Comment faire!!!

hajib -  
Bonjour,

je voudrais savoir comment endiguer ce fléau: "elvis is fat"
C'est un virus qui empêche parfois d'ouvrir la boite mail, et qui envoie des fichiers à mes contacts msn...
Quelles sont les dispositions à prenrde?
Merci!

11 réponses

  1. hajib
    Salut, merci beaucoup, je ressens les effets bénéfiques mais je ne sais toujours pas aller sur hotmail ou msn.

    J'ai retrouver des fichiers dans c:/windows/prefecht sinon rien dans le gestionnaire de taches.
    Voila mon log.

    Logfile of HijackThis v1.99.1
    Scan saved at 19:11:58, on 17/03/2005
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
    C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\drivers\CDAC11BA.EXE
    C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
    C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
    C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Program Files\Norton Internet Security Professional\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton Internet Security Professional\Norton AntiVirus\AdvTools\NPROTECT.EXE
    C:\WINDOWS\System32\nvsvc32.exe
    C:\Program Files\Norton Internet Security Professional\Norton AntiVirus\SAVScan.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\ctfmon.exe
    C:\PROGRA~1\Logitech\DESKTO~1\8876480\Program\BACKWE~1.EXE
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security Professional\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security Professional\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security Professional\UrlLstCk.exe
    O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\NORTON~1\AdvTools\ADVCHK.EXE
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
    O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe
    O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
    O4 - HKLM\..\RunOnce: [InstallShieldSetup] C:\PROGRA~1\INSTAL~1\{036AA~1\setup.exe -rebootC:\PROGRA~1\INSTAL~1\{036AA~1\reboot.ini -l0x40c
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
    O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
    O4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe -quiet
    O4 - HKCU\..\Run: [Le Petit Robert Hyperappel] C:\Program Files\Le Robert\Le Petit Robert\prhyper.exe
    O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
    O4 - HKCU\..\RunOnce: [iTouch] C:\Program Files\Logitech\iTouch\iTouch.exe /RegServer
    O4 - HKCU\..\RunOnce: [] C:\PROGRA~1\Logitech\RESOUR~1\ResCentr.exe
    O4 - Startup: emprun.lnk = C:\Program Files\Empty Temp Folders 2.8.3\emprun.exe
    O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
    O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
    O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
    O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZS
    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
    O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O12 - Plugin for .ivr: C:\\Program Files\\Internet Explorer\\PLUGINS\\NPRVRT32.dll
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cab
    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
    O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
    O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
    O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab
    O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by17fd.bay17.hotmail.msn.com/resources/MsnPUpld.cab
    O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20040105/qtinstall.info.apple.com/mickey/fr/win/QuickTimeInstaller.exe
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab31267.cab
    O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real.com/gameconsole/Bundler/CAB/RealArcadeRdxIE.cab
    O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
    O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{A47F2361-6B25-4462-90DD-0F4DCD1E9979}: NameServer = 195.238.2.21 195.238.2.22
    O17 - HKLM\System\CCS\Services\Tcpip\..\{D9BF2BED-DF6E-43EB-B1F9-B6E8CD851680}: NameServer = 217.117.32.3
    O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
    O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
    O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security Professional\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton Internet Security Professional\Norton AntiVirus\AdvTools\NPROTECT.EXE
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security Professional\Norton AntiVirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
    O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
    0
    1. michelle
      bonsoir,

      je t'ai envoyé fixsflog à ton adresse e-mail
      je n'ai pas eu de souci avec

      michelle
      0
      1. hajib
        merci mais je ne l'ai pas encore reçu? C'est bizarre parce que j'ai eu des mails provenant plus tard...
        0
    2. moe
      Salut

      Avant de faire quoi que ce soit, important:

      -> Rend visible les fichiers cachés et systeme
      panneau de configuration > options des dossiers > onglet affichage
      cocher " afficher les fichiers et dossiers cachés "
      décocher " masquer les extentions des fichiers dont le type est connu
      décocher " masquer les fichiers protégés du système"

      Puis:
      - Redémarre en mode sans échec en appuyant sur la touche F8 au démarrage de ton PC (apres l'ecran du bios)

      ---------------------------------------------

      Prend bien le temps de vérifier et n'oublier aucunes lignes (surtout les 04)

      Vérifie si ce ou ces procéssus apparaissent dans le gestionnaire des taches.(CTRL+ALT+SUPPR)
      S'ils sont présent: clic droit dessus puis clic sur "terminer le processus"

      msmbw.exe
      formatsys.exe
      serbw.exe

      Lance hijackthis et Fixe:
      (cocher au début de chaques lignes valider avec fix checked)

      O1 - Hosts: 64.233.167.104 www.symantec.com
      O1 - Hosts: 64.233.167.104 www.sophos.com
      O1 - Hosts: 64.233.167.104 www.mcafee.com
      O1 - Hosts: 64.233.167.104 www.viruslist.com
      O1 - Hosts: 64.233.167.104 www.f-secure.com
      O1 - Hosts: 64.233.167.104 www.avp.com
      O1 - Hosts: 64.233.167.104 www.kaspersky.com
      O1 - Hosts: 64.233.167.104 www.networkassociates.com
      O1 - Hosts: 64.233.167.104 www.ca.com
      O1 - Hosts: 64.233.167.104 www.my-etrust.com
      O1 - Hosts: 64.233.167.104 www.nai.com
      O1 - Hosts: 64.233.167.104 www.trendmicro.com
      O1 - Hosts: 64.233.167.104 www.grisoft.com
      O1 - Hosts: 64.233.167.104 securityresponse.symantec.com
      O1 - Hosts: 64.233.167.104 symantec.com
      O1 - Hosts: 64.233.167.104 sophos.com
      O1 - Hosts: 64.233.167.104 mcafee.com
      O1 - Hosts: 64.233.167.104 liveupdate.symantecliveupdate.com
      O1 - Hosts: 64.233.167.104 viruslist.com
      O1 - Hosts: 64.233.167.104 f-secure.com
      O1 - Hosts: 64.233.167.104 kaspersky.com
      O1 - Hosts: 64.233.167.104 kaspersky-labs.com
      O1 - Hosts: 64.233.167.104 avp.com
      O1 - Hosts: 64.233.167.104 networkassociates.com
      O1 - Hosts: 64.233.167.104 ca.com
      O1 - Hosts: 64.233.167.104 mast.mcafee.com
      O1 - Hosts: 64.233.167.104 my-etrust.com
      O1 - Hosts: 64.233.167.104 download.mcafee.com
      O1 - Hosts: 64.233.167.104 dispatch.mcafee.com
      O1 - Hosts: 64.233.167.104 secure.nai.com
      O1 - Hosts: 64.233.167.104 nai.com
      O1 - Hosts: 64.233.167.104 update.symantec.com
      O1 - Hosts: 64.233.167.104 updates.symantec.com
      O1 - Hosts: 64.233.167.104 us.mcafee.com
      O1 - Hosts: 64.233.167.104 liveupdate.symantec.com
      O1 - Hosts: 64.233.167.104 customer.symantec.com
      O1 - Hosts: 64.233.167.104 rads.mcafee.com
      O1 - Hosts: 64.233.167.104 trendmicro.com
      O1 - Hosts: 64.233.167.104 grisoft.com
      O1 - Hosts: 64.233.167.104 sandbox.norman.no
      O1 - Hosts: 64.233.167.104 www.pandasoftware.com
      O1 - Hosts: 64.233.167.104 uk.trendmicro-europe.com
      O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWay\SearchAt\6.bin\MWSSRCAS.DLL
      O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWay\bar\6.bin\MWSBAR.DLL
      O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - (no file)
      O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
      O3 - Toolbar: My &Way Speedbar - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWay\bar\6.bin\MWSBAR.DLL

      O4 - HKLM\..\Run: [AME_CSA] rundll32 amecsa.cpl,RUN_DLL
      O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
      O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MyWay\bar\6.bin\mwsoemon.exe
      O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fr-be\msnappau.exe"
      O4 - HKLM\..\Run: [avnort] C:\WINDOWS\System32\serbw.exe
      O4 - HKLM\..\Run: [ltwob] C:\WINDOWS\System32\formatsys.exe
      O4 - HKLM\..\Run: [serpe] C:\WINDOWS\System32\serbw.exe
      O4 - HKLM\..\RunServices: [avnort] C:\WINDOWS\System32\serbw.exe
      O4 - HKLM\..\RunServices: [ltwob] C:\WINDOWS\System32\formatsys.exe
      O4 - HKLM\..\RunServices: [serpe] C:\WINDOWS\System32\serbw.exe
      O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MyWay\bar\6.bin\mwsoemon.exe
      O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWay\bar\6.bin\MWSOEMON.EXE
      O4 - Global Startup: hp psc 1000 series.lnk = ?
      O4 - Global Startup: hpoddt01.exe.lnk = ?
      O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWay\bar\6.bin\MWSOEMON.EXE

      O16 - DPF: Dexia netbanking - http://netbanking.dexia.be/PC//Dynamic/Shared/Applet//DexiaIIA.cab
      O16 - DPF: PackageHtmlCab - http://acces.blonde.com/package/op/PackageHtmlCab.CAB
      O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab

      Rechercher et supprimer si présent:

      C:\WINDOWS\System32\serbw.exe
      C:\WINDOWS\System32\formatsys.exe
      C:\WINDOWS\msmbw.exe
      C:\Crazy-Frog.Html
      C:\Message to n00b LARISSA.txt
      C:\Fat Elvis! lol.pif
      C:\British National Party.jpg
      C:\Program Files\MyWay<= le dossier

      Vérifie aussi dans:

      C:\Documents and Settings\nom d'utilisateur\Local Settings\Application Data\Microsoft\CD Burning
      si ces 2 fichiers sont présent, si oui tu supprime:
      AUTORUN.EXE
      AUTORUN.INF

      Si problemes avec la restauration systeme aller jusqu'à:

      HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\clic sur SystemRestore => dans la fenetre de droite supprimer les 2 valeurs:

      "DisableConfig" = "0"

      "DisableSR" = "0"

      si tu utilise la mule, il peut se copier aussi dans le dossier:
      C:\Program Files\eMule\Incoming

      Ainsi que dans Poste de travail> "documents partagés"

      Sous les noms suivants:

      Messenger Plus! 3.50.exe
      MSN all version polygamy.exe
      MSN nudge bomb.exe
      MSN Display picture stealer.exe
      MSN Messenger 7.exe
      MSN Avatar Creator.exe
      A virer si présent

      Ensuite:

      Vide tes fichiers temporaires internet et les cookies:

      - panneau config> options internet> supprimer les fichiers, coche supprimer le contenu hors connection et valide ok
      - panneau config> options internet> supprimer les cookies

      Les fichiers temporaires:

      - C:\Document and setting\pour tous les dossiers\Local setting \Temp <=supprimer les fichiers à l'intérieur (pas les dossiers)

      - C:\Windows\Temp <=supprimer les fichiers à l'intérieur.

      - C:\WINDOWS\Prefetch <=supprimer les fichiers à l'intérieur sauf layout.ini

      - Vide la poubelle

      -----------------------------

      Redemarre normalement et reposte un log hijack pour vérifier l'évolution

      Ne pas oublier après les manips de recocher " masquer les fichiers protégés du système" dans les options des dossiers
      0
      1. hajib
        salut, merci pour ces conseils, je voulais les imprimer mais l'imprimante refus de sortir les photocopies, je fais donc devoir recopier. je te dis quoi après.
        peux tu me laisser ton adresse mail.merci
        0
      2. hajib
        voila je viens de noter, je vais faire ce que tu m'a dit: espérons que ca marche, je te met mon log après
        0
      3. hajib
        salut, qd je pousse sur f8 rien ne se passe sauf qd je suis sur le bureau il me met enregistrer, je crois donc que c'est une touche de raccourci. il me met au début qu'il faut pousser sur f4 ou ctrl+ s mais rien ne se passe. peux tu m'aider.
        0
      4. hajib
        voila c fait

        voila ce que j'obtient

        Logfile of HijackThis v1.99.1
        Scan saved at 0:54:15, on 17/03/2005
        Platform: Windows XP SP1 (WinNT 5.01.2600)
        MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
        C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
        C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
        C:\WINDOWS\system32\spoolsv.exe
        C:\WINDOWS\Explorer.EXE
        C:\WINDOWS\System32\drivers\CDAC11BA.EXE
        C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
        C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
        C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
        C:\Program Files\Norton Internet Security Professional\Norton AntiVirus\navapsvc.exe
        C:\Program Files\Norton Internet Security Professional\Norton AntiVirus\AdvTools\NPROTECT.EXE
        C:\WINDOWS\System32\nvsvc32.exe
        C:\Program Files\Norton Internet Security Professional\Norton AntiVirus\SAVScan.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\System32\formatsys.exe
        C:\WINDOWS\System32\sstray.exe
        C:\Program Files\Logitech\iTouch\iTouch.exe
        C:\Program Files\Messenger\msmsgs.exe
        C:\WINDOWS\System32\ctfmon.exe
        C:\WINDOWS\System32\RUNDLL32.EXE
        C:\Program Files\Le Robert\Le Petit Robert\prhyper.exe
        C:\Program Files\Skype\Phone\Skype.exe
        C:\Program Files\UnHackMe\hackmon.exe
        C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
        C:\Program Files\WinZip\WZQKPICK.EXE
        C:\Program Files\Empty Temp Folders 2.8.3\emprun.exe
        C:\WINDOWS\webshots.scr
        C:\Program Files\MSN Messenger\msnmsgr.exe
        C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fr-be\msnappau.exe
        C:\WINDOWS\System32\wuauclt.exe
        C:\WINDOWS\system32\NOTEPAD.EXE
        C:\hijackthis\HijackThis.exe

        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
        O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
        O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWay\bar\6.bin\MWSBAR.DLL
        O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.02.3000.1002\en-xu\stmain.dll
        O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
        O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\fr-be\msntb.dll
        O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security Professional\Norton AntiVirus\NavShExt.dll
        O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
        O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security Professional\Norton AntiVirus\NavShExt.dll
        O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\fr-be\msntb.dll
        O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
        O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r
        O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
        O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security Professional\UrlLstCk.exe
        O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\NORTON~1\AdvTools\ADVCHK.EXE
        O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
        O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
        O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
        O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
        O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
        O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe
        O4 - HKLM\..\Run: [ltwob] C:\WINDOWS\System32\formatsys.exe
        O4 - HKLM\..\RunServices: [ltwob] C:\WINDOWS\System32\formatsys.exe
        O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
        O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
        O4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe -quiet
        O4 - HKCU\..\Run: [Le Petit Robert Hyperappel] C:\Program Files\Le Robert\Le Petit Robert\prhyper.exe
        O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
        O4 - HKCU\..\Run: [UnHackMe Monitor] C:\Program Files\UnHackMe\hackmon.exe
        O4 - Startup: emprun.lnk = C:\Program Files\Empty Temp Folders 2.8.3\emprun.exe
        O4 - Startup: RegFreeze.lnk = C:\Program Files\RegFreeze\regfreeze.exe
        O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
        O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
        O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
        O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
        O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZS
        O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
        O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
        O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
        O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
        O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
        O12 - Plugin for .ivr: C:\\Program Files\\Internet Explorer\\PLUGINS\\NPRVRT32.dll
        O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
        O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cab
        O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
        O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
        O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
        O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab
        O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
        O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by17fd.bay17.hotmail.msn.com/resources/MsnPUpld.cab
        O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20040105/qtinstall.info.apple.com/mickey/fr/win/QuickTimeInstaller.exe
        O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
        O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab31267.cab
        O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real.com/gameconsole/Bundler/CAB/RealArcadeRdxIE.cab
        O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
        O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
        O17 - HKLM\System\CCS\Services\Tcpip\..\{A47F2361-6B25-4462-90DD-0F4DCD1E9979}: NameServer = 195.238.2.21 195.238.2.22
        O17 - HKLM\System\CCS\Services\Tcpip\..\{D9BF2BED-DF6E-43EB-B1F9-B6E8CD851680}: NameServer = 217.117.32.3
        O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
        O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
        O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
        O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
        O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
        O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
        O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security Professional\Norton AntiVirus\navapsvc.exe
        O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton Internet Security Professional\Norton AntiVirus\AdvTools\NPROTECT.EXE
        O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
        O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
        O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security Professional\Norton AntiVirus\SAVScan.exe
        O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
        O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
        O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
        0
      5. moe
        @hajibsalut

        Pour le mode sans echecs, redemarre ton pc, laisse passer l'ecran du bios et juste avant le chargement de windows tu tapote sur F8.
        Rend visible les fichiers cachés et systeme.

        Puis:
        ouvre le gestionnaire des taches (ctrl+alt+suppr)
        termine:
        formatsys.exe

        Lance hijack et fixe:
        O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWay\bar\6.bin\MWSBAR.DLL

        O4 - HKLM\..\Run: [ltwob] C:\WINDOWS\System32\formatsys.exe
        O4 - HKLM\..\RunServices: [ltwob] C:\WINDOWS\System32\formatsys.exe

        supprime:
        C:\WINDOWS\System32\formatsys.exe
        et vérifie si ceux là sont présents:
        C:\WINDOWS\System32\serbw.exe
        C:\WINDOWS\msmbw.exe

        redemarre normalement et reposte un log hijack

        a+
        0
    3. hajib
      une question, est-ce que je vais conserver les documents de mon ordi parce que j'ai des doc importants. Merci encore. J'attends ta réponse
      0
      2. hajib
        Logfile of HijackThis v1.99.1
        Scan saved at 21:35:45, on 16/03/2005
        Platform: Windows XP SP1 (WinNT 5.01.2600)
        MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
        C:\WINDOWS\Explorer.EXE
        C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
        C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
        C:\WINDOWS\system32\spoolsv.exe
        C:\WINDOWS\System32\drivers\CDAC11BA.EXE
        C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
        C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
        C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
        C:\Program Files\Norton Internet Security Professional\Norton AntiVirus\navapsvc.exe
        C:\Program Files\Norton Internet Security Professional\Norton AntiVirus\AdvTools\NPROTECT.EXE
        C:\WINDOWS\System32\nvsvc32.exe
        C:\Program Files\Norton Internet Security Professional\Norton AntiVirus\SAVScan.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\System32\formatsys.exe
        C:\WINDOWS\System32\sstray.exe
        C:\Program Files\Logitech\iTouch\iTouch.exe
        C:\WINDOWS\System32\rundll32.exe
        C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
        C:\WINDOWS\System32\P2P Networking\P2P Networking.exe
        C:\Program Files\Messenger\msmsgs.exe
        C:\PROGRA~1\MyWay\bar\6.bin\mwsoemon.exe
        C:\Program Files\QuickTime\qttask.exe
        C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fr-be\msnappau.exe
        C:\WINDOWS\System32\NotifyPhoneBook.exe
        C:\WINDOWS\System32\ctfmon.exe
        C:\WINDOWS\System32\RUNDLL32.EXE
        C:\Program Files\Le Robert\Le Petit Robert\prhyper.exe
        C:\Program Files\Skype\Phone\Skype.exe
        C:\Program Files\UnHackMe\hackmon.exe
        C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
        C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
        C:\Program Files\WinZip\WZQKPICK.EXE
        C:\Program Files\Empty Temp Folders 2.8.3\emprun.exe
        C:\WINDOWS\webshots.scr
        C:\Program Files\MSN Messenger\msnmsgr.exe
        C:\Program Files\Internet Explorer\iexplore.exe
        C:\WINDOWS\System32\wuauclt.exe
        C:\Program Files\Internet Explorer\IEXPLORE.EXE
        C:\hijackthis\HijackThis.exe

        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
        O1 - Hosts: 64.233.167.104 www.symantec.com
        O1 - Hosts: 64.233.167.104 www.sophos.com
        O1 - Hosts: 64.233.167.104 www.mcafee.com
        O1 - Hosts: 64.233.167.104 www.viruslist.com
        O1 - Hosts: 64.233.167.104 www.f-secure.com
        O1 - Hosts: 64.233.167.104 www.avp.com
        O1 - Hosts: 64.233.167.104 www.kaspersky.com
        O1 - Hosts: 64.233.167.104 www.networkassociates.com
        O1 - Hosts: 64.233.167.104 www.ca.com
        O1 - Hosts: 64.233.167.104 www.my-etrust.com
        O1 - Hosts: 64.233.167.104 www.nai.com
        O1 - Hosts: 64.233.167.104 www.trendmicro.com
        O1 - Hosts: 64.233.167.104 www.grisoft.com
        O1 - Hosts: 64.233.167.104 securityresponse.symantec.com
        O1 - Hosts: 64.233.167.104 symantec.com
        O1 - Hosts: 64.233.167.104 sophos.com
        O1 - Hosts: 64.233.167.104 mcafee.com
        O1 - Hosts: 64.233.167.104 liveupdate.symantecliveupdate.com
        O1 - Hosts: 64.233.167.104 viruslist.com
        O1 - Hosts: 64.233.167.104 f-secure.com
        O1 - Hosts: 64.233.167.104 kaspersky.com
        O1 - Hosts: 64.233.167.104 kaspersky-labs.com
        O1 - Hosts: 64.233.167.104 avp.com
        O1 - Hosts: 64.233.167.104 networkassociates.com
        O1 - Hosts: 64.233.167.104 ca.com
        O1 - Hosts: 64.233.167.104 mast.mcafee.com
        O1 - Hosts: 64.233.167.104 my-etrust.com
        O1 - Hosts: 64.233.167.104 download.mcafee.com
        O1 - Hosts: 64.233.167.104 dispatch.mcafee.com
        O1 - Hosts: 64.233.167.104 secure.nai.com
        O1 - Hosts: 64.233.167.104 nai.com
        O1 - Hosts: 64.233.167.104 update.symantec.com
        O1 - Hosts: 64.233.167.104 updates.symantec.com
        O1 - Hosts: 64.233.167.104 us.mcafee.com
        O1 - Hosts: 64.233.167.104 liveupdate.symantec.com
        O1 - Hosts: 64.233.167.104 customer.symantec.com
        O1 - Hosts: 64.233.167.104 rads.mcafee.com
        O1 - Hosts: 64.233.167.104 trendmicro.com
        O1 - Hosts: 64.233.167.104 grisoft.com
        O1 - Hosts: 64.233.167.104 sandbox.norman.no
        O1 - Hosts: 64.233.167.104 www.pandasoftware.com
        O1 - Hosts: 64.233.167.104 uk.trendmicro-europe.com
        O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWay\SearchAt\6.bin\MWSSRCAS.DLL
        O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
        O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWay\bar\6.bin\MWSBAR.DLL
        O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - (no file)
        O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.02.3000.1002\en-xu\stmain.dll
        O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
        O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
        O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\fr-be\msntb.dll
        O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security Professional\Norton AntiVirus\NavShExt.dll
        O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
        O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security Professional\Norton AntiVirus\NavShExt.dll
        O3 - Toolbar: My &Way Speedbar - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWay\bar\6.bin\MWSBAR.DLL
        O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\fr-be\msntb.dll
        O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
        O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r
        O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
        O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security Professional\UrlLstCk.exe
        O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\NORTON~1\AdvTools\ADVCHK.EXE
        O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
        O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
        O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
        O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
        O4 - HKLM\..\Run: [AME_CSA] rundll32 amecsa.cpl,RUN_DLL
        O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
        O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
        O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MyWay\bar\6.bin\mwsoemon.exe
        O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
        O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fr-be\msnappau.exe"
        O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
        O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe
        O4 - HKLM\..\Run: [avnort] C:\WINDOWS\System32\serbw.exe
        O4 - HKLM\..\Run: [ltwob] C:\WINDOWS\System32\formatsys.exe
        O4 - HKLM\..\Run: [serpe] C:\WINDOWS\System32\serbw.exe
        O4 - HKLM\..\RunServices: [avnort] C:\WINDOWS\System32\serbw.exe
        O4 - HKLM\..\RunServices: [ltwob] C:\WINDOWS\System32\formatsys.exe
        O4 - HKLM\..\RunServices: [serpe] C:\WINDOWS\System32\serbw.exe
        O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
        O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
        O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MyWay\bar\6.bin\mwsoemon.exe
        O4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe -quiet
        O4 - HKCU\..\Run: [Le Petit Robert Hyperappel] C:\Program Files\Le Robert\Le Petit Robert\prhyper.exe
        O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
        O4 - HKCU\..\Run: [UnHackMe Monitor] C:\Program Files\UnHackMe\hackmon.exe
        O4 - Startup: emprun.lnk = C:\Program Files\Empty Temp Folders 2.8.3\emprun.exe
        O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWay\bar\6.bin\MWSOEMON.EXE
        O4 - Startup: RegFreeze.lnk = C:\Program Files\RegFreeze\regfreeze.exe
        O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
        O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
        O4 - Global Startup: hp psc 1000 series.lnk = ?
        O4 - Global Startup: hpoddt01.exe.lnk = ?
        O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
        O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWay\bar\6.bin\MWSOEMON.EXE
        O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
        O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZS
        O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
        O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
        O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
        O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
        O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
        O12 - Plugin for .ivr: C:\\Program Files\\Internet Explorer\\PLUGINS\\NPRVRT32.dll
        O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
        O16 - DPF: Dexia netbanking - http://netbanking.dexia.be/PC//Dynamic/Shared/Applet//DexiaIIA.cab
        O16 - DPF: PackageHtmlCab - http://acces.blonde.com/package/op/PackageHtmlCab.CAB
        O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cab
        O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
        O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
        O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
        O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab
        O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
        O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by17fd.bay17.hotmail.msn.com/resources/MsnPUpld.cab
        O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20040105/qtinstall.info.apple.com/mickey/fr/win/QuickTimeInstaller.exe
        O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
        O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab31267.cab
        O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real.com/gameconsole/Bundler/CAB/RealArcadeRdxIE.cab
        O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
        O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
        O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab
        O17 - HKLM\System\CCS\Services\Tcpip\..\{A47F2361-6B25-4462-90DD-0F4DCD1E9979}: NameServer = 195.238.2.21 195.238.2.22
        O17 - HKLM\System\CCS\Services\Tcpip\..\{D9BF2BED-DF6E-43EB-B1F9-B6E8CD851680}: NameServer = 217.117.32.3
        O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
        O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
        O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
        O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
        O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
        O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
        O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security Professional\Norton AntiVirus\navapsvc.exe
        O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton Internet Security Professional\Norton AntiVirus\AdvTools\NPROTECT.EXE
        O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
        O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
        O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security Professional\Norton AntiVirus\SAVScan.exe
        O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
        O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
        O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
        0
        1. moe
          essaye de telecharger hijackthis:
          http://www.merijn.org/files/hijackthis.zip
          Dezippe le dans un dossier prévu a cet effet.
          Par exemple C:\hijackthis
          lance le puis:
          clic sur "do a system scan and save logfile"
          fais un copier coller du log entier sur le forum.
          0
          1. hajib
            C:\WINDOWS\webshots.scr
            C:\Program Files\MSN Messenger\msnmsgr.exe
            C:\Program Files\Internet Explorer\iexplore.exe
            C:\WINDOWS\System32\wuauclt.exe
            C:\Program Files\Internet Explorer\IEXPLORE.EXE
            C:\hijackthis\HijackThis.exe

            R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
            R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
            O1 - Hosts: 64.233.167.104 www.symantec.com
            O1 - Hosts: 64.233.167.104 www.sophos.com
            O1 - Hosts: 64.233.167.104 www.mcafee.com
            O1 - Hosts: 64.233.167.104 www.viruslist.com
            O1 - Hosts: 64.233.167.104 www.f-secure.com
            O1 - Hosts: 64.233.167.104 www.avp.com
            O1 - Hosts: 64.233.167.104 www.kaspersky.com
            O1 - Hosts: 64.233.167.104 www.networkassociates.com
            O1 - Hosts: 64.233.167.104 www.ca.com
            O1 - Hosts: 64.233.167.104 www.my-etrust.com
            O1 - Hosts: 64.233.167.104 www.nai.com
            O1 - Hosts: 64.233.167.104 www.trendmicro.com
            O1 - Hosts: 64.233.167.104 www.grisoft.com
            O1 - Hosts: 64.233.167.104 securityresponse.symantec.com
            O1 - Hosts: 64.233.167.104 symantec.com
            O1 - Hosts: 64.233.167.104 sophos.com
            O1 - Hosts: 64.233.167.104 mcafee.com
            O1 - Hosts: 64.233.167.104 liveupdate.symantecliveupdate.com
            O1 - Hosts: 64.233.167.104 viruslist.com
            O1 - Hosts: 64.233.167.104 f-secure.com
            O1 - Hosts: 64.233.167.104 kaspersky.com
            O1 - Hosts: 64.233.167.104 kaspersky-labs.com
            O1 - Hosts: 64.233.167.104 avp.com
            O1 - Hosts: 64.233.167.104 networkassociates.com
            O1 - Hosts: 64.233.167.104 ca.com
            O1 - Hosts: 64.233.167.104 mast.mcafee.com
            O1 - Hosts: 64.233.167.104 my-etrust.com
            O1 - Hosts: 64.233.167.104 download.mcafee.com
            O1 - Hosts: 64.233.167.104 dispatch.mcafee.com
            O1 - Hosts: 64.233.167.104 secure.nai.com
            O1 - Hosts: 64.233.167.104 nai.com
            O1 - Hosts: 64.233.167.104 update.symantec.com
            O1 - Hosts: 64.233.167.104 updates.symantec.com
            O1 - Hosts: 64.233.167.104 us.mcafee.com
            O1 - Hosts: 64.233.167.104 liveupdate.symantec.com
            O1 - Hosts: 64.233.167.104 customer.symantec.com
            O1 - Hosts: 64.233.167.104 rads.mcafee.com
            O1 - Hosts: 64.233.167.104 trendmicro.com
            O1 - Hosts: 64.233.167.104 grisoft.com
            O1 - Hosts: 64.233.167.104 sandbox.norman.no
            O1 - Hosts: 64.233.167.104 www.pandasoftware.com
            O1 - Hosts: 64.233.167.104 uk.trendmicro-europe.com
            O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWay\SearchAt\6.bin\MWSSRCAS.DLL
            O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
            O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWay\bar\6.bin\MWSBAR.DLL
            O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - (no file)
            O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.02.3000.1002\en-xu\stmain.dll
            O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
            O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
            O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\fr-be\msntb.dll
            O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security Professional\Norton AntiVirus\NavShExt.dll
            O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
            O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security Professional\Norton AntiVirus\NavShExt.dll
            O3 - Toolbar: My &Way Speedbar - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWay\bar\6.bin\MWSBAR.DLL
            O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\fr-be\msntb.dll
            O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
            O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r
            O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
            O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security Professional\UrlLstCk.exe
            O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\NORTON~1\AdvTools\ADVCHK.EXE
            O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
            O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
            O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
            O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
            O4 - HKLM\..\Run: [AME_CSA] rundll32 amecsa.cpl,RUN_DLL
            O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
            O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
            O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MyWay\bar\6.bin\mwsoemon.exe
            O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
            O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fr-be\msnappau.exe"
            O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
            O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe
            O4 - HKLM\..\Run: [avnort] C:\WINDOWS\System32\serbw.exe
            O4 - HKLM\..\Run: [ltwob] C:\WINDOWS\System32\formatsys.exe
            O4 - HKLM\..\Run: [serpe] C:\WINDOWS\System32\serbw.exe
            O4 - HKLM\..\RunServices: [avnort] C:\WINDOWS\System32\serbw.exe
            O4 - HKLM\..\RunServices: [ltwob] C:\WINDOWS\System32\formatsys.exe
            O4 - HKLM\..\RunServices: [serpe] C:\WINDOWS\System32\serbw.exe
            O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
            O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
            O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MyWay\bar\6.bin\mwsoemon.exe
            O4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe -quiet
            O4 - HKCU\..\Run: [Le Petit Robert Hyperappel] C:\Program Files\Le Robert\Le Petit Robert\prhyper.exe
            O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
            O4 - HKCU\..\Run: [UnHackMe Monitor] C:\Program Files\UnHackMe\hackmon.exe
            O4 - Startup: emprun.lnk = C:\Program Files\Empty Temp Folders 2.8.3\emprun.exe
            O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWay\bar\6.bin\MWSOEMON.EXE
            O4 - Startup: RegFreeze.lnk = C:\Program Files\RegFreeze\regfreeze.exe
            O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
            O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
            O4 - Global Startup: hp psc 1000 series.lnk = ?
            O4 - Global Startup: hpoddt01.exe.lnk = ?
            O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
            O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWay\bar\6.bin\MWSOEMON.EXE
            O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
            O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZS
            O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
            O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
            O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
            O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
            O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
            O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
            O12 - Plugin for .ivr: C:\\Program Files\\Internet Explorer\\PLUGINS\\NPRVRT32.dll
            O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
            O16 - DPF: Dexia netbanking - http://netbanking.dexia.be/PC//Dynamic/Shared/Applet//DexiaIIA.cab
            O16 - DPF: PackageHtmlCab - http://acces.blonde.com/package/op/PackageHtmlCab.CAB
            O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cab
            O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
            O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
            O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
            O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab
            O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
            O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by17fd.bay17.hotmail.msn.com/resources/MsnPUpld.cab
            O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20040105/qtinstall.info.apple.com/mickey/fr/win/QuickTimeInstaller.exe
            O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
            O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab31267.cab
            O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real.com/gameconsole/Bundler/CAB/RealArcadeRdxIE.cab
            O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
            O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
            O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab
            O17 - HKLM\System\CCS\Services\Tcpip\..\{A47F2361-6B25-4462-90DD-0F4DCD1E9979}: NameServer = 195.238.2.21 195.238.2.22
            O17 - HKLM\System\CCS\Services\Tcpip\..\{D9BF2BED-DF6E-43EB-B1F9-B6E8CD851680}: NameServer = 217.117.32.3
            O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
            O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
            O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
            O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
            O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
            O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
            O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security Professional\Norton AntiVirus\navapsvc.exe
            O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton Internet Security Professional\Norton AntiVirus\AdvTools\NPROTECT.EXE
            O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
            O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
            O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security Professional\Norton AntiVirus\SAVScan.exe
            O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
            O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
            O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
            0
        2. moe
          tu as pu telecharger le fix ?
          ici:
          http://majorgeeks.com/download4523.html
          0
          1. hajib
            mem pas le virus me laisse à peine le temps de lire le premier mot et puis ferme la fenetre
            0
          2. michelle
            @hajibj'ai eu le même problème la semaine dernière
            donne moi ton adresse e-mail et je te l'envoie
            et surtout ouvre le tout de suite car si tu l'enregistres avant sur ton pc tu ne pourras plus l'ouvrir
            0
        3. hajib
          je sais pas, des que je clique, elle ferme la fenetre. comment faire
          0
          3. Neo-Nil@u Contributeur
            Salut Hajib,

            Quelques infos dénichées sur Internet :
            http://secuser.com/alertes/2005/serflog.htm

            Aurais-tu MSN par hasard ?
            0
            1. hajib
              le virus ne me laisse mem pas le temps de voir la page, comment faire pour les avoir, me les envoyer ?
              0