APPLIC~1\itchfork\ikivmdtb.exe
                                Supprime! - C:\DOCUME~1\JEAN-S~1\APPLIC~1\itchfork\kbwohozq.exe
                                Supprime! - C:\DOCUME~1\JEAN-S~1\APPLIC~1\itchfork\kgnaobxx.exe
                                Supprime! - C:\DOCUME~1\JEAN-S~1\APPLIC~1\itchfork\lhvdpgbe.exe
                                Supprime! - C:\DOCUME~1\JEAN-S~1\APPLIC~1\itchfork\rnepovkx.exe
                                Supprime! - C:\DOCUME~1\JEAN-S~1\APPLIC~1\itchfork\spjlslvq.exe
                                Supprime! - C:\DOCUME~1\JEAN-S~1\APPLIC~1\itchfork\umurfxly.exe
                                Supprime! - C:\DOCUME~1\JEAN-S~1\APPLIC~1\itchfork\xeros.exe
                                Supprime! - C:\DOCUME~1\JEAN-S~1\APPLIC~1\itchfork\zkyqmdfa.exe
                                Supprime! - C:\DOCUME~1\JEAN-S~1\LOCALS~1\Temp\nsisdt.dll
                                Supprime! - C:\WINDOWS\Tasks\AE4D8704918A3724.job
                                Supprime! - C:\DOCUME~1\JEAN-S~1\LOCALS~1\Temp\bis107.exe
                                Supprime! - C:\DOCUME~1\JEAN-S~1\LOCALS~1\Temp\bis17.exe
                                Supprime! - C:\DOCUME~1\JEAN-S~1\LOCALS~1\Temp\bisF.exe
                                Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\Cast ping base frag
                                Supprime! - C:\DOCUME~1\JEAN-S~1\APPLIC~1\itchfork
                                Supprime! - C:\Program Files\itchfork
                                Supprime! - C:\Program Files\Circle Developement
                                -
                                [ Fichier Hosts ] .. Restaure!

                                \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

                                --------------------\\ Listing des dossiers dans APPLIC~1

                                [2008-10-05|11:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
                                [2008-04-14|20:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
                                [2008-04-15|20:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
                                [2008-04-15|20:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
                                [2008-08-02|16:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Avg8
                                [2008-10-15|17:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Blizzard
                                [2008-04-14|20:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ESET
                                [2008-09-03|15:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
                                [2008-12-09|18:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google Updater
                                [2008-05-28|21:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\HipSoft
                                [2008-12-03|18:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Logishrd
                                [2008-12-01|21:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Logitech
                                [2008-12-07|16:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
                                [2008-04-29|19:58] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
                                [2008-10-21|22:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
                                [2008-04-15|17:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Motive
                                [2008-04-15|17:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MotiveSysIDs
                                [2008-09-18|19:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\NCH Swift Sound
                                [2008-11-12|17:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\NVIDIA
                                [2008-12-01|01:02] C:\DOCUME~1\ALLUSE~1\APPLIC~1\PC Drivers HeadQuarters
                                [2008-07-29|16:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\PC Tools
                                [2008-05-18|10:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ROBLOX
                                [2008-12-10|11:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
                                [2008-04-14|17:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
                                [2008-04-17|22:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
                                [2008-12-02|00:01] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo!
                                [2008-12-01|23:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo! Companion

                                [2008-04-14|17:30] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

                                [2008-04-28|21:16] C:\DOCUME~1\JEAN-S~1\APPLIC~1\Adobe
                                [2008-10-05|21:12] C:\DOCUME~1\JEAN-S~1\APPLIC~1\Apple Computer
                                [2008-09-14|18:22] C:\DOCUME~1\JEAN-S~1\APPLIC~1\DivX
                                [2008-12-06|20:30] C:\DOCUME~1\JEAN-S~1\APPLIC~1\Google
                                [2008-04-14|17:36] C:\DOCUME~1\JEAN-S~1\APPLIC~1\Identities
                                [2008-05-10|14:46] C:\DOCUME~1\JEAN-S~1\APPLIC~1\iWin
                                [2008-06-02|16:13] C:\DOCUME~1\JEAN-S~1\APPLIC~1\Leadertech
                                [2008-12-09|17:38] C:\DOCUME~1\JEAN-S~1\APPLIC~1\LimeWire
                                [2008-04-28|21:16] C:\DOCUME~1\JEAN-S~1\APPLIC~1\Macromedia
                                [2008-12-07|16:11] C:\DOCUME~1\JEAN-S~1\APPLIC~1\Malwarebytes
                                [2008-10-21|23:14] C:\DOCUME~1\JEAN-S~1\APPLIC~1\Microsoft
                                [2008-04-25|16:19] C:\DOCUME~1\JEAN-S~1\APPLIC~1\Nero
                                [2008-04-17|10:24] C:\DOCUME~1\JEAN-S~1\APPLIC~1\PC Tools
                                [2008-05-18|10:57] C:\DOCUME~1\JEAN-S~1\APPLIC~1\ROBLOX
                                [2008-05-10|14:46] C:\DOCUME~1\JEAN-S~1\APPLIC~1\SpinTop
                                [2008-04-14|20:12] C:\DOCUME~1\JEAN-S~1\APPLIC~1\Sun
                                [2008-06-16|13:02] C:\DOCUME~1\JEAN-S~1\APPLIC~1\Ventrilo
                                [2008-10-15|18:54] C:\DOCUME~1\JEAN-S~1\APPLIC~1\Vso
                                [2008-11-18|18:12] C:\DOCUME~1\JEAN-S~1\APPLIC~1\Yahoo!

                                [2008-05-06|08:23] C:\DOCUME~1\LOCALS~1\APPLIC~1\Adobe
                                [2008-05-06|08:22] C:\DOCUME~1\LOCALS~1\APPLIC~1\Google
                                [2008-08-02|16:27] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

                                [2008-08-02|16:27] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

                                --------------------\\ Tâches planifiées dans C:\WINDOWS\tasks

                                [2008-08-29 14:10][--a------] C:\WINDOWS\tasks\AppleSoftwareUpdate.job
                                [2008-12-10 10:51][--ah-----] C:\WINDOWS\tasks\SA.DAT
                                [2002-08-30 08:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini

                                --------------------\\ Listing des dossiers dans C:\Program Files

                                [2008-10-26|10:55] C:\Program Files\3.0.2.8916 PTR Installer US-MX
                                [2008-08-24|18:57] C:\Program Files\Adobe
                                [2008-05-13|21:25] C:\Program Files\Alwil Software
                                [2008-08-04|18:04] C:\Program Files\Apple Software Update
                                [2008-12-29|22:15] C:\Program Files\AutoRun
                                [2008-04-14|19:42] C:\Program Files\AvRack
                                [2008-12-30|11:38] C:\Program Files\Bonjour
                                [2008-12-07|16:27] C:\Program Files\CCleaner
                                [2008-10-19|17:04] C:\Program Files\Common Files
                                [2008-11-03|21:20] C:\Program Files\Conduit
                                [2008-12-01|00:57] C:\Program Files\directx
                                [2008-12-01|16:15] C:\Program Files\DirectX9
                                [2008-04-14|19:08] C:\Program Files\Dr.Hardware 2007 english
                                [2008-10-22|18:25] C:\Program Files\EA GAMES
                                [2008-12-30|11:36] C:\Program Files\EA SPORTS
                                [2008-12-10|10:56] C:\Program Files\Enigma Software Group
                                [2008-12-10|11:08] C:\Program Files\EsetOnlineScanner
                                [2008-12-01|21:01] C:\Program Files\Fichiers communs
                                [2008-04-29|06:30] C:\Program Files\Fun Web Products
                                [2008-08-23|21:18] C:\Program Files\GamesCampus
                                [2008-10-14|21:52] C:\Program Files\Google
                                [2008-12-01|21:05] C:\Program Files\InstallShield Installation Information
                                [2008-12-10|10:36] C:\Program Files\Internet Explorer
                                [2008-10-05|11:33] C:\Program Files\iPod
                                [2008-10-05|11:34] C:\Program Files\iTunes
                                [2008-11-09|13:40] C:\Program Files\Java
                                [2008-11-09|13:38] C:\Program Files\LimeWire
                                [2008-12-02|13:50] C:\Program Files\Logitech
                                [2008-12-07|16:11] C:\Program Files\Malwarebytes' Anti-Malware
                                [2008-06-18|23:37] C:\Program Files\Manual
                                [2008-11-12|17:04] C:\Program Files\Messenger
                                [2008-09-03|15:09] C:\Program Files\Messenger Plus! Live
                                [2008-08-13|11:27] C:\Program Files\M‚t‚oM‚dia
                                [2008-04-21|18:58] C:\Program Files\Micro Innovations
                                [2008-04-18|19:44] C:\Program Files\Microsoft CAPICOM 2.1.0.2
                                [2008-04-14|17:30] C:\Program Files\microsoft frontpage
                                [2008-10-06|19:11] C:\Program Files\Microsoft Office
                                [2008-10-21|21:37] C:\Program Files\Microsoft Silverlight
                                [2008-11-12|18:01] C:\Program Files\Movie Maker
                                [2008-10-06|19:10] C:\Program Files\MSECache
                                [2008-04-14|17:25] C:\Program Files\MSN
                                [2008-04-14|17:25] C:\Program Files\MSN Gaming Zone
                                [2008-11-11|23:44] C:\Program Files\MSXML 4.0
                                [2008-04-14|17:29] C:\Program Files\MSXML 6.0
                                [2008-11-12|16:35] C:\Program Files\NetMeeting
                                [2008-04-14|17:26] C:\Program Files\Online Services
                                [2008-11-12|18:01] C:\Program Files\Outlook Express
                                [2008-12-01|01:02] C:\Program Files\PC Drivers HeadQuarters
                                [2008-11-11|16:46] C:\Program Files\QuickTime
                                [2008-04-14|19:42] C:\Program Files\Realtek AC97
                                [2008-04-14|19:42] C:\Program Files\Realtek Sound Manager
                                [2008-08-03|05:17] C:\Program Files\ReflexiveArcade
                                [2008-05-18|10:55] C:\Program Files\ROBLOX Corporation
                                [2008-10-05|11:25] C:\Program Files\Safari
                                [2008-04-14|17:28] C:\Program Files\Services en ligne
                                [2008-12-10|10:37] C:\Program Files\Spyware Doctor
                                [2008-08-11|23:53] C:\Program Files\Sun
                                [2008-12-29|22:16] C:\Program Files\Support
                                [2008-11-03|21:21] C:\Program Files\TorrentMan
                                [2008-12-07|16:04] C:\Program Files\Trend Micro
                                [2008-12-29|22:16] C:\Program Files\TSBin
                                [2008-12-29|22:17] C:\Program Files\TSData
                                [2008-04-14|17:36] C:\Program Files\Uninstall Information
                                [2008-06-16|12:57] C:\Program Files\Ventrilo
                                [2008-10-15|18:56] C:\Program Files\vso
                                [2008-04-17|22:13] C:\Program Files\Windows Live
                                [2008-04-14|17:26] C:\Program Files\Windows Media Connect 2
                                [2008-11-12|16:35] C:\Program Files\Windows Media Player
                                [2008-11-12|16:35] C:\Program Files\Windows NT
                                [2008-04-14|17:28] C:\Program Files\WindowsUpdate
                                [2008-04-14|18:20] C:\Program Files\WinRAR
                                [2008-12-09|23:06] C:\Program Files\World of Warcraft
                                [2008-11-12|17:15] C:\Program Files\World of Warcraft Public Test
                                [2008-04-16|13:58] C:\Program Files\World of Warcraft Trial
                                [2008-04-16|14:30] C:\Program Files\WoW-2.0.0-enUS-Installer
                                [2008-04-14|17:30] C:\Program Files\xerox
                                [2008-12-01|23:55] C:\Program Files\Yahoo!

                                --------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs

                                [2008-04-14|20:35] C:\Program Files\Fichiers communs\Adobe
                                [2008-04-15|20:49] C:\Program Files\Fichiers communs\Apple
                                [2008-11-11|14:55] C:\Program Files\Fichiers communs\Blizzard Entertainment
                                [2008-04-14|20:44] C:\Program Files\Fichiers communs\DESIGNER
                                [2008-04-14|21:12] C:\Program Files\Fichiers communs\InstallShield
                                [2008-04-14|20:01] C:\Program Files\Fichiers communs\Java
                                [2008-12-01|21:35] C:\Program Files\Fichiers communs\logishrd
                                [2008-12-01|21:30] C:\Program Files\Fichiers communs\Logitech
                                [2008-10-21|22:33] C:\Program Files\Fichiers communs\Microsoft Shared
                                [2008-04-14|17:27] C:\Program Files\Fichiers communs\MSSoap
                                [2008-12-30|11:20] C:\Program Files\Fichiers communs\Nero
                                [2008-04-14|13:54] C:\Program Files\Fichiers communs\ODBC
                                [2008-07-29|16:18] C:\Program Files\Fichiers communs\PC Tools
                                [2008-04-14|17:27] C:\Program Files\Fichiers communs\Services
                                [2008-04-14|13:54] C:\Program Files\Fichiers communs\SpeechEngines
                                [2008-10-28|18:41] C:\Program Files\Fichiers communs\Symantec Shared
                                [2008-11-12|16:35] C:\Program Files\Fichiers communs\System
                                [2008-04-17|22:13] C:\Program Files\Fichiers communs\WindowsLiveInstaller
                                [2008-06-16|12:56] C:\Program Files\Fichiers communs\Wise Installation Wizard

                                --------------------\\ Process

                                ( 54 Processes )

                                ... OK !

                                --------------------\\ Recherche avec S_Lop

                                Aucun fichier / dossier Lop trouvé !

                                --------------------\\ Recherche de Fichiers / Dossiers Lop

                                Aucun fichier / dossier Lop trouvé !

                                --------------------\\ Verification du Registre

                                ..... OK !

                                --------------------\\ Verification du fichier Hosts

                                Fichier Hosts PROPRE

                                --------------------\\ Recherche de fichiers avec Catchme

                                catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                                Rootkit scan 2008-12-10 11:48:12
                                Windows 5.1.2600 Service Pack 3 NTFS
                                detected NTDLL code modification:
                                ZwClose
                                scanning hidden processes ...
                                scanning hidden files ...
                                scan completed successfully
                                hidden processes: 0
                                hidden files: 21

                                --------------------\\ Recherche d'autres infections

                                --------------------\\ Cracks & Keygens ..

                                C:\DOCUME~1\JEAN-S~1\Mes documents\LimeWire\Saved\eek-a-mouse - Crack Cocaine and Marijuana.mp3
                                C:\DOCUME~1\JEAN-S~1\Mes documents\LimeWire\Saved\Silverfall Earth Awakening Crack FIXED + Serial to Play Online PC
                                C:\DOCUME~1\JEAN-S~1\Mes documents\LimeWire\Saved\Silverfall Earth Awakening Crack FIXED + Serial to Play Online PC\Password instructions.html
                                C:\DOCUME~1\JEAN-S~1\Mes documents\LimeWire\Saved\Silverfall Earth Awakening Crack FIXED + Serial to Play Online PC\Password instructions.txt
                                C:\DOCUME~1\JEAN-S~1\Mes documents\LimeWire\Saved\Silverfall Earth Awakening Crack FIXED + Serial to Play Online PC\sfallEAfixed
                                C:\DOCUME~1\JEAN-S~1\Mes documents\LimeWire\Saved\Silverfall Earth Awakening Crack FIXED + Serial to Play Online PC\sfallEAfixed.rar

                                [F:2694][D:153]-> C:\DOCUME~1\JEAN-S~1\LOCALS~1\Temp
                                [F:83][D:0]-> C:\DOCUME~1\JEAN-S~1\Cookies
                                [F:461][D:9]-> C:\DOCUME~1\JEAN-S~1\LOCALS~1\TEMPOR~1\content.IE5

                                1 - "C:\Lop SD\LopR_1.txt" - 2008-12-10|11:41 - Option : [1]
                                2 - "C:\Lop SD\LopR_2.txt" - 2008-12-10|11:49 - Option : [2]

                                --------------------\\ Fin du rapport a 11:49:51
                                1. jstlovesnow Auteur
                                  -----------\\ ToolBar S&D 1.2.6 XP/Vista

                                  Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
                                  X86-based PC ( Uniprocessor Free : AMD Athlon(tm) 64 Processor 3000+ )
                                  BIOS : Default System BIOS
                                  USER : Jean-Sébastien ( Administrator )
                                  BOOT : Normal boot
                                  Antivirus : ESET NOD32 Antivirus 3.0 3.0 (Activated)
                                  A:\ (USB)
                                  C:\ (Local Disk) - NTFS - Total:72 Go (Free:22 Go)
                                  D:\ (Local Disk) - NTFS - Total:2 Go (Free:2 Go)
                                  E:\ (CD or DVD)

                                  "C:\ToolBar SD" ( MAJ : 04-12-2008|20:40 )
                                  Option : [1] ( 2008-12-10|11:56 )

                                  -----------\\ Recherche de Fichiers / Dossiers ...

                                  C:\Program Files\Fun Web Products
                                  C:\Program Files\Fun Web Products\MSNMessenger
                                  C:\Program Files\Fun Web Products\MSNMessenger\MSNBackgrounds
                                  C:\DOCUME~1\JEAN-S~1\LOCALS~1\Temp\ICD1.tmp

                                  -----------\\ [..\Internet Explorer\Main]

                                  [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
                                  "Local Page"="C:\\WINDOWS\\system32\\blank.htm"
                                  "Search Page"="http://ca.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*https://ca.search.yahoo.com/"
                                  "Search Bar"="http://www.google.com/toolbar/ie8/sidebar.html"

                                  [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
                                  "Default_Page_URL"="https://ca.yahoo.com/"
                                  "Default_Search_URL"="http://ca.rd.yahoo.com/customize/ie/defaults/su/msgr9/*https://ca.search.yahoo.com/"
                                  "Search Page"="http://ca.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*https://ca.search.yahoo.com/"
                                  "Start Page"="https://ca.yahoo.com/"
                                  "Search Bar"="https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchasst.htm"

                                  --------------------\\ Recherche d'autres infections

                                  --------------------\\ Cracks & Keygens ..

                                  C:\DOCUME~1\JEAN-S~1\Mes documents\LimeWire\Saved\eek-a-mouse - Crack Cocaine and Marijuana.mp3
                                  C:\DOCUME~1\JEAN-S~1\Mes documents\LimeWire\Saved\Silverfall Earth Awakening Crack FIXED + Serial to Play Online PC
                                  C:\DOCUME~1\JEAN-S~1\Mes documents\LimeWire\Saved\Silverfall Earth Awakening Crack FIXED + Serial to Play Online PC\Password instructions.html
                                  C:\DOCUME~1\JEAN-S~1\Mes documents\LimeWire\Saved\Silverfall Earth Awakening Crack FIXED + Serial to Play Online PC\Password instructions.txt
                                  C:\DOCUME~1\JEAN-S~1\Mes documents\LimeWire\Saved\Silverfall Earth Awakening Crack FIXED + Serial to Play Online PC\sfallEAfixed
                                  C:\DOCUME~1\JEAN-S~1\Mes documents\LimeWire\Saved\Silverfall Earth Awakening Crack FIXED + Serial to Play Online PC\sfallEAfixed.rar

                                  1 - "C:\ToolBar SD\TB_1.txt" - 2008-12-10|11:57 - Option : [1]

                                  -----------\\ Fin du rapport a 11:57:23,81
                                  1. jstlovesnow Auteur
                                    -----------\\ ToolBar S&D 1.2.6 XP/Vista

                                    Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
                                    X86-based PC ( Uniprocessor Free : AMD Athlon(tm) 64 Processor 3000+ )
                                    BIOS : Default System BIOS
                                    USER : Jean-Sébastien ( Administrator )
                                    BOOT : Normal boot
                                    Antivirus : ESET NOD32 Antivirus 3.0 3.0 (Activated)
                                    A:\ (USB)
                                    C:\ (Local Disk) - NTFS - Total:72 Go (Free:22 Go)
                                    D:\ (Local Disk) - NTFS - Total:2 Go (Free:2 Go)
                                    E:\ (CD or DVD)

                                    "C:\ToolBar SD" ( MAJ : 04-12-2008|20:40 )
                                    Option : [2] ( 2008-12-10|12:00 )

                                    -----------\\ SUPPRESSION

                                    Supprime! - C:\Program Files\Fun Web Products\MSNMessenger
                                    Supprime! - C:\DOCUME~1\JEAN-S~1\LOCALS~1\Temp\ICD1.tmp
                                    Supprime! - C:\Program Files\Fun Web Products

                                    -----------\\ Recherche de Fichiers / Dossiers ...

                                    -----------\\ [..\Internet Explorer\Main]

                                    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
                                    "Local Page"="C:\\WINDOWS\\system32\\blank.htm"
                                    "Search Page"="http://ca.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*https://ca.search.yahoo.com/"
                                    "Search Bar"="http://www.google.com/toolbar/ie8/sidebar.html"

                                    [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
                                    "Default_Page_URL"="https://ca.yahoo.com/"
                                    "Default_Search_URL"="http://ca.rd.yahoo.com/customize/ie/defaults/su/msgr9/*https://ca.search.yahoo.com/"
                                    "Search Page"="http://ca.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*https://ca.search.yahoo.com/"
                                    "Start Page"="https://www.msn.com/fr-fr/"
                                    "Search Bar"="https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchasst.htm"

                                    --------------------\\ Recherche d'autres infections

                                    --------------------\\ Cracks & Keygens ..

                                    C:\DOCUME~1\JEAN-S~1\Mes documents\LimeWire\Saved\eek-a-mouse - Crack Cocaine and Marijuana.mp3
                                    C:\DOCUME~1\JEAN-S~1\Mes documents\LimeWire\Saved\Silverfall Earth Awakening Crack FIXED + Serial to Play Online PC
                                    C:\DOCUME~1\JEAN-S~1\Mes documents\LimeWire\Saved\Silverfall Earth Awakening Crack FIXED + Serial to Play Online PC\Password instructions.html
                                    C:\DOCUME~1\JEAN-S~1\Mes documents\LimeWire\Saved\Silverfall Earth Awakening Crack FIXED + Serial to Play Online PC\Password instructions.txt
                                    C:\DOCUME~1\JEAN-S~1\Mes documents\LimeWire\Saved\Silverfall Earth Awakening Crack FIXED + Serial to Play Online PC\sfallEAfixed
                                    C:\DOCUME~1\JEAN-S~1\Mes documents\LimeWire\Saved\Silverfall Earth Awakening Crack FIXED + Serial to Play Online PC\sfallEAfixed.rar

                                    1 - "C:\ToolBar SD\TB_1.txt" - 2008-12-10|11:57 - Option : [1]
                                    2 - "C:\ToolBar SD\TB_2.txt" - 2008-12-10|12:02 - Option : [2]

                                    -----------\\ Fin du rapport a 12:02:00,57
                                    1. jstlovesnow Auteur
                                      SmitFraudFix v2.382

                                      Rapport fait à 12:06:46,56, 2008-12-10
                                      Executé à partir de C:\Documents and Settings\Jean-S‚bastien\Bureau\SmitfraudFix
                                      OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
                                      Le type du système de fichiers est NTFS
                                      Fix executé en mode normal

                                      »»»»»»»»»»»»»»»»»»»»»»»» Process

                                      C:\WINDOWS\System32\smss.exe
                                      C:\WINDOWS\system32\csrss.exe
                                      C:\WINDOWS\system32\winlogon.exe
                                      C:\WINDOWS\system32\services.exe
                                      C:\WINDOWS\system32\lsass.exe
                                      C:\WINDOWS\system32\svchost.exe
                                      C:\WINDOWS\system32\svchost.exe
                                      C:\WINDOWS\System32\svchost.exe
                                      C:\WINDOWS\system32\svchost.exe
                                      C:\WINDOWS\system32\svchost.exe
                                      C:\WINDOWS\Explorer.EXE
                                      C:\WINDOWS\system32\spoolsv.exe
                                      C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
                                      C:\WINDOWS\SOUNDMAN.EXE
                                      C:\Program Files\Java\jre6\bin\jusched.exe
                                      C:\Program Files\Micro Innovations\Keyboard\kbdap32a.EXE
                                      C:\Program Files\Micro Innovations\Mouse\mouse32a.exe
                                      C:\Program Files\iTunes\iTunesHelper.exe
                                      C:\WINDOWS\system32\RUNDLL32.EXE
                                      C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
                                      C:\Program Files\Logitech\QuickCam\Quickcam.exe
                                      C:\Program Files\Spyware Doctor\pctsTray.exe
                                      C:\WINDOWS\system32\ctfmon.exe
                                      C:\Program Files\Messenger\msmsgs.exe
                                      C:\Program Files\MétéoMédia\MétéoÉclair\WeatherEye.exe
                                      C:\Documents and Settings\Jean-Sébastien\Application Data\Google\kjzna1562565.exe
                                      C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
                                      C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                                      C:\Program Files\Bonjour\mDNSResponder.exe
                                      C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                                      C:\Program Files\Java\jre6\bin\jqs.exe
                                      C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
                                      C:\WINDOWS\system32\nvsvc32.exe
                                      C:\WINDOWS\system32\PnkBstrA.exe
                                      C:\Program Files\Spyware Doctor\pctsAuxs.exe
                                      C:\Program Files\Spyware Doctor\pctsSvc.exe
                                      C:\WINDOWS\system32\svchost.exe
                                      C:\Program Files\iPod\bin\iPodService.exe
                                      C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
                                      C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
                                      C:\WINDOWS\system32\wbem\wmiapsrv.exe
                                      C:\WINDOWS\System32\alg.exe
                                      C:\WINDOWS\System32\svchost.exe
                                      C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe
                                      C:\WINDOWS\system32\dwwin.exe
                                      C:\Program Files\Windows Live\Messenger\msnmsgr.exe
                                      C:\Program Files\Windows Live\Messenger\usnsvc.exe
                                      C:\Program Files\iTunes\iTunes.exe
                                      C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
                                      C:\Program Files\Internet Explorer\IEXPLORE.EXE
                                      C:\Documents and Settings\Jean-Sébastien\Bureau\SmitfraudFix\Policies.exe
                                      C:\WINDOWS\system32\cmd.exe
                                      C:\WINDOWS\system32\wbem\wmiprvse.exe

                                      »»»»»»»»»»»»»»»»»»»»»»»» hosts

                                      »»»»»»»»»»»»»»»»»»»»»»»» C:\

                                      »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

                                      »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

                                      »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

                                      »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

                                      »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

                                      »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Jean-S‚bastien

                                      »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\JEAN-S~1\LOCALS~1\Temp

                                      »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Jean-S‚bastien\Application Data

                                      »»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

                                      »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\JEAN-S~1\Favoris

                                      »»»»»»»»»»»»»»»»»»»»»»»» Bureau

                                      »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

                                      C:\Program Files\Google\googletoolbar1.dll PRESENT !

                                      »»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

                                      »»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

                                      [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
                                      "Source"="About:Home"
                                      "SubscribedURL"="About:Home"
                                      "FriendlyName"="Ma page d'accueil"

                                      »»»»»»»»»»»»»»»»»»»»»»»» o4Patch
                                      !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                                      o4Patch
                                      Credits: Malware Analysis & Diagnostic
                                      Code: S!Ri

                                      »»»»»»»»»»»»»»»»»»»»»»»» IEDFix
                                      !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                                      IEDFix
                                      Credits: Malware Analysis & Diagnostic
                                      Code: S!Ri

                                      »»»»»»»»»»»»»»»»»»»»»»»» VACFix
                                      !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                                      VACFix
                                      Credits: Malware Analysis & Diagnostic
                                      Code: S!Ri

                                      »»»»»»»»»»»»»»»»»»»»»»»» 404Fix
                                      !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                                      404Fix
                                      Credits: Malware Analysis & Diagnostic
                                      Code: S!Ri

                                      »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
                                      !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                                      SrchSTS.exe by S!Ri
                                      Search SharedTaskScheduler's .dll

                                      »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
                                      !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                                      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
                                      "AppInit_DLLs"=""
                                      "LoadAppInit_DLLs"=dword:00000001

                                      »»»»»»»»»»»»»»»»»»»»»»»» Winlogon
                                      !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                                      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
                                      "Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
                                      "System"=""

                                      »»»»»»»»»»»»»»»»»»»»»»»» RK

                                      »»»»»»»»»»»»»»»»»»»»»»»» DNS

                                      Description: WAN (PPP/SLIP) Interface
                                      DNS Server Search Order: 142.166.145.137
                                      DNS Server Search Order: 142.177.2.130

                                      HKLM\SYSTEM\CCS\Services\Tcpip\..\{89C58DB9-5E83-4CCE-82CF-D767D34179A5}: NameServer=142.166.145.137 142.177.2.130
                                      HKLM\SYSTEM\CS1\Services\Tcpip\..\{89C58DB9-5E83-4CCE-82CF-D767D34179A5}: NameServer=142.166.145.137 142.177.2.130
                                      HKLM\SYSTEM\CS3\Services\Tcpip\..\{89C58DB9-5E83-4CCE-82CF-D767D34179A5}: NameServer=142.166.145.137 142.177.2.130

                                      »»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

                                      »»»»»»»»»»»»»»»»»»»»»»»» Fin
                                      • 1
                                      • 2