Ordi qui rame

ce n'est pas au chargment de la video, lorsque je veux lire une video, il y a un ralentissement général, et le son se met à trembler car l'image bug,

c'est un ordi portable, donc peut pas le nettoyer, et je n'ai pas de pilote son,

voila pour ajouter de la ram ça se passe comment?

dis moi si tu veux que je fasse un cou de OTL

a plus

salut,

bon l'ordi va un petit mieux mais on peut pas dire que c'est merveilleux,

les videos rament toujours, le son broute, les images aussi,

l'ordi est toujours long au démarrage, une fois qu'il a chauffé, internet marche relativement bien, mais ça prend un peu de temps,

voila les rapports que tu m'as demandé, la défragmentation m'a été demandé uniquement pour le C: pas pour le D:

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== FILES ==========
C:\WINDOWS\_delis32.ini moved successfully.
========== OTL ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\\{74CC49F7-EB32-4A08-B204-948962A6E3DB} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{74CC49F7-EB32-4A08-B204-948962A6E3DB}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Adobe Reader Speed Launcher deleted successfully.
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\CtrlVol deleted successfully.
C:\Program Files\Launch Manager\CtrlVol.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\EPSON Stylus CX3600 Series deleted successfully.
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\EPSON Stylus CX3600 Series (Copie 1) deleted successfully.
File C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\EPSON Stylus DX4000 Series deleted successfully.
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBEE.EXE moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\eRecoveryService deleted successfully.
C:\WINDOWS\System32\Check.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\HotKeysCmds deleted successfully.
C:\WINDOWS\System32\hkcmd.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\IgfxTray deleted successfully.
C:\WINDOWS\System32\igfxtray.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ImgTask deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\IMJPMIG8.1 deleted successfully.
C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\LaunchAp deleted successfully.
C:\Program Files\Launch Manager\LaunchAp.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\MSPY2002 deleted successfully.
C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ORAHSSSessionManager deleted successfully.
C:\Program Files\OrangeHSS\SessionManager\SessionManager.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\PHIME2002A deleted successfully.
C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\PHIME2002ASync deleted successfully.
File C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\PowerKey deleted successfully.
C:\Program Files\Launch Manager\PowerKey.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\QuickTime Task deleted successfully.
C:\Program Files\QuickTime\qttask.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\SoundMan deleted successfully.
C:\WINDOWS\SOUNDMAN.EXE moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\SunJavaUpdateSched deleted successfully.
C:\Program Files\Java\jre6\bin\jusched.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\SynTPEnh deleted successfully.
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\SynTPLpr deleted successfully.
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Wbutton deleted successfully.
C:\Program Files\Launch Manager\Wbutton.exe moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\MSMSGS deleted successfully.
C:\Program Files\Messenger\msmsgs.exe moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\swg deleted successfully.
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe moved successfully.
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk moved successfully.
C:\Program Files\Microsoft Office\Office\OSA9.EXE moved successfully.
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\BlueSoleil.lnk moved successfully.
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe moved successfully.
C:\Documents and Settings\Francois\Menu Démarrer\Programmes\Démarrage\Outil de détection de support Picture Motion Browser.lnk moved successfully.
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Restrictions\ deleted successfully.
Starting removal of ActiveX control {0A5FD7C5-A45C-49FC-ADB5-9952547D5715}
C:\WINDOWS\Downloaded Program Files\CTSUEng.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{0A5FD7C5-A45C-49FC-ADB5-9952547D5715}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0A5FD7C5-A45C-49FC-ADB5-9952547D5715}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{0A5FD7C5-A45C-49FC-ADB5-9952547D5715}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0A5FD7C5-A45C-49FC-ADB5-9952547D5715}\ not found.
Starting removal of ActiveX control {166B1BCA-3F9C-11CF-8075-444553540000}
C:\WINDOWS\Downloaded Program Files\setup.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{166B1BCA-3F9C-11CF-8075-444553540000}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{166B1BCA-3F9C-11CF-8075-444553540000}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{166B1BCA-3F9C-11CF-8075-444553540000}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{166B1BCA-3F9C-11CF-8075-444553540000}\ not found.
Starting removal of ActiveX control {42E1F024-ECC3-456F-B98A-4CE5ACDBF25C}
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{42E1F024-ECC3-456F-B98A-4CE5ACDBF25C}\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{42E1F024-ECC3-456F-B98A-4CE5ACDBF25C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42E1F024-ECC3-456F-B98A-4CE5ACDBF25C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{42E1F024-ECC3-456F-B98A-4CE5ACDBF25C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42E1F024-ECC3-456F-B98A-4CE5ACDBF25C}\ not found.
Starting removal of ActiveX control {4F1E5B1A-2A80-42CA-8532-2D05CB959537}
C:\WINDOWS\Downloaded Program Files\MsnPUpld.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{4F1E5B1A-2A80-42CA-8532-2D05CB959537}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4F1E5B1A-2A80-42CA-8532-2D05CB959537}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{4F1E5B1A-2A80-42CA-8532-2D05CB959537}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4F1E5B1A-2A80-42CA-8532-2D05CB959537}\ not found.
Starting removal of ActiveX control {88764F69-3831-4EC1-B40B-FF21D8381345}
C:\WINDOWS\Downloaded Program Files\AdSignerADP.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{88764F69-3831-4EC1-B40B-FF21D8381345}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{88764F69-3831-4EC1-B40B-FF21D8381345}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{88764F69-3831-4EC1-B40B-FF21D8381345}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{88764F69-3831-4EC1-B40B-FF21D8381345}\ not found.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
C:\WINDOWS\Downloaded Program Files\erma.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Starting removal of ActiveX control {B38870E4-7ECB-40DA-8C6A-595F0A5519FF}
C:\WINDOWS\Downloaded Program Files\MsnMessengerSetupDownloader.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{B38870E4-7ECB-40DA-8C6A-595F0A5519FF}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B38870E4-7ECB-40DA-8C6A-595F0A5519FF}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{B38870E4-7ECB-40DA-8C6A-595F0A5519FF}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B38870E4-7ECB-40DA-8C6A-595F0A5519FF}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {D27CDB6E-AE6D-11CF-96B8-444553540000}
C:\WINDOWS\Downloaded Program Files\swflash.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{D27CDB6E-AE6D-11CF-96B8-444553540000}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11CF-96B8-444553540000}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{D27CDB6E-AE6D-11CF-96B8-444553540000}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11CF-96B8-444553540000}\ not found.
Starting removal of ActiveX control {F6ACF75C-C32C-447B-9BEF-46B766368D29}
C:\WINDOWS\Downloaded Program Files\CTPID.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{F6ACF75C-C32C-447B-9BEF-46B766368D29}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F6ACF75C-C32C-447B-9BEF-46B766368D29}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{F6ACF75C-C32C-447B-9BEF-46B766368D29}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F6ACF75C-C32C-447B-9BEF-46B766368D29}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ipp\ deleted successfully.
File Protocol\Handler\ipp - No CLSID value found not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\msdaipp\ deleted successfully.
File Protocol\Handler\msdaipp - No CLSID value found not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: All Users

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 33170 bytes

User: Francois
->Temp folder emptied: 23850 bytes
->Temporary Internet Files folder emptied: 253009678 bytes
->Java cache emptied: 13425503 bytes
->FireFox cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
Windows Temp folder emptied: 664 bytes
RecycleBin emptied: 272872 bytes

Total Files Cleaned = 254,41 mb

OTL by OldTimer - Version 3.0.10.3 log created on 08242009_191623

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

[ Rapport ToolsCleaner version 2.3.9 (par A.Rothstein & dj QUIOU) ]

--> Recherche:

C:\lopR.txt: trouvé !
C:\Lop SD: trouvé !
C:\Documents and Settings\Francois\Bureau\LopSD.exe: trouvé !
C:\Lop SD\catchme.exe: trouvé !
C:\Lop SD\catchme.log: trouvé !

---------------------------------
--> Suppression:

C:\Documents and Settings\Francois\Bureau\LopSD.exe: supprimé !
C:\Lop SD\catchme.exe: supprimé !
C:\lopR.txt: supprimé !
C:\Lop SD\catchme.log: supprimé !
C:\Lop SD: supprimé !

voila, est ce qu'il y a encore des choses à faire et qu'est ce que ça dit, mon ordi est il mal barré? toujours infecté?

merci pour les tuyaux,

a plus

dsl mais pas beaucoup de temps,

voila le rapport que tu m'as demandé:

http://www.cijoint.fr/cjlink.php?file=cj200908/cijMH6RLq6.txt

j'espére que j'ai réussi,

encore combien de temps ça peut prendre ces ralentissements

a plus

salut,

c'est quoi une infection lop

voila pour le rapport,

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== FILES ==========
C:\Documents and Settings\All Users\Application Data\Boldnurbmp3flaw moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: All Users

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: LocalService
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 33170 bytes

User: Francois
->Temp folder emptied: 62408 bytes
->Temporary Internet Files folder emptied: 14943925 bytes
->Java cache emptied: 13425503 bytes
->FireFox cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
Windows Temp folder emptied: 17570586 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 43,97 mb

OTL by OldTimer - Version 3.0.10.3 log created on 08122009_194201

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

sinon l'ordi, c'est pas tellement mieux, toujours très long à démarrer et après ça va mieux,

par contre je ne dois pas avoir le CCleaner,

a plus

salut,

dsl, pas beaucoup de temps en ce moment pour l'ordi,

voila les infos sans erreur j'espère, !

Malwarebytes' Anti-Malware 1.39
Version de la base de données: 2530
Windows 5.1.2600 Service Pack 3

30/07/2009 21:15:06
mbam-log-2009-07-30 (21-15-06).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 169619
Temps écoulé: 1 hour(s), 50 minute(s), 34 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

le rapport OTL:

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
C:\Documents and Settings\All Users\Application Data\Boldnurbmp3flaw\Heck Bash.exe moved successfully.
C:\Program Files\Common Files\Companion Wizard\WapCHK.dll NOT unregistered.
C:\Program Files\Common Files\Companion Wizard\WapCHK.dll moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: All Users

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 33170 bytes

User: Francois
->Temp folder emptied: 79257468 bytes
->Temporary Internet Files folder emptied: 159699434 bytes
->Java cache emptied: 13553524 bytes
->FireFox cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
Windows Temp folder emptied: 528808 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 241,35 mb

OTL by OldTimer - Version 3.0.10.3 log created on 08062009_194253

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

et le rapport lop SD recherche + suppression

--------------------\\ Lop S&D 4.2.5-0 XP/Vista

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : Intel(R) Celeron(R) M processor 1.50GHz )
BIOS : PhoenixBIOS 4.0 Release 6.1
USER : Francois ( Administrator )
BOOT : Normal boot
Antivirus : Avira AntiVir PersonalEdition Classic 0.0.0.0 (Activated)
C:\ (Local Disk) - FAT32 - Total:26 Go (Free:9 Go)
D:\ (Local Disk) - FAT32 - Total:26 Go (Free:18 Go)
E:\ (CD or DVD)

"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
Option : [2] ( 06/08/2009|20:40 )

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ SUPPRESSION

-
[ Fichier Hosts ] .. Restaure!

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

--------------------\\ Listing des dossiers dans APPLIC~1

[15/10/2004|12:05] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
[15/10/2004|11:51] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

[09/10/2008|22:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
[26/09/2006|16:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AntiVir PersonalEdition Classic
[08/02/2009|18:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Azureus
[05/01/2008|11:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Bluetooth
[14/12/2005|22:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Boldnurbmp3flaw
[31/12/2007|13:39] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Creative
[27/10/2006|12:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
[24/05/2009|16:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
[09/07/2009|10:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
[25/02/2009|18:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
[15/10/2004|11:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[16/03/2007|20:25] C:\DOCUME~1\ALLUSE~1\APPLIC~1\NtiDvdCopy
[01/05/2008|20:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
[20/09/2005|18:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBT
[24/02/2006|21:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ScanSoft
[21/01/2006|11:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
[06/12/2005|16:58] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
[28/01/2006|12:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SSScanAppDataDir
[28/01/2006|12:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SSScanWizard
[17/09/2005|23:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
[26/10/2008|12:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\UDL
[08/08/2006|11:25] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
[11/02/2007|10:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Live Toolbar
[22/11/2007|23:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller

[15/10/2004|11:51] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

[20/04/2009|18:21] C:\DOCUME~1\LOCALS~1\APPLIC~1\Adobe
[15/10/2004|11:51] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

[22/09/2005|12:33] C:\DOCUME~1\FRANCOIS\APPLIC~1\Adobe
[22/09/2005|12:38] C:\DOCUME~1\FRANCOIS\APPLIC~1\AdobeUM
[28/01/2006|12:20] C:\DOCUME~1\FRANCOIS\APPLIC~1\Arcsoft
[01/12/2006|16:07] C:\DOCUME~1\FRANCOIS\APPLIC~1\Azureus
[28/01/2006|12:18] C:\DOCUME~1\FRANCOIS\APPLIC~1\Canon
[31/12/2007|13:43] C:\DOCUME~1\FRANCOIS\APPLIC~1\Creative
[17/09/2005|23:57] C:\DOCUME~1\FRANCOIS\APPLIC~1\CyberLink
[06/01/2008|14:13] C:\DOCUME~1\FRANCOIS\APPLIC~1\dvdcss
[27/10/2006|12:32] C:\DOCUME~1\FRANCOIS\APPLIC~1\Google
[05/12/2005|14:34] C:\DOCUME~1\FRANCOIS\APPLIC~1\Help
[15/10/2004|12:05] C:\DOCUME~1\FRANCOIS\APPLIC~1\Identities
[28/01/2006|12:11] C:\DOCUME~1\FRANCOIS\APPLIC~1\InterTrust
[18/12/2005|20:49] C:\DOCUME~1\FRANCOIS\APPLIC~1\Lavasoft
[22/09/2005|11:25] C:\DOCUME~1\FRANCOIS\APPLIC~1\Macromedia
[09/07/2009|10:03] C:\DOCUME~1\FRANCOIS\APPLIC~1\Malwarebytes
[03/03/2006|16:28] C:\DOCUME~1\FRANCOIS\APPLIC~1\Media Player Classic
[15/10/2004|11:51] C:\DOCUME~1\FRANCOIS\APPLIC~1\Microsoft
[20/09/2005|18:41] C:\DOCUME~1\FRANCOIS\APPLIC~1\Microsoft Web Folders
[12/08/2008|18:37] C:\DOCUME~1\FRANCOIS\APPLIC~1\Mozilla
[06/01/2009|18:46] C:\DOCUME~1\FRANCOIS\APPLIC~1\MP-Manager
[17/03/2006|18:37] C:\DOCUME~1\FRANCOIS\APPLIC~1\MSNInstaller
[03/10/2006|11:28] C:\DOCUME~1\FRANCOIS\APPLIC~1\programsite
[20/12/2007|17:27] C:\DOCUME~1\FRANCOIS\APPLIC~1\Real
[28/01/2006|12:14] C:\DOCUME~1\FRANCOIS\APPLIC~1\ScanSoft
[21/01/2006|11:50] C:\DOCUME~1\FRANCOIS\APPLIC~1\Skype
[13/03/2008|18:19] C:\DOCUME~1\FRANCOIS\APPLIC~1\skypePM
[14/12/2008|12:21] C:\DOCUME~1\FRANCOIS\APPLIC~1\Smart Panel
[05/01/2008|11:16] C:\DOCUME~1\FRANCOIS\APPLIC~1\Sony Corporation
[01/12/2006|16:05] C:\DOCUME~1\FRANCOIS\APPLIC~1\Sun
[17/09/2005|23:52] C:\DOCUME~1\FRANCOIS\APPLIC~1\Symantec
[02/06/2008|21:29] C:\DOCUME~1\FRANCOIS\APPLIC~1\TaoUSign
[14/06/2008|18:53] C:\DOCUME~1\FRANCOIS\APPLIC~1\U3
[20/12/2007|08:00] C:\DOCUME~1\FRANCOIS\APPLIC~1\vlc
[07/07/2009|19:40] C:\DOCUME~1\FRANCOIS\APPLIC~1\WinRAR

--------------------\\ Tâches planifiées dans C:\WINDOWS\tasks

[11/06/2009 10:00][--a------] C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[06/08/2009 19:45][--ah-----] C:\WINDOWS\tasks\SA.DAT
[05/08/2004 05:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini

--------------------\\ Listing des dossiers dans C:\Program Files

[17/09/2005|23:39] C:\Program Files\acer
[06/07/2005|20:04] C:\Program Files\Acer Inc
[06/07/2005|20:03] C:\Program Files\Adobe
[26/09/2006|16:43] C:\Program Files\AntiVir PersonalEdition Classic
[17/09/2005|23:38] C:\Program Files\Arcade
[28/01/2006|12:11] C:\Program Files\ArcSoft
[06/01/2006|18:58] C:\Program Files\Canon
[21/10/2007|12:18] C:\Program Files\Coeur
[27/03/2006|09:33] C:\Program Files\Common Files
[15/10/2004|11:58] C:\Program Files\ComPlus Applications
[06/07/2005|19:59] C:\Program Files\CONEXANT
[31/12/2007|13:35] C:\Program Files\Creative
[06/07/2005|20:03] C:\Program Files\CyberLink
[07/12/2005|20:20] C:\Program Files\directx
[09/07/2007|21:49] C:\Program Files\epson
[15/10/2004|11:52] C:\Program Files\Fichiers communs
[05/01/2008|11:59] C:\Program Files\FlashDiskManager
[28/09/2007|22:37] C:\Program Files\Free
[27/10/2006|12:31] C:\Program Files\Google
[06/07/2005|19:50] C:\Program Files\InstallShield Installation Information
[06/07/2005|19:51] C:\Program Files\Intel
[15/10/2004|11:58] C:\Program Files\Internet Explorer
[05/01/2008|11:25] C:\Program Files\IVT Corporation
[01/12/2006|16:01] C:\Program Files\Java
[29/01/2006|11:21] C:\Program Files\Kerio
[03/03/2006|21:45] C:\Program Files\K-Lite Codec Pack
[06/07/2005|20:00] C:\Program Files\Launch Manager
[24/05/2009|16:09] C:\Program Files\Lavasoft
[19/11/2006|12:14] C:\Program Files\Logitech
[09/07/2009|10:02] C:\Program Files\Malwarebytes' Anti-Malware
[15/10/2004|11:57] C:\Program Files\Messenger
[22/03/2009|15:40] C:\Program Files\Microsoft
[13/05/2007|03:03] C:\Program Files\Microsoft CAPICOM 2.1.0.2
[15/10/2004|12:01] C:\Program Files\microsoft frontpage
[17/09/2005|23:42] C:\Program Files\Microsoft Office
[25/09/2005|12:53] C:\Program Files\Microsoft R‚f‚rence
[22/03/2009|15:48] C:\Program Files\Microsoft Silverlight
[22/11/2007|23:34] C:\Program Files\Microsoft SQL Server Compact Edition
[22/03/2009|15:43] C:\Program Files\Microsoft Sync Framework
[20/09/2005|18:46] C:\Program Files\Microsoft Visual Studio
[17/09/2005|23:42] C:\Program Files\Microsoft Works
[15/10/2004|11:58] C:\Program Files\Movie Maker
[12/08/2008|18:37] C:\Program Files\Mozilla Firefox
[15/10/2004|11:57] C:\Program Files\MSN
[15/10/2004|11:57] C:\Program Files\MSN Gaming Zone
[15/11/2006|03:01] C:\Program Files\MSXML 4.0
[15/10/2004|11:58] C:\Program Files\NetMeeting
[06/07/2005|20:01] C:\Program Files\NewTech Infosystems
[15/10/2004|11:57] C:\Program Files\Online Services
[26/12/2008|15:42] C:\Program Files\OrangeHSS
[15/10/2004|11:58] C:\Program Files\Outlook Express
[01/05/2008|20:44] C:\Program Files\QuickTime
[06/01/2007|10:48] C:\Program Files\Real
[03/12/2006|12:15] C:\Program Files\Samsung
[28/01/2006|12:13] C:\Program Files\ScanSoft
[26/12/2008|15:43] C:\Program Files\Securitoo
[15/10/2004|11:59] C:\Program Files\Services en ligne
[24/10/2007|21:14] C:\Program Files\Skype
[26/10/2008|11:57] C:\Program Files\Smart Panel
[20/09/2005|18:43] C:\Program Files\Snapshot Viewer
[05/01/2008|11:08] C:\Program Files\Sony
[06/12/2005|16:58] C:\Program Files\Spybot - Search & Destroy
[06/07/2005|19:58] C:\Program Files\Synaptics
[25/05/2009|20:59] C:\Program Files\trend micro
[15/10/2004|12:05] C:\Program Files\Uninstall Information
[01/04/2006|15:41] C:\Program Files\VirtualDJ
[08/02/2009|18:58] C:\Program Files\Vuze
[10/08/2007|22:11] C:\Program Files\Windows Live
[22/03/2009|15:40] C:\Program Files\Windows Live SkyDrive
[05/05/2007|20:00] C:\Program Files\Windows Media Connect 2
[15/10/2004|11:57] C:\Program Files\Windows Media Player
[15/10/2004|11:57] C:\Program Files\Windows NT
[15/10/2004|11:59] C:\Program Files\WindowsUpdate
[19/10/2005|20:48] C:\Program Files\WinRAR
[15/10/2004|12:01] C:\Program Files\xerox

--------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs

[22/09/2005|12:33] C:\Program Files\Fichiers communs\Adobe
[09/10/2008|22:51] C:\Program Files\Fichiers communs\Adobe AIR
[20/09/2005|18:46] C:\Program Files\Fichiers communs\Designer
[26/12/2008|15:41] C:\Program Files\Fichiers communs\France Telecom
[08/02/2009|18:58] C:\Program Files\Fichiers communs\i4j_jres
[06/07/2005|19:50] C:\Program Files\Fichiers communs\InstallShield
[07/12/2005|20:17] C:\Program Files\Fichiers communs\Logitech
[15/10/2004|11:52] C:\Program Files\Fichiers communs\Microsoft Shared
[15/10/2004|11:58] C:\Program Files\Fichiers communs\MSSoap
[06/07/2005|20:02] C:\Program Files\Fichiers communs\muvee Technologies
[06/07/2005|20:01] C:\Program Files\Fichiers communs\NewTech Infosystems
[15/10/2004|11:52] C:\Program Files\Fichiers communs\ODBC
[06/01/2007|10:48] C:\Program Files\Fichiers communs\Real
[28/01/2006|12:14] C:\Program Files\Fichiers communs\ScanSoft Shared
[15/10/2004|11:58] C:\Program Files\Fichiers communs\Services
[13/03/2008|18:18] C:\Program Files\Fichiers communs\Skype
[15/10/2004|11:52] C:\Program Files\Fichiers communs\SpeechEngines
[17/09/2005|23:52] C:\Program Files\Fichiers communs\Symantec Shared
[15/10/2004|11:58] C:\Program Files\Fichiers communs\System
[22/03/2009|15:34] C:\Program Files\Fichiers communs\Windows Live
[22/11/2007|23:30] C:\Program Files\Fichiers communs\WindowsLiveInstaller

--------------------\\ Process

( 54 Processes )

... OK !

--------------------\\ Recherche avec S_Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Recherche de Fichiers / Dossiers Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Verification du Registre

..... OK !

--------------------\\ Verification du fichier Hosts

Fichier Hosts PROPRE

--------------------\\ Recherche de fichiers avec Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-06 20:43:14
Windows 5.1.2600 Service Pack 3 FAT NTAPI
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 0

--------------------\\ Recherche d'autres infections

Aucune autre infection trouvée !

[F:3][D:3]-> C:\DOCUME~1\Francois\LOCALS~1\Temp
[F:52][D:0]-> C:\DOCUME~1\Francois\Cookies
[F:125][D:4]-> C:\DOCUME~1\Francois\LOCALS~1\TEMPOR~1\content.IE5
[F:2][D:0]-> C:\Recycled

1 - "C:\Lop SD\LopR_1.txt" - 06/08/2009|20:35 - Option : [1]
2 - "C:\Lop SD\LopR_2.txt" - 06/08/2009|20:43 - Option : [2]

--------------------\\ Fin du rapport a 20:43:42

--------------------\\ Lop S&D 4.2.5-0 XP/Vista

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : Intel(R) Celeron(R) M processor 1.50GHz )
BIOS : PhoenixBIOS 4.0 Release 6.1
USER : Francois ( Administrator )
BOOT : Normal boot
Antivirus : Avira AntiVir PersonalEdition Classic 0.0.0.0 (Activated)
C:\ (Local Disk) - FAT32 - Total:26 Go (Free:9 Go)
D:\ (Local Disk) - FAT32 - Total:26 Go (Free:18 Go)
E:\ (CD or DVD)

"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
Option : [2] ( 06/08/2009|20:40 )

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ SUPPRESSION

-
[ Fichier Hosts ] .. Restaure!

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

--------------------\\ Listing des dossiers dans APPLIC~1

[15/10/2004|12:05] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
[15/10/2004|11:51] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

[09/10/2008|22:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
[26/09/2006|16:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AntiVir PersonalEdition Classic
[08/02/2009|18:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Azureus
[05/01/2008|11:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Bluetooth
[14/12/2005|22:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Boldnurbmp3flaw
[31/12/2007|13:39] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Creative
[27/10/2006|12:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
[24/05/2009|16:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
[09/07/2009|10:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
[25/02/2009|18:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
[15/10/2004|11:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[16/03/2007|20:25] C:\DOCUME~1\ALLUSE~1\APPLIC~1\NtiDvdCopy
[01/05/2008|20:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
[20/09/2005|18:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBT
[24/02/2006|21:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ScanSoft
[21/01/2006|11:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
[06/12/2005|16:58] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
[28/01/2006|12:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SSScanAppDataDir
[28/01/2006|12:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SSScanWizard
[17/09/2005|23:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
[26/10/2008|12:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\UDL
[08/08/2006|11:25] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
[11/02/2007|10:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Live Toolbar
[22/11/2007|23:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller

[15/10/2004|11:51] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

[20/04/2009|18:21] C:\DOCUME~1\LOCALS~1\APPLIC~1\Adobe
[15/10/2004|11:51] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

[22/09/2005|12:33] C:\DOCUME~1\FRANCOIS\APPLIC~1\Adobe
[22/09/2005|12:38] C:\DOCUME~1\FRANCOIS\APPLIC~1\AdobeUM
[28/01/2006|12:20] C:\DOCUME~1\FRANCOIS\APPLIC~1\Arcsoft
[01/12/2006|16:07] C:\DOCUME~1\FRANCOIS\APPLIC~1\Azureus
[28/01/2006|12:18] C:\DOCUME~1\FRANCOIS\APPLIC~1\Canon
[31/12/2007|13:43] C:\DOCUME~1\FRANCOIS\APPLIC~1\Creative
[17/09/2005|23:57] C:\DOCUME~1\FRANCOIS\APPLIC~1\CyberLink
[06/01/2008|14:13] C:\DOCUME~1\FRANCOIS\APPLIC~1\dvdcss
[27/10/2006|12:32] C:\DOCUME~1\FRANCOIS\APPLIC~1\Google
[05/12/2005|14:34] C:\DOCUME~1\FRANCOIS\APPLIC~1\Help
[15/10/2004|12:05] C:\DOCUME~1\FRANCOIS\APPLIC~1\Identities
[28/01/2006|12:11] C:\DOCUME~1\FRANCOIS\APPLIC~1\InterTrust
[18/12/2005|20:49] C:\DOCUME~1\FRANCOIS\APPLIC~1\Lavasoft
[22/09/2005|11:25] C:\DOCUME~1\FRANCOIS\APPLIC~1\Macromedia
[09/07/2009|10:03] C:\DOCUME~1\FRANCOIS\APPLIC~1\Malwarebytes
[03/03/2006|16:28] C:\DOCUME~1\FRANCOIS\APPLIC~1\Media Player Classic
[15/10/2004|11:51] C:\DOCUME~1\FRANCOIS\APPLIC~1\Microsoft
[20/09/2005|18:41] C:\DOCUME~1\FRANCOIS\APPLIC~1\Microsoft Web Folders
[12/08/2008|18:37] C:\DOCUME~1\FRANCOIS\APPLIC~1\Mozilla
[06/01/2009|18:46] C:\DOCUME~1\FRANCOIS\APPLIC~1\MP-Manager
[17/03/2006|18:37] C:\DOCUME~1\FRANCOIS\APPLIC~1\MSNInstaller
[03/10/2006|11:28] C:\DOCUME~1\FRANCOIS\APPLIC~1\programsite
[20/12/2007|17:27] C:\DOCUME~1\FRANCOIS\APPLIC~1\Real
[28/01/2006|12:14] C:\DOCUME~1\FRANCOIS\APPLIC~1\ScanSoft
[21/01/2006|11:50] C:\DOCUME~1\FRANCOIS\APPLIC~1\Skype
[13/03/2008|18:19] C:\DOCUME~1\FRANCOIS\APPLIC~1\skypePM
[14/12/2008|12:21] C:\DOCUME~1\FRANCOIS\APPLIC~1\Smart Panel
[05/01/2008|11:16] C:\DOCUME~1\FRANCOIS\APPLIC~1\Sony Corporation
[01/12/2006|16:05] C:\DOCUME~1\FRANCOIS\APPLIC~1\Sun
[17/09/2005|23:52] C:\DOCUME~1\FRANCOIS\APPLIC~1\Symantec
[02/06/2008|21:29] C:\DOCUME~1\FRANCOIS\APPLIC~1\TaoUSign
[14/06/2008|18:53] C:\DOCUME~1\FRANCOIS\APPLIC~1\U3
[20/12/2007|08:00] C:\DOCUME~1\FRANCOIS\APPLIC~1\vlc
[07/07/2009|19:40] C:\DOCUME~1\FRANCOIS\APPLIC~1\WinRAR

--------------------\\ Tâches planifiées dans C:\WINDOWS\tasks

[11/06/2009 10:00][--a------] C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[06/08/2009 19:45][--ah-----] C:\WINDOWS\tasks\SA.DAT
[05/08/2004 05:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini

--------------------\\ Listing des dossiers dans C:\Program Files

[17/09/2005|23:39] C:\Program Files\acer
[06/07/2005|20:04] C:\Program Files\Acer Inc
[06/07/2005|20:03] C:\Program Files\Adobe
[26/09/2006|16:43] C:\Program Files\AntiVir PersonalEdition Classic
[17/09/2005|23:38] C:\Program Files\Arcade
[28/01/2006|12:11] C:\Program Files\ArcSoft
[06/01/2006|18:58] C:\Program Files\Canon
[21/10/2007|12:18] C:\Program Files\Coeur
[27/03/2006|09:33] C:\Program Files\Common Files
[15/10/2004|11:58] C:\Program Files\ComPlus Applications
[06/07/2005|19:59] C:\Program Files\CONEXANT
[31/12/2007|13:35] C:\Program Files\Creative
[06/07/2005|20:03] C:\Program Files\CyberLink
[07/12/2005|20:20] C:\Program Files\directx
[09/07/2007|21:49] C:\Program Files\epson
[15/10/2004|11:52] C:\Program Files\Fichiers communs
[05/01/2008|11:59] C:\Program Files\FlashDiskManager
[28/09/2007|22:37] C:\Program Files\Free
[27/10/2006|12:31] C:\Program Files\Google
[06/07/2005|19:50] C:\Program Files\InstallShield Installation Information
[06/07/2005|19:51] C:\Program Files\Intel
[15/10/2004|11:58] C:\Program Files\Internet Explorer
[05/01/2008|11:25] C:\Program Files\IVT Corporation
[01/12/2006|16:01] C:\Program Files\Java
[29/01/2006|11:21] C:\Program Files\Kerio
[03/03/2006|21:45] C:\Program Files\K-Lite Codec Pack
[06/07/2005|20:00] C:\Program Files\Launch Manager
[24/05/2009|16:09] C:\Program Files\Lavasoft
[19/11/2006|12:14] C:\Program Files\Logitech
[09/07/2009|10:02] C:\Program Files\Malwarebytes' Anti-Malware
[15/10/2004|11:57] C:\Program Files\Messenger
[22/03/2009|15:40] C:\Program Files\Microsoft
[13/05/2007|03:03] C:\Program Files\Microsoft CAPICOM 2.1.0.2
[15/10/2004|12:01] C:\Program Files\microsoft frontpage
[17/09/2005|23:42] C:\Program Files\Microsoft Office
[25/09/2005|12:53] C:\Program Files\Microsoft R‚f‚rence
[22/03/2009|15:48] C:\Program Files\Microsoft Silverlight
[22/11/2007|23:34] C:\Program Files\Microsoft SQL Server Compact Edition
[22/03/2009|15:43] C:\Program Files\Microsoft Sync Framework
[20/09/2005|18:46] C:\Program Files\Microsoft Visual Studio
[17/09/2005|23:42] C:\Program Files\Microsoft Works
[15/10/2004|11:58] C:\Program Files\Movie Maker
[12/08/2008|18:37] C:\Program Files\Mozilla Firefox
[15/10/2004|11:57] C:\Program Files\MSN
[15/10/2004|11:57] C:\Program Files\MSN Gaming Zone
[15/11/2006|03:01] C:\Program Files\MSXML 4.0
[15/10/2004|11:58] C:\Program Files\NetMeeting
[06/07/2005|20:01] C:\Program Files\NewTech Infosystems
[15/10/2004|11:57] C:\Program Files\Online Services
[26/12/2008|15:42] C:\Program Files\OrangeHSS
[15/10/2004|11:58] C:\Program Files\Outlook Express
[01/05/2008|20:44] C:\Program Files\QuickTime
[06/01/2007|10:48] C:\Program Files\Real
[03/12/2006|12:15] C:\Program Files\Samsung
[28/01/2006|12:13] C:\Program Files\ScanSoft
[26/12/2008|15:43] C:\Program Files\Securitoo
[15/10/2004|11:59] C:\Program Files\Services en ligne
[24/10/2007|21:14] C:\Program Files\Skype
[26/10/2008|11:57] C:\Program Files\Smart Panel
[20/09/2005|18:43] C:\Program Files\Snapshot Viewer
[05/01/2008|11:08] C:\Program Files\Sony
[06/12/2005|16:58] C:\Program Files\Spybot - Search & Destroy
[06/07/2005|19:58] C:\Program Files\Synaptics
[25/05/2009|20:59] C:\Program Files\trend micro
[15/10/2004|12:05] C:\Program Files\Uninstall Information
[01/04/2006|15:41] C:\Program Files\VirtualDJ
[08/02/2009|18:58] C:\Program Files\Vuze
[10/08/2007|22:11] C:\Program Files\Windows Live
[22/03/2009|15:40] C:\Program Files\Windows Live SkyDrive
[05/05/2007|20:00] C:\Program Files\Windows Media Connect 2
[15/10/2004|11:57] C:\Program Files\Windows Media Player
[15/10/2004|11:57] C:\Program Files\Windows NT
[15/10/2004|11:59] C:\Program Files\WindowsUpdate
[19/10/2005|20:48] C:\Program Files\WinRAR
[15/10/2004|12:01] C:\Program Files\xerox

--------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs

[22/09/2005|12:33] C:\Program Files\Fichiers communs\Adobe
[09/10/2008|22:51] C:\Program Files\Fichiers communs\Adobe AIR
[20/09/2005|18:46] C:\Program Files\Fichiers communs\Designer
[26/12/2008|15:41] C:\Program Files\Fichiers communs\France Telecom
[08/02/2009|18:58] C:\Program Files\Fichiers communs\i4j_jres
[06/07/2005|19:50] C:\Program Files\Fichiers communs\InstallShield
[07/12/2005|20:17] C:\Program Files\Fichiers communs\Logitech
[15/10/2004|11:52] C:\Program Files\Fichiers communs\Microsoft Shared
[15/10/2004|11:58] C:\Program Files\Fichiers communs\MSSoap
[06/07/2005|20:02] C:\Program Files\Fichiers communs\muvee Technologies
[06/07/2005|20:01] C:\Program Files\Fichiers communs\NewTech Infosystems
[15/10/2004|11:52] C:\Program Files\Fichiers communs\ODBC
[06/01/2007|10:48] C:\Program Files\Fichiers communs\Real
[28/01/2006|12:14] C:\Program Files\Fichiers communs\ScanSoft Shared
[15/10/2004|11:58] C:\Program Files\Fichiers communs\Services
[13/03/2008|18:18] C:\Program Files\Fichiers communs\Skype
[15/10/2004|11:52] C:\Program Files\Fichiers communs\SpeechEngines
[17/09/2005|23:52] C:\Program Files\Fichiers communs\Symantec Shared
[15/10/2004|11:58] C:\Program Files\Fichiers communs\System
[22/03/2009|15:34] C:\Program Files\Fichiers communs\Windows Live
[22/11/2007|23:30] C:\Program Files\Fichiers communs\WindowsLiveInstaller

--------------------\\ Process

( 54 Processes )

... OK !

--------------------\\ Recherche avec S_Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Recherche de Fichiers / Dossiers Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Verification du Registre

..... OK !

--------------------\\ Verification du fichier Hosts

Fichier Hosts PROPRE

--------------------\\ Recherche de fichiers avec Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-06 20:43:14
Windows 5.1.2600 Service Pack 3 FAT NTAPI
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 0

--------------------\\ Recherche d'autres infections

Aucune autre infection trouvée !

[F:3][D:3]-> C:\DOCUME~1\Francois\LOCALS~1\Temp
[F:52][D:0]-> C:\DOCUME~1\Francois\Cookies
[F:125][D:4]-> C:\DOCUME~1\Francois\LOCALS~1\TEMPOR~1\content.IE5
[F:2][D:0]-> C:\Recycled

1 - "C:\Lop SD\LopR_1.txt" - 06/08/2009|20:35 - Option : [1]
2 - "C:\Lop SD\LopR_2.txt" - 06/08/2009|20:43 - Option : [2]

--------------------\\ Fin du rapport a 20:43:42

j'espère que tu as tout,

a +

salut, bonnes vacances si tu pars, voila les infos que tu m'as demandé,

le rapport OTL:

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== SERVICES/DRIVERS ==========
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\ deleted successfully.
========== REGISTRY ==========
========== FILES ==========
C:\WINDOWS\System32\tmp.reg moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\SlantAdj.dll
C:\WINDOWS\SlantAdj.dll NOT unregistered.
C:\WINDOWS\SlantAdj.dll moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: All Users

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 33170 bytes

User: Francois
->Temp folder emptied: 22065 bytes
->Temporary Internet Files folder emptied: 5535612 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
Windows Temp folder emptied: 664 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 5,33 mb

OTL by OldTimer - Version 3.0.10.3 log created on 07302009_172308

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

après, le rapport Malawayre

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== SERVICES/DRIVERS ==========
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}\ deleted successfully.
========== REGISTRY ==========
========== FILES ==========
C:\WINDOWS\System32\tmp.reg moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\SlantAdj.dll
C:\WINDOWS\SlantAdj.dll NOT unregistered.
C:\WINDOWS\SlantAdj.dll moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: All Users

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 33170 bytes

User: Francois
->Temp folder emptied: 22065 bytes
->Temporary Internet Files folder emptied: 5535612 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
Windows Temp folder emptied: 664 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 5,33 mb

OTL by OldTimer - Version 3.0.10.3 log created on 07302009_172308

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

voila un copier coller du rapport kaspersky, désolé pas réussi à trouver le format texte

vendredi 31 juillet 2009
Système d'exploitation : Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Version de Kaspersky Online Scanner : 7.0.26.13
Dernière mise à jour de la base : Thursday, July 30, 2009 22:40:15
Enregistrements dans la base : 2564753

Paramètres d'analyse
analyser avec la base suivante étendue
Analyser les archives oui
Analyser les bases de messagerie oui

Zone d'analyse Poste de travail
C:\
D:\

Statistiques d'analyse
Objets analysés 83130
Menaces trouvées 2
Objets infectés trouvés 6
Objets suspects trouvés 0
Durée d'analyse 03:18:33

Nom de fichier Menace Compteur de menaces
C:\Documents and Settings\All Users\Application Data\Boldnurbmp3flaw\Heck Bash.exe Infecté : not-a-virus:AdWare.Win32.Lop.bb 1

C:\Documents and Settings\All Users\Application Data\Boldnurbmp3flaw\DaleKind.exe Infecté : not-a-virus:AdWare.Win32.Lop.bb 1

C:\Documents and Settings\All Users\Application Data\Boldnurbmp3flaw\Once Remote.exe Infecté : not-a-virus:AdWare.Win32.Lop.bb 1

C:\Documents and Settings\All Users\Application Data\Boldnurbmp3flaw\LICENSE BLEH.exe Infecté : not-a-virus:AdWare.Win32.Lop.bb 1

C:\Documents and Settings\All Users\Application Data\Boldnurbmp3flaw\Logo list.exe Infecté : not-a-virus:AdWare.Win32.Lop.bb 1

C:\Program Files\Common Files\Companion Wizard\WapCHK.dll Infecté : not-a-virus:FraudTool.Win32.WinAntiVirus.2006 1

La zone sélectionnée a été analysée.

Nom de fichier Menace Compteur de menaces
C:\Documents and Settings\All Users\Application Data\Boldnurbmp3flaw\Heck Bash.exe Infecté : not-a-virus:AdWare.Win32.Lop.bb 1

C:\Documents and Settings\All Users\Application Data\Boldnurbmp3flaw\DaleKind.exe Infecté : not-a-virus:AdWare.Win32.Lop.bb 1

C:\Documents and Settings\All Users\Application Data\Boldnurbmp3flaw\Once Remote.exe Infecté : not-a-virus:AdWare.Win32.Lop.bb 1

C:\Documents and Settings\All Users\Application Data\Boldnurbmp3flaw\LICENSE BLEH.exe Infecté : not-a-virus:AdWare.Win32.Lop.bb 1

C:\Documents and Settings\All Users\Application Data\Boldnurbmp3flaw\Logo list.exe Infecté : not-a-virus:AdWare.Win32.Lop.bb 1

C:\Program Files\Common Files\Companion Wizard\WapCHK.dll Infecté : not-a-virus:FraudTool.Win32.WinAntiVirus.2006 1

La zone sélectionnée a été analysée.

pour tools cleaner, par contre j'ai du effacer le premier rapport quand je l'ai relancé une 2è fois,

je te mets le rapport de la 2 é fois,

[ Rapport ToolsCleaner version 2.3.9 (par A.Rothstein & dj QUIOU) ]

--> Recherche:

---------------------------------
--> Suppression:

voila j'attends tes nouvelles quand tu rentres,

a plus

voila le rapport de OTL,

je te joints l'adresse de OTL texte, et il y a aussi un autre fichier "extras" en plus qui s'est ouvert après le fichier texte

http://www.cijoint.fr/cjlink.php?file=cj200907/cijkgAn4k8.txt

le rapport "extras"

http://www.cijoint.fr/cjlink.php?file=cj200907/cijpUfrWJ6.txt

voila

a plus,

dsl mais je ne suis pas très doué,

alors voila le rapport de otl:

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{44F27C0A-1149-7B9A-CCBD-9F091034EC3D}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{44F27C0A-1149-7B9A-CCBD-9F091034EC3D}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\preload deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\SNCT511 deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\WeatherOnTray deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\SpySpotter System Defender deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\NI.UERSV_0001_N68M0602 deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\second load not found.
========== FILES ==========
File\Folder C:\DOCUME~1\FRANCOIS\APPLIC~1\SpamBlocker not found.
C:\Windows\RUNXMLPL.EXE moved successfully.
C:\WINDOWS\system32\tmp.txt moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32768 bytes

User: All Users

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: LocalService
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 2924588 bytes

User: Francois
->Temp folder emptied: 1091902 bytes
->Temporary Internet Files folder emptied: 97645101 bytes
->Java cache emptied: 3359781 bytes
->FireFox cache emptied: 878388 bytes

%systemdrive% .tmp files removed: 0 bytes
C:\WINDOWS\msdownld.tmp folder deleted successfully.
%systemroot% .tmp files removed: 19569 bytes
%systemroot%\System32 .tmp files removed: 3433472 bytes
Windows Temp folder emptied: 2098 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 104,35 mb

OTL by OldTimer - Version 3.0.10.3 log created on 07272009_182207

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

voila j'attends les instructions, et alors qu'est ce que ça dit avec tout ça, ça risque de prendre encore beaucoup de temps?

merci pour les infos,

dsl, mais lorsque je veux telecharger OTL, il m'affiche un message d'erreur, et lorsque je copie colle le contenu malgré ce message d'erreur, ça fait pareil que OTM, il n'y a plus rien qui s'affiche à l'écran et je suis obligé d'éteindre mon ordi manuellement pour qu'il redémarre correctement.
en plus OTL ne s'affiche pas sur le bureau (à cause du message d'erreur je pense)

voila,

merci pour la suite,

salut de retour sur l'ordi,

alors concernant OTM, ça n'a pas marché comme tu souhaitais, lorsque je copie colle le contenu dans la fenetre, l'ordi se ferme et il n'y a plus rien a l'écran... ça l'a déja fait la première fois,

pour les autres rapports, voila les résultats,

.
======= RAPPORT D'AD-REMOVER 1.1.4.5_O | UNIQUEMENT XP/VISTA/SEVEN =======
.
Mit à jour par C_XX le 24/06/2009 à 7:10 PM
Contact: AdRemover.contact@gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Lancé à: 19:51:48, 23/07/2009 | Mode Normal | Option: SCAN
Exécuté de: C:\Program Files\Ad-remover\
Système d'exploitation: Microsoft® Windows XP™ Service Pack 3 v5.1.2600
Nom du PC: FRANCOISPC | Utilisateur actuel: Francois
.
Administrateur: Administrateur
Administrateur: Francois
N'est pas administrateur: HelpAssistant *Desactive*
N'est pas administrateur: Invité *Desactive*
N'est pas administrateur: SUPPORT_388945a0 *Desactive*
.
============== ÉLÉMENT(S) TROUVÉ(S) ==============
.
.
HKCR\SearchSettings.BHO
HKCR\SearchSettings.BHO.1
HKCU\Software\AppDataLow\software\Dealio
HKLM\Software\Classes\SearchSettings.BHO
HKLM\Software\Classes\SearchSettings.BHO.1
HKLM\Software\Dealio
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{0B1AAC97-8563-41D9-AE47-58E6A222F0E1}
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{94C3BB3A-56A1-43DE-A242-8B41F46E97EF}
HKLM\Software\Search Settings
HKU\S-1-5-21-3883549307-3166849312-3284258596-1005\Software\Appdatalow\Software\Dealio
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\SearchSettings
HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
HKLM\Software\Microsoft\Internet Explorer\Toolbar\\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{3041d03e-fd4b-44e0-b742-2d9b88305f98}
HKCR\CLSID\{0702a2b6-13aa-4090-9e01-bcdc85dd933f}
HKLM\Software\Classes\CLSID\{0702a2b6-13aa-4090-9e01-bcdc85dd933f}
HKCR\CLSID\{b0de3308-5d5a-470d-81b9-634fc078393b}
HKLM\Software\Classes\CLSID\{b0de3308-5d5a-470d-81b9-634fc078393b}
HKCR\CLSID\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
HKLM\Software\Classes\CLSID\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
.
C:\DOCUME~1\Francois\APPLIC~1\Dealio
C:\DOCUME~1\Francois\APPLIC~1\Mozilla\Firefox\Profiles\bw429yy2.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}
C:\DOCUME~1\Francois\APPLIC~1\Search Settings
C:\Program Files\Dealio Toolbar
C:\Program Files\Search Settings
C:\WINDOWS\Installer\873d7a.msi
C:\WINDOWS\Installer\873d81.msi
C:\WINDOWS\Prefetch\SEARCHSETTINGS.EXE-30EFBC20.pf
.
============== Scan additionnel ==============
.

* Mozilla FireFox Version 1.5 *

Nom du profil: bw429yy2.default (Francois)
.
(Prefs.js) user_pref("browser.search.defaultenginename", "Google");
(Prefs.js) user_pref("browser.search.selectedEngine", "Google");
(Prefs.js) user_pref("browser.search.defaulturl", "hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=");
.
.

* Internet Explorer Version 8.0.6001.18702 *

[HKEY_CURRENT_USER\..\Internet Explorer\Main]

Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home

[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

Tabs: res://ieframe.dll/tabswelcome.htm
.
===================================
.
3793 Octet(s) - C:\Ad-Report-SCAN.log
.
17 Fichier(s) - C:\DOCUME~1\Francois\LOCALS~1\Temp
5 Fichier(s) - C:\WINDOWS\Temp
.
0 Fichier(s) - C:\Program Files\Ad-remover\BACKUP
0 Fichier(s) - C:\Program Files\Ad-remover\QUARANTINE
.
Fin à: 20:25:03 | 23/07/2009
.
============== E.O.F ==============
.

.
======= RAPPORT D'AD-REMOVER 1.1.4.5_O | UNIQUEMENT XP/VISTA/SEVEN =======
.
Mit à jour par C_XX le 24/06/2009 à 7:10 PM
Contact: AdRemover.contact@gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Lancé à: 21:08:52, 23/07/2009 | Mode Normal | Option: CLEAN
Exécuté de: C:\Program Files\Ad-remover\
Système d'exploitation: Microsoft® Windows XP™ Service Pack 3 v5.1.2600
Nom du PC: FRANCOISPC | Utilisateur actuel: Francois
.
Administrateur: Administrateur
Administrateur: Francois
N'est pas administrateur: HelpAssistant *Desactive*
N'est pas administrateur: Invité *Desactive*
N'est pas administrateur: SUPPORT_388945a0 *Desactive*
.
============== ÉLÉMENT(S) NEUTRALISÉ(S) ==============
.
.
HKCR\SearchSettings.BHO
HKCR\SearchSettings.BHO.1
HKCU\Software\AppDataLow\software\Dealio
HKLM\Software\Dealio
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{0B1AAC97-8563-41D9-AE47-58E6A222F0E1}
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{94C3BB3A-56A1-43DE-A242-8B41F46E97EF}
HKLM\Software\Search Settings
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\SearchSettings
HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
HKLM\Software\Microsoft\Internet Explorer\Toolbar\\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{3041d03e-fd4b-44e0-b742-2d9b88305f98}
HKCR\CLSID\{0702a2b6-13aa-4090-9e01-bcdc85dd933f}
HKCR\CLSID\{b0de3308-5d5a-470d-81b9-634fc078393b}
HKCR\CLSID\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}
.
C:\DOCUME~1\Francois\APPLIC~1\Dealio\temp
C:\DOCUME~1\Francois\APPLIC~1\Dealio\res
C:\DOCUME~1\Francois\APPLIC~1\Dealio\temp\http___www_dealio_com_rss_coupons-deals_dotd_.xml
C:\DOCUME~1\Francois\APPLIC~1\Dealio\res\widgets.xml
C:\DOCUME~1\Francois\APPLIC~1\Dealio
C:\DOCUME~1\Francois\APPLIC~1\Mozilla\Firefox\Profiles\bw429yy2.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\chrome.manifest
C:\DOCUME~1\Francois\APPLIC~1\Mozilla\Firefox\Profiles\bw429yy2.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\chrome.manifest.dev
C:\DOCUME~1\Francois\APPLIC~1\Mozilla\Firefox\Profiles\bw429yy2.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\install.rdf
C:\DOCUME~1\Francois\APPLIC~1\Mozilla\Firefox\Profiles\bw429yy2.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\install.rdf.bak
C:\DOCUME~1\Francois\APPLIC~1\Mozilla\Firefox\Profiles\bw429yy2.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\install.rdf.de-DE
C:\DOCUME~1\Francois\APPLIC~1\Mozilla\Firefox\Profiles\bw429yy2.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\install.rdf.es-ES
C:\DOCUME~1\Francois\APPLIC~1\Mozilla\Firefox\Profiles\bw429yy2.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\install.rdf.fr-FR
C:\DOCUME~1\Francois\APPLIC~1\Mozilla\Firefox\Profiles\bw429yy2.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\install.rdf.it-IT
C:\DOCUME~1\Francois\APPLIC~1\Mozilla\Firefox\Profiles\bw429yy2.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\chrome
C:\DOCUME~1\Francois\APPLIC~1\Mozilla\Firefox\Profiles\bw429yy2.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\defaults
C:\DOCUME~1\Francois\APPLIC~1\Mozilla\Firefox\Profiles\bw429yy2.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\META-INF
C:\DOCUME~1\Francois\APPLIC~1\Mozilla\Firefox\Profiles\bw429yy2.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\chrome\ajtoolbar.jar
C:\DOCUME~1\Francois\APPLIC~1\Mozilla\Firefox\Profiles\bw429yy2.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\defaults\preferences
C:\DOCUME~1\Francois\APPLIC~1\Mozilla\Firefox\Profiles\bw429yy2.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\defaults\preferences\ask.gif
C:\DOCUME~1\Francois\APPLIC~1\Mozilla\Firefox\Profiles\bw429yy2.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\defaults\preferences\ask.src
C:\DOCUME~1\Francois\APPLIC~1\Mozilla\Firefox\Profiles\bw429yy2.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\defaults\preferences\contents.rdf
C:\DOCUME~1\Francois\APPLIC~1\Mozilla\Firefox\Profiles\bw429yy2.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\defaults\preferences\snipit.js
C:\DOCUME~1\Francois\APPLIC~1\Mozilla\Firefox\Profiles\bw429yy2.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\defaults\preferences\config.dat.bak
C:\DOCUME~1\Francois\APPLIC~1\Mozilla\Firefox\Profiles\bw429yy2.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\defaults\preferences\config.dat
C:\DOCUME~1\Francois\APPLIC~1\Mozilla\Firefox\Profiles\bw429yy2.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\META-INF\manifest.mf
C:\DOCUME~1\Francois\APPLIC~1\Mozilla\Firefox\Profiles\bw429yy2.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\META-INF\zigbert.rsa
C:\DOCUME~1\Francois\APPLIC~1\Mozilla\Firefox\Profiles\bw429yy2.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\META-INF\zigbert.sf
C:\DOCUME~1\Francois\APPLIC~1\Mozilla\Firefox\Profiles\bw429yy2.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}
C:\DOCUME~1\Francois\APPLIC~1\Search Settings\kb128
C:\DOCUME~1\Francois\APPLIC~1\Search Settings\kb128\temp
C:\DOCUME~1\Francois\APPLIC~1\Search Settings\kb128\temp\ws-14446.log
C:\DOCUME~1\Francois\APPLIC~1\Search Settings\kb128\temp\ws-14447.log
C:\DOCUME~1\Francois\APPLIC~1\Search Settings\kb128\temp\ws-14448.log
C:\DOCUME~1\Francois\APPLIC~1\Search Settings
C:\Program Files\Dealio Toolbar\Res
C:\Program Files\Dealio Toolbar\WidgiHelper.exe
C:\Program Files\Dealio Toolbar\SearchSettingsKit.exe
C:\Program Files\Dealio Toolbar\DealioToolbarIE.dll
C:\Program Files\Dealio Toolbar\config.ini
C:\Program Files\Dealio Toolbar\Res\amazon.gif
C:\Program Files\Dealio Toolbar\Res\apple.gif
C:\Program Files\Dealio Toolbar\Res\barnes.gif
C:\Program Files\Dealio Toolbar\Res\bestbuy.gif
C:\Program Files\Dealio Toolbar\Res\dealio_logo.gif
C:\Program Files\Dealio Toolbar\Res\dealio_logo_hover.gif
C:\Program Files\Dealio Toolbar\Res\ebay.gif
C:\Program Files\Dealio Toolbar\Res\icon_settings.gif
C:\Program Files\Dealio Toolbar\Res\macys.gif
C:\Program Files\Dealio Toolbar\Res\newegg.gif
C:\Program Files\Dealio Toolbar\Res\overstock.gif
C:\Program Files\Dealio Toolbar\Res\search_amazon.gif
C:\Program Files\Dealio Toolbar\Res\search-button.gif
C:\Program Files\Dealio Toolbar\Res\search-button-hover.gif
C:\Program Files\Dealio Toolbar\Res\search-chevron.gif
C:\Program Files\Dealio Toolbar\Res\search-chevron-hover.gif
C:\Program Files\Dealio Toolbar\Res\search_dealio.gif
C:\Program Files\Dealio Toolbar\Res\search_ebay.gif
C:\Program Files\Dealio Toolbar\Res\search_yahoo.gif
C:\Program Files\Dealio Toolbar\Res\separator.gif
C:\Program Files\Dealio Toolbar\Res\target.gif
C:\Program Files\Dealio Toolbar\Res\walmart.gif
C:\Program Files\Dealio Toolbar\Res\widgets.xml
C:\Program Files\Dealio Toolbar
C:\Program Files\Search Settings\kb128
C:\Program Files\Search Settings\SearchSettings.exe
C:\Program Files\Search Settings\kb128\res
C:\Program Files\Search Settings\kb128\temp
C:\Program Files\Search Settings\kb128\SearchSettings.dll
C:\Program Files\Search Settings\kb128\SearchSettingsRes409.dll
C:\Program Files\Search Settings
C:\WINDOWS\Installer\873d7a.msi
C:\WINDOWS\Installer\873d81.msi
C:\WINDOWS\Prefetch\SEARCHSETTINGS.EXE-30EFBC20.pf

(!) -- Fichiers temporaires supprimés.

.
============== Scan additionnel ==============
.

* Mozilla FireFox Version 1.5 *

Nom du profil: bw429yy2.default (Francois)
.
(Prefs.js) user_pref("browser.search.defaultenginename", "Google");
(Prefs.js) user_pref("browser.search.selectedEngine", "Google");
(Prefs.js) user_pref("browser.search.defaulturl", "hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=");
.
.

* Internet Explorer Version 8.0.6001.18702 *

[HKEY_CURRENT_USER\..\Internet Explorer\Main]

Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://search.msn.com/spbasic.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://fr.msn.com/

[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

Tabs: res://ieframe.dll/tabswelcome.htm
.
===================================
.
4107 Octet(s) - C:\Ad-Report-SCAN.log
9121 Octet(s) - C:\Ad-Report-CLEAN.log
.
8 Fichier(s) - C:\DOCUME~1\Francois\LOCALS~1\Temp
0 Fichier(s) - C:\WINDOWS\Temp
.
18 Fichier(s) - C:\Program Files\Ad-remover\BACKUP
47 Fichier(s) - C:\Program Files\Ad-remover\QUARANTINE
.
Fin à: 21:43:09 | 23/07/2009
.
============== E.O.F ==============
.

Malwarebytes' Anti-Malware 1.39
Version de la base de données: 2421
Windows 5.1.2600 Service Pack 3

23/07/2009 23:10:42
mbam-log-2009-07-23 (23-10-42).txt

Type de recherche: Examen rapide
Eléments examinés: 88596
Temps écoulé: 15 minute(s), 32 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

et le logrsit:

Logfile of random's system information tool 1.06 (written by random/random)
Run by Francois at 2009-07-23 23:12:26
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 7 GB (28%) free of 27 GB
Total RAM: 502 MB (28% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:12:43, on 23/07/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\eManager\anbmServ.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Launch Manager\LaunchAp.exe
C:\Program Files\Launch Manager\PowerKey.exe
C:\Program Files\Launch Manager\HotkeyApp.exe
C:\Program Files\Launch Manager\OSDCtrl.exe
C:\Program Files\Launch Manager\Wbutton.exe
C:\acer\epm\epm-dm.exe
C:\Program Files\Arcade\PCMService.exe
C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\Program Files\acer\eRecovery\Monitor.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\Documents and Settings\Francois\Local Settings\Temporary Internet Files\Content.IE5\2XZR49B7\RSIT[1].exe
C:\Program Files\trend micro\Francois.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\OrangeHSS\SearchURLHook\SearchPageURL.dll
O2 - BHO: Dealio Toolbar - {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - C:\Program Files\Dealio Toolbar\DealioToolbarIE.dll (file missing)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {44F27C0A-1149-7B9A-CCBD-9F091034EC3D} - C:\DOCUME~1\Francois\APPLIC~1\PROGRA~1\base show.exe (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [preload] C:\Windows\RUNXMLPL.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [LaunchAp] "C:\Program Files\Launch Manager\LaunchAp.exe"
O4 - HKLM\..\Run: [PowerKey] "C:\Program Files\Launch Manager\PowerKey.exe"
O4 - HKLM\..\Run: [LManager] "C:\Program Files\Launch Manager\HotkeyApp.exe"
O4 - HKLM\..\Run: [CtrlVol] "C:\Program Files\Launch Manager\CtrlVol.exe"
O4 - HKLM\..\Run: [LMgrOSD] "C:\Program Files\Launch Manager\OSDCtrl.exe"
O4 - HKLM\..\Run: [Wbutton] "C:\Program Files\Launch Manager\Wbutton.exe"
O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Arcade\PCMService.exe"
O4 - HKLM\..\Run: [eRecoveryService] C:\Windows\System32\Check.exe
O4 - HKLM\..\Run: [SNCT511] C:\WINDOWS\vsnct511.exe
O4 - HKLM\..\Run: [WeatherOnTray] C:\Program Files\SpamBlockerUtility\Bin\4.7.1.0\SbWeatherOnTray.exe
O4 - HKLM\..\Run: [SpySpotter System Defender] C:\Program Files\SpySpotter3\Defender.exe -startup
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [NI.UERSV_0001_N68M0602] "C:\Documents and Settings\Francois\Local Settings\Temporary Internet Files\Content.IE5\GZIJ2LM5\ErrorSafeScannerInstall_fr[1].exe" -nag
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [EPSON Stylus DX4000 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBEE.EXE /FU "C:\WINDOWS\TEMP\E_SEE.tmp" /EF "HKLM"
O4 - HKLM\..\Run: [ImgTask] C:\WINDOWS\Imgtask.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [EPSON Stylus CX3600 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P26 "EPSON Stylus CX3600 Series" /O5 "LPT1:" /M "Stylus CX3600"
O4 - HKLM\..\Run: [EPSON Stylus CX3600 Series (Copie 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P36 "EPSON Stylus CX3600 Series (Copie 1)" /O6 "USB003" /M "Stylus CX3600"
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\OrangeHSS\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Outil de détection de support Picture Motion Browser.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: BlueSoleil.lnk = C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15031/CTSUEng.cab
O16 - DPF: {42E1F024-ECC3-456F-B98A-4CE5ACDBF25C} (ActiveFormX Contrôle) - http://ssl-tb.sitadelle.com/...
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-2.0.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15033/CTPID.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{43F93F86-888D-472D-BAC2-2957B93A564F}: NameServer = 212.27.53.252,212.27.54.252
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

salut,

le probleme c'est que je n'ai rien installé sur mon ordi depuis que tu me guides pour le virus, et je ne sais pas pourquoi mais j'ai plein de toollbar qui se sont affichées et je sais pas d'où ça sort !! en plus l'ordi rame de plus en plus au démarrage,

je suis absent qq jours, je n'ai pas mon ordi sur moi, je transmets tes infos demandés dès que je suis de retour

merci quand même !

SALUT, dsl mais peu eu le temps de me consacrer à l'ordi,

tout s'est bien passé, sauf pour le rapport OTM qui ne s'est pas fait, lors de l'analyse j'avais un écran vide et impossible de faire qqchose donc obliger de redémarrer l'ordi et donc pas de rapport,

sinon voila le reste des infos:

Malwarebytes' Anti-Malware 1.38
Version de la base de données: 2397
Windows 5.1.2600 Service Pack 3

09/07/2009 17:59:21
mbam-log-2009-07-09 (17-59-21).txt

Type de recherche: Examen rapide
Eléments examinés: 90306
Temps écoulé: 19 minute(s), 14 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 40
Valeur(s) du Registre infectée(s): 3
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 2

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\sbcoresrv.coreservices (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\sbcoresrv.coreservices.1 (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\sbcoresrv.lfgax (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\sbcoresrv.lfgax.1 (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\sbhostol.mailanim (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\sbhostol.mailanim.1 (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\sbhostol.webmailsend (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\sbhostol.webmailsend.1 (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\sbinstie.sbinstobj (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\sbinstie.sbinstobj.1 (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\sbsrv.coreservices (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\sbsrv.coreservices.1 (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\sbtoolbar.htmlmenuui (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\sbtoolbar.htmlmenuui.1 (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\sbtoolbar.toolbarctl (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\sbtoolbar.toolbarctl.1 (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\spamblockerconfig.application (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\spamblockerconfig.application.1 (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\spamblockerutility.commband (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\spamblockerutility.commband.1 (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\spamblockerutility.sbmain (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\spamblockerutility.sbmain.1 (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{00b498e3-0543-4624-8fde-1caf89a80550} (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{460ac4db-b0de-4626-a0f0-175dd84dcb9b} (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{d9882035-7745-47c7-8d5e-c11178f9c553} (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{e678cbdc-d022-41f5-ab21-c43dfd9dfc3e} (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{ea232a0a-46f8-4d44-a30b-50321518a828} (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{f919fbd3-a96b-4679-af26-f551439bb5fd} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{09f1adac-76d8-4d0f-99a5-5c907dadb988} (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{31a59636-0fa3-4a56-954d-db7ad02840d8} (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3fa917b9-df69-477f-9e4f-b60d929de79f} (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{ed8525ea-2bfc-4440-bd8a-20efb9d5e541} (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b64f4a7c-97c9-11da-8bde-f66bad1e3f3a} (Rogue.WinAntiVirus) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{2178f3fb-2560-458f-bdee-631e2fe0dfe4} (Rogue.WinAntiVirus) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{2d2bee6e-3c9a-4d58-b9ec-458edb28d0f6} (Rogue.DriveCleaner) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6fd31ed6-7c94-4bbc-8e95-f927f4d3a949} (Adware.180Solutions) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\SpamBlockerUtility (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Spam Blocker (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Outlook\Addins\SbHostOL.MailAnim (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\SpamBlockerUtility (Adware.Hotbar) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform\spamblockerutility 4.7.1 (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Exchange\Client\Extensions\spam blocker for ms outlook (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegedit (Hijack.Regedit) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
c:\documents and settings\Francois\Application Data\SpamBlocker (Adware.Hotbar) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
c:\documents and settings\Default User\results.txt (Malware.Trace) -> Quarantined and deleted successfully.
c:\documents and settings\Francois\results.txt (Malware.Trace) -> Quarantined and deleted successfully.

er le logrsit:

Logfile of random's system information tool 1.06 (written by random/random)
Run by Francois at 2009-07-09 18:14:42
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 7 GB (26%) free of 27 GB
Total RAM: 502 MB (21% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:15:15, on 09/07/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\eManager\anbmServ.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Launch Manager\LaunchAp.exe
C:\Program Files\Launch Manager\PowerKey.exe
C:\Program Files\Launch Manager\HotkeyApp.exe
C:\Program Files\Launch Manager\OSDCtrl.exe
C:\Program Files\Launch Manager\Wbutton.exe
C:\acer\epm\epm-dm.exe
C:\Program Files\Arcade\PCMService.exe
C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE
C:\Program Files\Search Settings\SearchSettings.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\Program Files\acer\eRecovery\Monitor.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\Documents and Settings\Francois\Local Settings\Temporary Internet Files\Content.IE5\2XZR49B7\RSIT[1].exe
C:\Program Files\trend micro\Francois.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\OrangeHSS\SearchURLHook\SearchPageURL.dll
R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb128\SearchSettings.dll
O2 - BHO: Dealio Toolbar - {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - C:\Program Files\Dealio Toolbar\DealioToolbarIE.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {44F27C0A-1149-7B9A-CCBD-9F091034EC3D} - C:\DOCUME~1\Francois\APPLIC~1\PROGRA~1\base show.exe (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb128\SearchSettings.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Dealio Toolbar - {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - C:\Program Files\Dealio Toolbar\DealioToolbarIE.dll
O4 - HKLM\..\Run: [preload] C:\Windows\RUNXMLPL.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [LaunchAp] "C:\Program Files\Launch Manager\LaunchAp.exe"
O4 - HKLM\..\Run: [PowerKey] "C:\Program Files\Launch Manager\PowerKey.exe"
O4 - HKLM\..\Run: [LManager] "C:\Program Files\Launch Manager\HotkeyApp.exe"
O4 - HKLM\..\Run: [CtrlVol] "C:\Program Files\Launch Manager\CtrlVol.exe"
O4 - HKLM\..\Run: [LMgrOSD] "C:\Program Files\Launch Manager\OSDCtrl.exe"
O4 - HKLM\..\Run: [Wbutton] "C:\Program Files\Launch Manager\Wbutton.exe"
O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Arcade\PCMService.exe"
O4 - HKLM\..\Run: [eRecoveryService] C:\Windows\System32\Check.exe
O4 - HKLM\..\Run: [SNCT511] C:\WINDOWS\vsnct511.exe
O4 - HKLM\..\Run: [WeatherOnTray] C:\Program Files\SpamBlockerUtility\Bin\4.7.1.0\SbWeatherOnTray.exe
O4 - HKLM\..\Run: [SpySpotter System Defender] C:\Program Files\SpySpotter3\Defender.exe -startup
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [NI.UERSV_0001_N68M0602] "C:\Documents and Settings\Francois\Local Settings\Temporary Internet Files\Content.IE5\GZIJ2LM5\ErrorSafeScannerInstall_fr[1].exe" -nag
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [EPSON Stylus DX4000 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBEE.EXE /FU "C:\WINDOWS\TEMP\E_SEE.tmp" /EF "HKLM"
O4 - HKLM\..\Run: [ImgTask] C:\WINDOWS\Imgtask.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [EPSON Stylus CX3600 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P26 "EPSON Stylus CX3600 Series" /O5 "LPT1:" /M "Stylus CX3600"
O4 - HKLM\..\Run: [EPSON Stylus CX3600 Series (Copie 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P36 "EPSON Stylus CX3600 Series (Copie 1)" /O6 "USB003" /M "Stylus CX3600"
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\OrangeHSS\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\Search Settings\SearchSettings.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Outil de détection de support Picture Motion Browser.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: BlueSoleil.lnk = C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15031/CTSUEng.cab
O16 - DPF: {42E1F024-ECC3-456F-B98A-4CE5ACDBF25C} (ActiveFormX Contrôle) - http://ssl-tb.sitadelle.com/...
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-2.0.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15033/CTPID.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{43F93F86-888D-472D-BAC2-2957B93A564F}: NameServer = 212.27.53.252,212.27.54.252
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

ok merci pour les infos, voila la suite, tout s'est bien passé;

--------------------\\ Lop S&D 4.2.5-0 XP/Vista

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : Intel(R) Celeron(R) M processor 1.50GHz )
BIOS : PhoenixBIOS 4.0 Release 6.1
USER : Francois ( Administrator )
BOOT : Normal boot
Antivirus : Avira AntiVir PersonalEdition Classic 0.0.0.0 (Activated)
C:\ (Local Disk) - FAT32 - Total:26 Go (Free:7 Go)
D:\ (Local Disk) - FAT32 - Total:26 Go (Free:16 Go)
E:\ (CD or DVD)

"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
Option : [2] ( 07/07/2009|17:16 )

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ SUPPRESSION

Supprime! - C:\WINDOWS\Tasks\ADD24E2291A5C54A.job
Supprime! - C:\DOCUME~1\FRANCOIS\APPLIC~1\IdolSupport\gywjkupe.exe
Supprime! - C:\DOCUME~1\FRANCOIS\APPLIC~1\IdolSupport\gjlypmah.exe
Supprime! - C:\DOCUME~1\FRANCOIS\APPLIC~1\IdolSupport\nedxykhk.exe
Supprime! - C:\DOCUME~1\FRANCOIS\APPLIC~1\IdolSupport\ohyuvzmn.exe
Supprime! - C:\DOCUME~1\FRANCOIS\APPLIC~1\IdolSupport\oibsbhrn.exe
Supprime! - C:\DOCUME~1\FRANCOIS\APPLIC~1\IdolSupport
Supprime! - C:\Program Files\IdolSupport

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

--------------------\\ Listing des dossiers dans APPLIC~1

[15/10/2004|12:05] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
[15/10/2004|11:51] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

[24/05/2009|16:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{83C91755-2546-441D-AC40-9A6B4B860800}
[09/10/2008|22:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
[26/09/2006|16:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AntiVir PersonalEdition Classic
[08/02/2009|18:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Azureus
[05/01/2008|11:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Bluetooth
[14/12/2005|22:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Boldnurbmp3flaw
[31/12/2007|13:39] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Creative
[27/10/2006|12:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
[24/05/2009|16:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
[25/02/2009|18:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
[15/10/2004|11:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[16/03/2007|20:25] C:\DOCUME~1\ALLUSE~1\APPLIC~1\NtiDvdCopy
[01/05/2008|20:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
[20/09/2005|18:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBT
[24/02/2006|21:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ScanSoft
[21/01/2006|11:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
[06/12/2005|16:58] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
[28/01/2006|12:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SSScanAppDataDir
[28/01/2006|12:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SSScanWizard
[17/09/2005|23:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
[26/10/2008|12:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\UDL
[08/08/2006|11:25] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
[11/02/2007|10:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Live Toolbar
[22/11/2007|23:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller

[15/10/2004|11:51] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

[20/04/2009|18:21] C:\DOCUME~1\LOCALS~1\APPLIC~1\Adobe
[15/10/2004|11:51] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

[22/09/2005|12:33] C:\DOCUME~1\FRANCOIS\APPLIC~1\Adobe
[22/09/2005|12:38] C:\DOCUME~1\FRANCOIS\APPLIC~1\AdobeUM
[28/01/2006|12:20] C:\DOCUME~1\FRANCOIS\APPLIC~1\Arcsoft
[01/12/2006|16:07] C:\DOCUME~1\FRANCOIS\APPLIC~1\Azureus
[28/01/2006|12:18] C:\DOCUME~1\FRANCOIS\APPLIC~1\Canon
[31/12/2007|13:43] C:\DOCUME~1\FRANCOIS\APPLIC~1\Creative
[17/09/2005|23:57] C:\DOCUME~1\FRANCOIS\APPLIC~1\CyberLink
[06/01/2008|14:13] C:\DOCUME~1\FRANCOIS\APPLIC~1\dvdcss
[27/10/2006|12:32] C:\DOCUME~1\FRANCOIS\APPLIC~1\Google
[05/12/2005|14:34] C:\DOCUME~1\FRANCOIS\APPLIC~1\Help
[15/10/2004|12:05] C:\DOCUME~1\FRANCOIS\APPLIC~1\Identities
[28/01/2006|12:11] C:\DOCUME~1\FRANCOIS\APPLIC~1\InterTrust
[18/12/2005|20:49] C:\DOCUME~1\FRANCOIS\APPLIC~1\Lavasoft
[22/09/2005|11:25] C:\DOCUME~1\FRANCOIS\APPLIC~1\Macromedia
[03/03/2006|16:28] C:\DOCUME~1\FRANCOIS\APPLIC~1\Media Player Classic
[15/10/2004|11:51] C:\DOCUME~1\FRANCOIS\APPLIC~1\Microsoft
[20/09/2005|18:41] C:\DOCUME~1\FRANCOIS\APPLIC~1\Microsoft Web Folders
[12/08/2008|18:37] C:\DOCUME~1\FRANCOIS\APPLIC~1\Mozilla
[06/01/2009|18:46] C:\DOCUME~1\FRANCOIS\APPLIC~1\MP-Manager
[17/03/2006|18:37] C:\DOCUME~1\FRANCOIS\APPLIC~1\MSNInstaller
[03/10/2006|11:28] C:\DOCUME~1\FRANCOIS\APPLIC~1\programsite
[20/12/2007|17:27] C:\DOCUME~1\FRANCOIS\APPLIC~1\Real
[28/01/2006|12:14] C:\DOCUME~1\FRANCOIS\APPLIC~1\ScanSoft
[21/01/2006|11:50] C:\DOCUME~1\FRANCOIS\APPLIC~1\Skype
[13/03/2008|18:19] C:\DOCUME~1\FRANCOIS\APPLIC~1\skypePM
[14/12/2008|12:21] C:\DOCUME~1\FRANCOIS\APPLIC~1\Smart Panel
[05/01/2008|11:16] C:\DOCUME~1\FRANCOIS\APPLIC~1\Sony Corporation
[16/11/2005|20:14] C:\DOCUME~1\FRANCOIS\APPLIC~1\SpamBlocker
[01/12/2006|16:05] C:\DOCUME~1\FRANCOIS\APPLIC~1\Sun
[17/09/2005|23:52] C:\DOCUME~1\FRANCOIS\APPLIC~1\Symantec
[02/06/2008|21:29] C:\DOCUME~1\FRANCOIS\APPLIC~1\TaoUSign
[14/06/2008|18:53] C:\DOCUME~1\FRANCOIS\APPLIC~1\U3
[20/12/2007|08:00] C:\DOCUME~1\FRANCOIS\APPLIC~1\vlc

--------------------\\ Tâches planifiées dans C:\WINDOWS\tasks

[11/06/2009 10:00][--a------] C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[07/07/2009 16:59][--ah-----] C:\WINDOWS\tasks\SA.DAT
[05/08/2004 05:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini

--------------------\\ Listing des dossiers dans C:\Program Files

[17/09/2005|23:39] C:\Program Files\acer
[06/07/2005|20:04] C:\Program Files\Acer Inc
[06/07/2005|20:03] C:\Program Files\Adobe
[26/09/2006|16:43] C:\Program Files\AntiVir PersonalEdition Classic
[17/09/2005|23:38] C:\Program Files\Arcade
[28/01/2006|12:11] C:\Program Files\ArcSoft
[06/01/2006|18:58] C:\Program Files\Canon
[21/10/2007|12:18] C:\Program Files\Coeur
[27/03/2006|09:33] C:\Program Files\Common Files
[15/10/2004|11:58] C:\Program Files\ComPlus Applications
[06/07/2005|19:59] C:\Program Files\CONEXANT
[31/12/2007|13:35] C:\Program Files\Creative
[06/07/2005|20:03] C:\Program Files\CyberLink
[07/12/2005|20:20] C:\Program Files\directx
[09/07/2007|21:49] C:\Program Files\epson
[15/10/2004|11:52] C:\Program Files\Fichiers communs
[05/01/2008|11:59] C:\Program Files\FlashDiskManager
[28/09/2007|22:37] C:\Program Files\Free
[27/10/2006|12:31] C:\Program Files\Google
[06/07/2005|19:50] C:\Program Files\InstallShield Installation Information
[06/07/2005|19:51] C:\Program Files\Intel
[15/10/2004|11:58] C:\Program Files\Internet Explorer
[05/01/2008|11:25] C:\Program Files\IVT Corporation
[01/12/2006|16:01] C:\Program Files\Java
[29/01/2006|11:21] C:\Program Files\Kerio
[03/03/2006|21:45] C:\Program Files\K-Lite Codec Pack
[06/07/2005|20:00] C:\Program Files\Launch Manager
[24/05/2009|16:09] C:\Program Files\Lavasoft
[19/11/2006|12:14] C:\Program Files\Logitech
[15/10/2004|11:57] C:\Program Files\Messenger
[22/03/2009|15:40] C:\Program Files\Microsoft
[13/05/2007|03:03] C:\Program Files\Microsoft CAPICOM 2.1.0.2
[15/10/2004|12:01] C:\Program Files\microsoft frontpage
[17/09/2005|23:42] C:\Program Files\Microsoft Office
[25/09/2005|12:53] C:\Program Files\Microsoft R‚f‚rence
[22/03/2009|15:48] C:\Program Files\Microsoft Silverlight
[22/11/2007|23:34] C:\Program Files\Microsoft SQL Server Compact Edition
[22/03/2009|15:43] C:\Program Files\Microsoft Sync Framework
[20/09/2005|18:46] C:\Program Files\Microsoft Visual Studio
[17/09/2005|23:42] C:\Program Files\Microsoft Works
[15/10/2004|11:58] C:\Program Files\Movie Maker
[12/08/2008|18:37] C:\Program Files\Mozilla Firefox
[15/10/2004|11:57] C:\Program Files\MSN
[15/10/2004|11:57] C:\Program Files\MSN Gaming Zone
[15/11/2006|03:01] C:\Program Files\MSXML 4.0
[06/07/2009|21:44] C:\Program Files\Navilog1
[15/10/2004|11:58] C:\Program Files\NetMeeting
[06/07/2005|20:01] C:\Program Files\NewTech Infosystems
[15/10/2004|11:57] C:\Program Files\Online Services
[26/12/2008|15:42] C:\Program Files\OrangeHSS
[15/10/2004|11:58] C:\Program Files\Outlook Express
[01/05/2008|20:44] C:\Program Files\QuickTime
[06/01/2007|10:48] C:\Program Files\Real
[03/12/2006|12:15] C:\Program Files\Samsung
[28/01/2006|12:13] C:\Program Files\ScanSoft
[26/12/2008|15:43] C:\Program Files\Securitoo
[15/10/2004|11:59] C:\Program Files\Services en ligne
[24/10/2007|21:14] C:\Program Files\Skype
[26/10/2008|11:57] C:\Program Files\Smart Panel
[20/09/2005|18:43] C:\Program Files\Snapshot Viewer
[05/01/2008|11:08] C:\Program Files\Sony
[06/12/2005|16:58] C:\Program Files\Spybot - Search & Destroy
[06/07/2005|19:58] C:\Program Files\Synaptics
[25/05/2009|20:59] C:\Program Files\trend micro
[15/10/2004|12:05] C:\Program Files\Uninstall Information
[01/04/2006|15:41] C:\Program Files\VirtualDJ
[08/02/2009|18:58] C:\Program Files\Vuze
[10/08/2007|22:11] C:\Program Files\Windows Live
[22/03/2009|15:40] C:\Program Files\Windows Live SkyDrive
[05/05/2007|20:00] C:\Program Files\Windows Media Connect 2
[15/10/2004|11:57] C:\Program Files\Windows Media Player
[15/10/2004|11:57] C:\Program Files\Windows NT
[15/10/2004|11:59] C:\Program Files\WindowsUpdate
[19/10/2005|20:48] C:\Program Files\WinRAR
[15/10/2004|12:01] C:\Program Files\xerox

--------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs

[22/09/2005|12:33] C:\Program Files\Fichiers communs\Adobe
[09/10/2008|22:51] C:\Program Files\Fichiers communs\Adobe AIR
[20/09/2005|18:46] C:\Program Files\Fichiers communs\Designer
[26/12/2008|15:41] C:\Program Files\Fichiers communs\France Telecom
[08/02/2009|18:58] C:\Program Files\Fichiers communs\i4j_jres
[06/07/2005|19:50] C:\Program Files\Fichiers communs\InstallShield
[07/12/2005|20:17] C:\Program Files\Fichiers communs\Logitech
[15/10/2004|11:52] C:\Program Files\Fichiers communs\Microsoft Shared
[15/10/2004|11:58] C:\Program Files\Fichiers communs\MSSoap
[06/07/2005|20:02] C:\Program Files\Fichiers communs\muvee Technologies
[06/07/2005|20:01] C:\Program Files\Fichiers communs\NewTech Infosystems
[15/10/2004|11:52] C:\Program Files\Fichiers communs\ODBC
[06/01/2007|10:48] C:\Program Files\Fichiers communs\Real
[28/01/2006|12:14] C:\Program Files\Fichiers communs\ScanSoft Shared
[15/10/2004|11:58] C:\Program Files\Fichiers communs\Services
[13/03/2008|18:18] C:\Program Files\Fichiers communs\Skype
[15/10/2004|11:52] C:\Program Files\Fichiers communs\SpeechEngines
[17/09/2005|23:52] C:\Program Files\Fichiers communs\Symantec Shared
[15/10/2004|11:58] C:\Program Files\Fichiers communs\System
[22/03/2009|15:34] C:\Program Files\Fichiers communs\Windows Live
[22/11/2007|23:30] C:\Program Files\Fichiers communs\WindowsLiveInstaller

--------------------\\ Process

( 54 Processes )

... OK !

--------------------\\ Recherche avec S_Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Recherche de Fichiers / Dossiers Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Verification du Registre

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

..... OK !

--------------------\\ Verification du fichier Hosts

Fichier Hosts PROPRE

--------------------\\ Recherche de fichiers avec Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-07 17:19:21
Windows 5.1.2600 Service Pack 3 FAT NTAPI
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 0

--------------------\\ Recherche d'autres infections

--------------------\\ ROGUES ..

C:\DOCUME~1\FRANCOIS\APPLIC~1\SpamBlocker

[F:2][D:4]-> C:\DOCUME~1\Francois\LOCALS~1\Temp
[F:22][D:0]-> C:\DOCUME~1\Francois\Cookies
[F:222][D:24]-> C:\DOCUME~1\Francois\LOCALS~1\TEMPOR~1\content.IE5
[F:4][D:0]-> C:\Recycled

1 - "C:\Lop SD\LopR_1.txt" - 07/07/2009|17:20 - Option : [2]

--------------------\\ Fin du rapport a 17:20:19

[b]SDFix: Version 1.240 /b
Run by Francois on 07/07/2009 at 19:29

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services /b:

Restoring Default Security Values
Restoring Default Hosts File

Rebooting

[b]Checking Files /b:

No Trojan Files Found

Removing Temp Files

[b]ADS Check /b:

[b]Final Check /b:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-07 19:45:38
Windows 5.1.2600 Service Pack 3 FAT NTAPI

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

[b]Remaining Services /b:

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"="C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe:*:Enabled:BlueSoleil"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"
"C:\\Program Files\\OrangeHSS\\Connectivity\\ConnectivityManager.exe"="C:\\Program Files\\OrangeHSS\\Connectivity\\ConnectivityManager.exe:*:enabled:CSS"
"D:\\eMule\\emule.exe"="D:\\eMule\\emule.exe:*:Enabled:eMule"
"C:\\Program Files\\Vuze\\Azureus.exe"="C:\\Program Files\\Vuze\\Azureus.exe:*:Enabled:Azureus"
"C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"="C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"="C:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe:*:Enabled:Windows Live Sync"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"="C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"="C:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe:*:Enabled:Windows Live Sync"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"

[b]Remaining Files /b:

[b]Files with Hidden Attributes /b:

Wed 6 Jul 2005 1,024 ...HR --- "C:\WINDOWS\system32\NTICDMK7.dll"
Wed 6 Jul 2005 1,024 ...HR --- "C:\WINDOWS\system32\NTIMPEG2.dll"
Wed 6 Jul 2005 1,024 ...HR --- "C:\WINDOWS\system32\NTIMP3.dll"
Wed 6 Jul 2005 1,024 ...HR --- "C:\WINDOWS\system32\NTIFCD3.dll"
Wed 6 Jul 2005 1,024 ...HR --- "C:\WINDOWS\system32\NTIBUN4.dll"
Thu 29 Sep 2005 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Thu 29 Sep 2005 401 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv19.bak"
Sat 5 May 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp"
Thu 14 Jun 2007 22,641,152 ...H. --- "C:\Documents and Settings\Francois\Application Data\Microsoft\Word\~WRL1535.tmp"
Tue 23 Oct 2007 3,350,528 A..H. --- "C:\Documents and Settings\Francois\Application Data\U3\temp\Launchpad Removal.exe"

[b]Finished!/b

le rapport logrsit:

Logfile of random's system information tool 1.06 (written by random/random)
Run by Francois at 2009-07-07 20:45:14
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 7 GB (26%) free of 27 GB
Total RAM: 502 MB (22% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:45:52, on 07/07/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\eManager\anbmServ.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Launch Manager\LaunchAp.exe
C:\Program Files\Launch Manager\PowerKey.exe
C:\Program Files\Launch Manager\HotkeyApp.exe
C:\Program Files\Launch Manager\OSDCtrl.exe
C:\Program Files\Launch Manager\Wbutton.exe
C:\acer\epm\epm-dm.exe
C:\Program Files\Arcade\PCMService.exe
C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\Program Files\acer\eRecovery\Monitor.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\Documents and Settings\Francois\Local Settings\Temporary Internet Files\Content.IE5\2XZR49B7\RSIT[1].exe
C:\Program Files\trend micro\Francois.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\OrangeHSS\SearchURLHook\SearchPageURL.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {44F27C0A-1149-7B9A-CCBD-9F091034EC3D} - C:\DOCUME~1\Francois\APPLIC~1\PROGRA~1\base show.exe (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [preload] C:\Windows\RUNXMLPL.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [LaunchAp] "C:\Program Files\Launch Manager\LaunchAp.exe"
O4 - HKLM\..\Run: [PowerKey] "C:\Program Files\Launch Manager\PowerKey.exe"
O4 - HKLM\..\Run: [LManager] "C:\Program Files\Launch Manager\HotkeyApp.exe"
O4 - HKLM\..\Run: [CtrlVol] "C:\Program Files\Launch Manager\CtrlVol.exe"
O4 - HKLM\..\Run: [LMgrOSD] "C:\Program Files\Launch Manager\OSDCtrl.exe"
O4 - HKLM\..\Run: [Wbutton] "C:\Program Files\Launch Manager\Wbutton.exe"
O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Arcade\PCMService.exe"
O4 - HKLM\..\Run: [eRecoveryService] C:\Windows\System32\Check.exe
O4 - HKLM\..\Run: [SNCT511] C:\WINDOWS\vsnct511.exe
O4 - HKLM\..\Run: [WeatherOnTray] C:\Program Files\SpamBlockerUtility\Bin\4.7.1.0\SbWeatherOnTray.exe
O4 - HKLM\..\Run: [SpySpotter System Defender] C:\Program Files\SpySpotter3\Defender.exe -startup
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [NI.UERSV_0001_N68M0602] "C:\Documents and Settings\Francois\Local Settings\Temporary Internet Files\Content.IE5\GZIJ2LM5\ErrorSafeScannerInstall_fr[1].exe" -nag
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [EPSON Stylus DX4000 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBEE.EXE /FU "C:\WINDOWS\TEMP\E_SEE.tmp" /EF "HKLM"
O4 - HKLM\..\Run: [ImgTask] C:\WINDOWS\Imgtask.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [EPSON Stylus CX3600 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P26 "EPSON Stylus CX3600 Series" /O5 "LPT1:" /M "Stylus CX3600"
O4 - HKLM\..\Run: [EPSON Stylus CX3600 Series (Copie 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P36 "EPSON Stylus CX3600 Series (Copie 1)" /O6 "USB003" /M "Stylus CX3600"
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\OrangeHSS\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Outil de détection de support Picture Motion Browser.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: BlueSoleil.lnk = C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15031/CTSUEng.cab
O16 - DPF: {42E1F024-ECC3-456F-B98A-4CE5ACDBF25C} (ActiveFormX Contrôle) - http://ssl-tb.sitadelle.com/...
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-2.0.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15033/CTPID.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{43F93F86-888D-472D-BAC2-2957B93A564F}: NameServer = 212.27.53.252,212.27.54.252
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

salut doc,

voila les rapports, pas sure d'avoir bien réalisé le mode sans echec..., à toi de voir,

Fix Navipromo version 4.0.0 commencé le 06/07/2009 à 21:45:39,53

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!

Outil exécuté depuis C:\Program Files\navilog1

Mise à jour le 19.06.2009 à 20h00 par IL-MAFIOSO

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : Intel(R) Celeron(R) M processor 1.50GHz )
BIOS : PhoenixBIOS 4.0 Release 6.1
USER : Francois ( Administrator )
BOOT : Normal boot

Antivirus : Avira AntiVir PersonalEdition Classic 0.0.0.0 (Activated)

C:\ (Local Disk) - FAT32 - Total:26 Go (Free:7 Go)
D:\ (Local Disk) - FAT32 - Total:26 Go (Free:16 Go)
E:\ (CD or DVD)

Recherche exécutée en mode normal

Nettoyage exécuté au redémarrage de l'ordinateur

C:\Documents and Settings\Francois\locals~1\applic~1\seaem.dat supprimé !
C:\Documents and Settings\Francois\locals~1\applic~1\seaem_nav.dat supprimé !
C:\Documents and Settings\Francois\locals~1\applic~1\seaem_navps.dat supprimé !

Nettoyage contenu C:\WINDOWS\Temp effectué !
Nettoyage contenu C:\Documents and Settings\Francois\locals~1\Temp effectué !

*** Sauvegarde du Registre vers dossier Safebackup ***

sauvegarde du Registre réalisée avec succès !

*** Nettoyage Registre ***

Nettoyage Registre Ok

Certificat Electronic-Group supprimé !
Certificat OOO-Favorit supprimé !

C:\WINDOWS\Tasks\ADD24E2291A5C54A.job trouvé ! Infection Lop possible non traitée par cet outil !

*** Scan terminé le 06/07/2009 à 22:00:17,79 ***

SmitFraudFix v2.423

Rapport fait à 22:20:45,96, 06/07/2009
Executé à partir de C:\Documents and Settings\Francois\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\eManager\anbmServ.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Launch Manager\LaunchAp.exe
C:\Program Files\Launch Manager\PowerKey.exe
C:\Program Files\Launch Manager\HotkeyApp.exe
C:\Program Files\Launch Manager\OSDCtrl.exe
C:\Program Files\Launch Manager\Wbutton.exe
C:\acer\epm\epm-dm.exe
C:\Program Files\Arcade\PCMService.exe
C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\Program Files\acer\eRecovery\Monitor.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\Documents and Settings\Francois\Bureau\SmitfraudFix\Policies.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Francois

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Francois\LOCALS~1\Temp

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Francois\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\FRANCOIS\FAVORIS

»»»»»»»»»»»»»»»»»»»»»»»» Bureau

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

C:\Program Files\PowerCodec\ PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"

»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{f31aee4a-1530-4fef-8537-79c6973bff9a}"="gaonic"

[HKEY_CLASSES_ROOT\CLSID\{f31aee4a-1530-4fef-8537-79c6973bff9a}\InProcServer32]
@="C:\WINDOWS\system32\tazth.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{f31aee4a-1530-4fef-8537-79c6973bff9a}\InProcServer32]
@="C:\WINDOWS\system32\tazth.dll"

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"

»»»»»»»»»»»»»»»»»»»»»»»» RK

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Carte réseau Broadcom 802.11g - Miniport d'ordonnancement de paquets
DNS Server Search Order: 212.27.53.252
DNS Server Search Order: 212.27.54.252

HKLM\SYSTEM\CCS\Services\Tcpip\..\{43F93F86-888D-472D-BAC2-2957B93A564F}: DhcpNameServer=212.27.40.240 212.27.40.241
HKLM\SYSTEM\CCS\Services\Tcpip\..\{43F93F86-888D-472D-BAC2-2957B93A564F}: NameServer=212.27.53.252,212.27.54.252
HKLM\SYSTEM\CS1\Services\Tcpip\..\{43F93F86-888D-472D-BAC2-2957B93A564F}: DhcpNameServer=212.27.40.240 212.27.40.241
HKLM\SYSTEM\CS1\Services\Tcpip\..\{43F93F86-888D-472D-BAC2-2957B93A564F}: NameServer=212.27.53.252,212.27.54.252
HKLM\SYSTEM\CS3\Services\Tcpip\..\{43F93F86-888D-472D-BAC2-2957B93A564F}: DhcpNameServer=212.27.40.240 212.27.40.241
HKLM\SYSTEM\CS3\Services\Tcpip\..\{43F93F86-888D-472D-BAC2-2957B93A564F}: NameServer=212.27.53.252,212.27.54.252
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.240 212.27.40.241
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.240 212.27.40.241
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.240 212.27.40.241

»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

»»»»»»»»»»»»»»»»»»»»»»»» Fin

SmitFraudFix v2.423

Rapport fait à 22:27:12,78, 06/07/2009
Executé à partir de C:\Documents and Settings\Francois\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{f31aee4a-1530-4fef-8537-79c6973bff9a}"="gaonic"

[HKEY_CLASSES_ROOT\CLSID\{f31aee4a-1530-4fef-8537-79c6973bff9a}\InProcServer32]
@="C:\WINDOWS\system32\tazth.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{f31aee4a-1530-4fef-8537-79c6973bff9a}\InProcServer32]
@="C:\WINDOWS\system32\tazth.dll"

»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus

»»»»»»»»»»»»»»»»»»»»»»»» hosts

127.0.0.1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés

C:\Program Files\PowerCodec\ supprimé

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» 404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» RK

»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Carte réseau Broadcom 802.11g - Miniport d'ordonnancement de paquets
DNS Server Search Order: 212.27.53.252
DNS Server Search Order: 212.27.54.252

HKLM\SYSTEM\CCS\Services\Tcpip\..\{43F93F86-888D-472D-BAC2-2957B93A564F}: DhcpNameServer=212.27.40.240 212.27.40.241
HKLM\SYSTEM\CCS\Services\Tcpip\..\{43F93F86-888D-472D-BAC2-2957B93A564F}: NameServer=212.27.53.252,212.27.54.252
HKLM\SYSTEM\CS1\Services\Tcpip\..\{43F93F86-888D-472D-BAC2-2957B93A564F}: DhcpNameServer=212.27.40.240 212.27.40.241
HKLM\SYSTEM\CS1\Services\Tcpip\..\{43F93F86-888D-472D-BAC2-2957B93A564F}: NameServer=212.27.53.252,212.27.54.252
HKLM\SYSTEM\CS3\Services\Tcpip\..\{43F93F86-888D-472D-BAC2-2957B93A564F}: DhcpNameServer=212.27.40.240 212.27.40.241
HKLM\SYSTEM\CS3\Services\Tcpip\..\{43F93F86-888D-472D-BAC2-2957B93A564F}: NameServer=212.27.53.252,212.27.54.252
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.240 212.27.40.241
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.240 212.27.40.241
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=212.27.40.240 212.27.40.241

»»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» RK.2

»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre

Nettoyage terminé.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Après SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Fin

le rapport logrsit

Logfile of random's system information tool 1.06 (written by random/random)
Run by Francois at 2009-07-06 22:35:21
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 7 GB (27%) free of 27 GB
Total RAM: 502 MB (33% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:35:45, on 06/07/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\eManager\anbmServ.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Launch Manager\LaunchAp.exe
C:\Program Files\Launch Manager\PowerKey.exe
C:\Program Files\Launch Manager\HotkeyApp.exe
C:\Program Files\Launch Manager\OSDCtrl.exe
C:\Program Files\Launch Manager\Wbutton.exe
C:\acer\epm\epm-dm.exe
C:\Program Files\Arcade\PCMService.exe
C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\Program Files\acer\eRecovery\Monitor.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\WINDOWS\system32\cmd.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Francois\Local Settings\Temporary Internet Files\Content.IE5\2XZR49B7\RSIT[1].exe
C:\Program Files\trend micro\Francois.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\OrangeHSS\SearchURLHook\SearchPageURL.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {44F27C0A-1149-7B9A-CCBD-9F091034EC3D} - C:\DOCUME~1\Francois\APPLIC~1\PROGRA~1\base show.exe (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [preload] C:\Windows\RUNXMLPL.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [LaunchAp] "C:\Program Files\Launch Manager\LaunchAp.exe"
O4 - HKLM\..\Run: [PowerKey] "C:\Program Files\Launch Manager\PowerKey.exe"
O4 - HKLM\..\Run: [LManager] "C:\Program Files\Launch Manager\HotkeyApp.exe"
O4 - HKLM\..\Run: [CtrlVol] "C:\Program Files\Launch Manager\CtrlVol.exe"
O4 - HKLM\..\Run: [LMgrOSD] "C:\Program Files\Launch Manager\OSDCtrl.exe"
O4 - HKLM\..\Run: [Wbutton] "C:\Program Files\Launch Manager\Wbutton.exe"
O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Arcade\PCMService.exe"
O4 - HKLM\..\Run: [eRecoveryService] C:\Windows\System32\Check.exe
O4 - HKLM\..\Run: [SNCT511] C:\WINDOWS\vsnct511.exe
O4 - HKLM\..\Run: [WeatherOnTray] C:\Program Files\SpamBlockerUtility\Bin\4.7.1.0\SbWeatherOnTray.exe
O4 - HKLM\..\Run: [SpySpotter System Defender] C:\Program Files\SpySpotter3\Defender.exe -startup
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [NI.UERSV_0001_N68M0602] "C:\Documents and Settings\Francois\Local Settings\Temporary Internet Files\Content.IE5\GZIJ2LM5\ErrorSafeScannerInstall_fr[1].exe" -nag
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [EPSON Stylus DX4000 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBEE.EXE /FU "C:\WINDOWS\TEMP\E_SEE.tmp" /EF "HKLM"
O4 - HKLM\..\Run: [ImgTask] C:\WINDOWS\Imgtask.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [EPSON Stylus CX3600 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P26 "EPSON Stylus CX3600 Series" /O5 "LPT1:" /M "Stylus CX3600"
O4 - HKLM\..\Run: [EPSON Stylus CX3600 Series (Copie 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P36 "EPSON Stylus CX3600 Series (Copie 1)" /O6 "USB003" /M "Stylus CX3600"
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\OrangeHSS\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [second load] C:\DOCUME~1\Francois\APPLIC~1\IDOLSU~1\DrvWay.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Outil de détection de support Picture Motion Browser.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: BlueSoleil.lnk = C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15031/CTSUEng.cab
O16 - DPF: {42E1F024-ECC3-456F-B98A-4CE5ACDBF25C} (ActiveFormX Contrôle) - http://ssl-tb.sitadelle.com/...
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-2.0.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15033/CTPID.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{43F93F86-888D-472D-BAC2-2957B93A564F}: NameServer = 212.27.53.252,212.27.54.252
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

c'était long cette analyse ....

au fait j'utilise une clé USB mais que je n'ai pas là, sinon pas de disque dur externe, etc,

voila les rapports :

############################## | FindyKill V6.001 |

# User : Francois (Administrateurs) # FRANCOISPC
# Update on 30/06/09 by Chiquitine29 & C_XX
# Start at: 17:51:17 | 03/07/2009
# Website : http://pagesperso-orange.fr/NosTools/index.html

# Intel(R) Celeron(R) M processor 1.50GHz
# Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 8.0.6001.18702
# Windows Firewall Status : Enabled
# AV : Avira AntiVir PersonalEdition Classic 0.0.0.0 [ Enabled | Updated ]
# AV : Avira AntiVir PersonalEdition Classic 0.0.0.0 [ Enabled | Updated ]
# AV : Avira AntiVir PersonalEdition Classic 0.0.0.0 [ Enabled | Updated ]
# AV : Avira AntiVir PersonalEdition 8.0.1.30 [ Enabled | (!) Outdated ]
# AV : Avira AntiVir PersonalEdition Classic 7.0.1.75
[ Enabled | Updated ]
# AV : Avira AntiVir PersonalEdition Classic 7.0.3.61
[ Enabled | Updated ]
# AV : Avira AntiVir PersonalEdition Classic 0.0.0.0 [ Enabled | Updated ]

# C:\ # Disque fixe local # 26,51 Go (5,78 Go free) [ACER] # FAT32
# D:\ # Disque fixe local # 26,91 Go (16,2 Go free) [ACERDATA] # FAT32
# E:\ # Disque CD-ROM

############################## | Processus actifs |

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Acer\eManager\anbmServ.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## | Fichiers # Dossiers infectieux |

Supprimé ! C:\WINDOWS\system32\autorun.ini

################## | C:\Documents and Settings\Francois\Temporary Internet Files |

################## | All Drives ... |

Supprimé ! D:\autorun.inf

################## | Autres ... |

################## | Registre # Clés Run infectieuses |

################## | Registre # Mountpoints2 |

Supprimé ! HKCU\...\Explorer\MountPoints2\{37e58578-ac05-11dc-8a96-0014a42772d6}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{9a5209c6-dc19-11dd-8c19-0014a42772d6}\Shell\Auto\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{d848e714-5992-11dd-8b8f-001167716b82}\Shell\AutoRun\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{de52edd8-31be-11da-8677-0014a42772d6}\Shell\Auto\Command
Supprimé ! HKCU\...\Explorer\MountPoints2\{f5001f68-8f9d-11db-892a-0014a42772d6}\Shell\AutoRun\Command

################## | Listing des fichiers présent |

[03/07/2009 17:48|--a------|5372] - C:\aaw7boot.log
[25/03/2007 13:39|--a------|115208] - C:\SNCT511.RAW
[15/10/2004 11:41|---hs----|512] - C:\BOOTSECT.DOS
[05/08/2004 05:00|-rahs----|4952] - C:\Bootfont.bin
[01/09/2008 09:56|-rahs----|252240] - C:\ntldr
[05/08/2004 05:00|-rahs----|47564] - C:\NTDETECT.COM
[25/09/2005 16:55|-rahs----|216] - C:\boot.ini
[08/07/2005 16:33|-rahs----|65] - C:\PRELOAD.AAA
[06/07/2005 19:40|--a------|4] - C:\wps.dat
[06/07/2005 19:50|--a------|167] - C:\bcmwl5.log
[08/07/2005 16:33|-rahs----|65] - C:\PRELOAD.REV
[22/07/2005 10:27|--ahs----|609] - C:\PATCH.REV
[11/04/2007 18:25|--a------|0] - C:\rollback.ini
[||] - C:\hiberfil.sys
[19/11/2006 12:15|--a------|183] - C:\LogiSetup.log
[03/07/2009 17:12|--a------|3182] - C:\TB.txt
[03/07/2009 18:41|--a------|4000] - C:\FindyKill.txt
[25/09/2005 12:52|-rahs----|0] - C:\MSDOS.SYS
[25/09/2005 12:52|-rahs----|0] - C:\IO.SYS
[||] - C:\pagefile.sys
[03/03/2006 13:07|--a------|2624] - C:\NEW.STA
[03/10/2006 11:01|--a------|16277288] - D:\Install_Messenger.exe
[13/04/2008 19:34|--a------|28672] - D:\setupSNK.exe

################## | Vaccination |

# C:\autorun.inf ( # Not infected ) -> Folder created by FindyKill.
# D:\autorun.inf ( # Not infected ) -> Folder created by FindyKill.

################## | Etat / Services / Informations |

# Mode sans echec : OK

# Affichage des fichiers cachés : OK

# Ndisuio -> Start = 3 ( Good = 3 | Bad = 4 )
# EapHost -> Start = 2 ( Good = 2 | Bad = 4 )
# Ip6Fw -> Start = 2 ( Good = 2 | Bad = 4 )
# SharedAccess -> Start = 2 ( Good = 2 | Bad = 4 )
# wuauserv -> Start = 2 ( Good = 2 | Bad = 4 )
# wscsvc -> Start = 2 ( Good = 2 | Bad = 4 )

################## | PEH ... |

################## | Cracks / Keygens / Serials |

################## | ! Fin du rapport # FindyKill V6.001 ! |

l'autre raport logrsit

Logfile of random's system information tool 1.06 (written by random/random)
Run by Francois at 2009-07-03 18:53:42
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 7 GB (27%) free of 27 GB
Total RAM: 502 MB (20% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:54:07, on 03/07/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\eManager\anbmServ.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\Documents and Settings\Francois\Local Settings\Temporary Internet Files\Content.IE5\IQHBEVAG\RSIT[1].exe
C:\Program Files\trend micro\Francois.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\OrangeHSS\SearchURLHook\SearchPageURL.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {44F27C0A-1149-7B9A-CCBD-9F091034EC3D} - C:\DOCUME~1\Francois\APPLIC~1\PROGRA~1\base show.exe (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [preload] C:\Windows\RUNXMLPL.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [LaunchAp] "C:\Program Files\Launch Manager\LaunchAp.exe"
O4 - HKLM\..\Run: [PowerKey] "C:\Program Files\Launch Manager\PowerKey.exe"
O4 - HKLM\..\Run: [LManager] "C:\Program Files\Launch Manager\HotkeyApp.exe"
O4 - HKLM\..\Run: [CtrlVol] "C:\Program Files\Launch Manager\CtrlVol.exe"
O4 - HKLM\..\Run: [LMgrOSD] "C:\Program Files\Launch Manager\OSDCtrl.exe"
O4 - HKLM\..\Run: [Wbutton] "C:\Program Files\Launch Manager\Wbutton.exe"
O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Arcade\PCMService.exe"
O4 - HKLM\..\Run: [eRecoveryService] C:\Windows\System32\Check.exe
O4 - HKLM\..\Run: [SNCT511] C:\WINDOWS\vsnct511.exe
O4 - HKLM\..\Run: [WeatherOnTray] C:\Program Files\SpamBlockerUtility\Bin\4.7.1.0\SbWeatherOnTray.exe
O4 - HKLM\..\Run: [SpySpotter System Defender] C:\Program Files\SpySpotter3\Defender.exe -startup
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [NI.UERSV_0001_N68M0602] "C:\Documents and Settings\Francois\Local Settings\Temporary Internet Files\Content.IE5\GZIJ2LM5\ErrorSafeScannerInstall_fr[1].exe" -nag
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [EPSON Stylus DX4000 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBEE.EXE /FU "C:\WINDOWS\TEMP\E_SEE.tmp" /EF "HKLM"
O4 - HKLM\..\Run: [ImgTask] C:\WINDOWS\Imgtask.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [EPSON Stylus CX3600 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P26 "EPSON Stylus CX3600 Series" /O5 "LPT1:" /M "Stylus CX3600"
O4 - HKLM\..\Run: [EPSON Stylus CX3600 Series (Copie 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P36 "EPSON Stylus CX3600 Series (Copie 1)" /O6 "USB003" /M "Stylus CX3600"
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\OrangeHSS\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [second load] C:\DOCUME~1\Francois\APPLIC~1\IDOLSU~1\DrvWay.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [seaem] "c:\documents and settings\francois\local settings\application data\seaem.exe" seaem
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Outil de détection de support Picture Motion Browser.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: BlueSoleil.lnk = C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15031/CTSUEng.cab
O16 - DPF: {42E1F024-ECC3-456F-B98A-4CE5ACDBF25C} (ActiveFormX Contrôle) - http://ssl-tb.sitadelle.com/...
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-2.0.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15033/CTPID.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{43F93F86-888D-472D-BAC2-2957B93A564F}: NameServer = 212.27.53.252,212.27.54.252
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O21 - SSODL: gaonic - {f31aee4a-1530-4fef-8537-79c6973bff9a} - C:\WINDOWS\system32\tazth.dll (file missing)
O22 - SharedTaskScheduler: gaonic - {f31aee4a-1530-4fef-8537-79c6973bff9a} - C:\WINDOWS\system32\tazth.dll (file missing)
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

et je suis infecté jusqu'à quel niveau...? c'est grave docteur..., bon sérieusement,

bon voila les infos pour findykill:

############################## | FindyKill V6.001 |

# User : Francois (Administrateurs) # FRANCOISPC
# Update on 30/06/09 by Chiquitine29 & C_XX
# Start at: 17:31:19 | 03/07/2009
# Website : http://pagesperso-orange.fr/NosTools/index.html

# Intel(R) Celeron(R) M processor 1.50GHz
# Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 8.0.6001.18702
# Windows Firewall Status : Enabled
# AV : Avira AntiVir PersonalEdition Classic 0.0.0.0 [ Enabled | Updated ]
# AV : Avira AntiVir PersonalEdition Classic 0.0.0.0 [ Enabled | Updated ]
# AV : Avira AntiVir PersonalEdition Classic 0.0.0.0 [ Enabled | Updated ]
# AV : Avira AntiVir PersonalEdition 8.0.1.30 [ Enabled | (!) Outdated ]
# AV : Avira AntiVir PersonalEdition Classic 7.0.1.75
[ Enabled | Updated ]
# AV : Avira AntiVir PersonalEdition Classic 7.0.3.61
[ Enabled | Updated ]
# AV : Avira AntiVir PersonalEdition Classic 0.0.0.0 [ Enabled | Updated ]

# C:\ # Disque fixe local # 26,51 Go (5,79 Go free) [ACER] # FAT32
# D:\ # Disque fixe local # 26,91 Go (16,2 Go free) [ACERDATA] # FAT32
# E:\ # Disque CD-ROM

############################## | Processus actifs |

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Acer\eManager\anbmServ.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Launch Manager\LaunchAp.exe
C:\Program Files\Launch Manager\PowerKey.exe
C:\Program Files\Launch Manager\HotkeyApp.exe
C:\Program Files\Launch Manager\OSDCtrl.exe
C:\Program Files\Launch Manager\Wbutton.exe
C:\acer\epm\epm-dm.exe
C:\Program Files\Arcade\PCMService.exe
C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\acer\eRecovery\Monitor.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## | Registre Startup |

HKCU_Main: "Local Page"="C:\\WINDOWS\\system32\\blank.htm"
HKCU_Main: "Search Page"="https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC"
HKCU_Main: "Start Page"="https://www.msn.com/fr-fr"
HKCU_Main: "Secondary Start Pages"=hex(7):68,00,74,00,74,00,70,00,3a,00,2f,00,2f,00,77,00,\
HKLM_logon: "Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
HKLM_logon: "DefaultUserName"="Francois"
HKLM_logon: "AltDefaultUserName"="Francois"
HKLM_logon: "LegalNoticeCaption"=""
HKLM_logon: "LegalNoticeText"=""
HKLM_Run: preload=C:\Windows\RUNXMLPL.exe
HKLM_Run: IgfxTray=C:\WINDOWS\system32\igfxtray.exe
HKLM_Run: HotKeysCmds=C:\WINDOWS\system32\hkcmd.exe
HKLM_Run: SoundMan=SOUNDMAN.EXE
HKLM_Run: SynTPLpr=C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
HKLM_Run: SynTPEnh=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
HKLM_Run: LaunchAp="C:\Program Files\Launch Manager\LaunchAp.exe"
HKLM_Run: PowerKey="C:\Program Files\Launch Manager\PowerKey.exe"
HKLM_Run: LManager="C:\Program Files\Launch Manager\HotkeyApp.exe"
HKLM_Run: CtrlVol="C:\Program Files\Launch Manager\CtrlVol.exe"
HKLM_Run: LMgrOSD="C:\Program Files\Launch Manager\OSDCtrl.exe"
HKLM_Run: Wbutton="C:\Program Files\Launch Manager\Wbutton.exe"
HKLM_Run: EPM-DM=c:\acer\epm\epm-dm.exe
HKLM_Run: ePowerManagement=C:\Acer\ePM\ePM.exe boot
HKLM_Run: IMJPMIG8.1="C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
HKLM_Run: MSPY2002=C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
HKLM_Run: PHIME2002ASync=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
HKLM_Run: PHIME2002A=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
HKLM_Run: PCMService="C:\Program Files\Arcade\PCMService.exe"
HKLM_Run: eRecoveryService=C:\Windows\System32\Check.exe
HKLM_Run: SNCT511=C:\WINDOWS\vsnct511.exe
HKLM_Run: WeatherOnTray=C:\Program Files\SpamBlockerUtility\Bin\4.7.1.0\SbWeatherOnTray.exe
HKLM_Run: SpySpotter System Defender=C:\Program Files\SpySpotter3\Defender.exe -startup
HKLM_Run: LogitechVideoRepair=C:\Program Files\Logitech\Video\ISStart.exe
HKLM_Run: Omnipage=C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
HKLM_Run: NI.UERSV_0001_N68M0602="C:\Documents and Settings\Francois\Local Settings\Temporary Internet Files\Content.IE5\GZIJ2LM5\ErrorSafeScannerInstall_fr[1].exe" -nag
HKLM_Run: avgnt="C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
HKLM_Run: EPSON Stylus DX4000 Series=C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBEE.EXE /FU "C:\WINDOWS\TEMP\E_SEE.tmp" /EF "HKLM"
HKLM_Run: ImgTask=C:\WINDOWS\Imgtask.exe
HKLM_Run: QuickTime Task="C:\Program Files\QuickTime\qttask.exe" -atboottime
HKLM_Run: EPSON Stylus CX3600 Series=C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P26 "EPSON Stylus CX3600 Series" /O5 "LPT1:" /M "Stylus CX3600"
HKLM_Run: EPSON Stylus CX3600 Series (Copie 1)=C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P36 "EPSON Stylus CX3600 Series (Copie 1)" /O6 "USB003" /M "Stylus CX3600"
HKLM_Run: ORAHSSSessionManager=C:\Program Files\OrangeHSS\SessionManager\SessionManager.exe
HKLM_Run: Adobe Reader Speed Launcher="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
HKLM_Run: Ad-Watch=C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
HKLM_Run: HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents=
HKCU_Run: CTFMON.EXE=C:\WINDOWS\system32\ctfmon.exe
HKCU_Run: MSMSGS="C:\Program Files\Messenger\msmsgs.exe" /background
HKCU_Run: second load=C:\DOCUME~1\Francois\APPLIC~1\IDOLSU~1\DrvWay.exe
HKCU_Run: swg=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
HKCU_Run: seaem="c:\documents and settings\francois\local settings\application data\seaem.exe" seaem

################## | Fichiers # Dossiers infectieux |

Présent ! C:\WINDOWS\system32\autorun.ini

################## | C:\Documents and Settings\Francois\Temporary Internet Files |

################## | All Drives ... |

Présent ! D:\autorun.inf

################## | Registre # Clés Run infectieuses |

################## | Registre # Mountpoints2 |

HKCU\...\Explorer\MountPoints2\{37e58578-ac05-11dc-8a96-0014a42772d6}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{9a5209c6-dc19-11dd-8c19-0014a42772d6}\Shell\Auto\Command
HKCU\...\Explorer\MountPoints2\{9a5209c6-dc19-11dd-8c19-0014a42772d6}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{d848e714-5992-11dd-8b8f-001167716b82}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{de52edd8-31be-11da-8677-0014a42772d6}\Shell\Auto\Command
HKCU\...\Explorer\MountPoints2\{de52edd8-31be-11da-8677-0014a42772d6}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{f5001f68-8f9d-11db-892a-0014a42772d6}\Shell\AutoRun\Command

################## | Etat / Services / Informations |

# Affichage des fichiers cachés : OK

# Mode sans echec : OK

# Ndisuio -> Start = 3 ( Good = 3 | Bad = 4 )
# EapHost -> Start = 3 ( Good = 2 | Bad = 4 )
# Ip6Fw -> Start = 3 ( Good = 2 | Bad = 4 )
# SharedAccess -> Start = 2 ( Good = 2 | Bad = 4 )
# wuauserv -> Start = 2 ( Good = 2 | Bad = 4 )
# wscsvc -> Start = 2 ( Good = 2 | Bad = 4 )

################## | Cracks / Keygens / Serials |

################## | ! Fin du rapport # FindyKill V6.001 ! |

en attente de la nouvelle consultation,
merci doc,