Au secours ! virus !!!

BOnjour Mike,

PLus de virus sur mon PC, merci beaucoup
POur les déconnexion, j'ai contacté NEUF qui a fait une modification sur ma ligne. Maintenant ça fonctionne mais l'affichage est très long.
Je vous remercie encore pour votre aide à combattre ce virus

VOici les derniers rapports mais je n'ai pas encore fait Erunt ....

Fix Navipromo version 4.0.2 commencé le 16/09/2009 15:02:24,48

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!

Outil exécuté depuis C:\Program Files\navilog1

Mise à jour le 27.08.2009 à 11h00 par IL-MAFIOSO

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : AMD Sempron(tm) Processor 3200+ )
BIOS : BIOS Date: 08/10/07 10:04:22 Ver: 08.00.12
USER : bea ( Administrator )
BOOT : Normal boot

Antivirus : avast! antivirus 4.8.1351 [VPS 090916-0] 4.8.1351 (Activated)

A:\ (USB)
C:\ (Local Disk) - NTFS - Total:18 Go (Free:5 Go)
D:\ (Local Disk) - NTFS - Total:96 Go (Free:20 Go)
E:\ (CD or DVD)

Recherche executée en mode normal

[b]Aucune Infection Navipromo/Egdaccess trouvée/b

*** Scan terminé 16/09/2009 15:06:48,51 ***

____________________________________________________________
Malwarebytes' Anti-Malware 1.41
Version de la base de données: 2811
Windows 5.1.2600 Service Pack 3

16/09/2009 16:01:06
mbam-log-2009-09-16 (16-01-06).txt

Type de recherche: Examen rapide
Eléments examinés: 93248
Temps écoulé: 6 minute(s), 13 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\asc3550p (Rootkit.Agent) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

Bon, ça y est, j'ai fini toutes les procédures, y compris ERUNT et WINSOCK. Je vais éteindre mon PC et voir plus tard dans la soirée comment tout se passe. Dans l'hypothèse où tout irait bien, pouvez-vous encore m'apporter votre aider pour :

- me dire tout ce que je peux effacer au niveau des rapports, programmes téléchargés ... etc (hijackthis, Navilog..) et surtout où je vais les trouver pour les effacer correctement

- me dire les programmes que je dois garder et utiliser régulièrement comme CCLEANER, par exemple, je supppose que celui là, il faut le conserver

- me dire à quoi sert la fameuse sauvegarde de la base de registre faite avec ERUNT

et pour finir me conseiller éventuellement un antivirus fiable

Encore, merci et merci pour votre aide, en espérant que vous n'aurez plus de mes nouvelles

Mike,

Je suis étonnée de ne plus avoir de nouvelles.
NOus sommes vendredi, depuis hier, je n'ai plus de messages de virus donc je pense qu'il est enfin éradiqué. Encore merci pour votre aide précieuse.
Par contre, concernant les déconnexions intempestives, toujours idem.
Hier soir, j'ai donc débranchée ma neuf box BB4 du PC, et ma ligne téléphonique est restée stable jusqu'à ce matin.
Je pense qu'il y a une interaction entre le PC et la neuf qui entraine des déconnexions tout à fait aléatoires. N'y a t il pas quelque chose qui ai pu être effacé lors de toutes les manip ?
Si vous avez encore un peu de temps à m'accorder, merci de répondre au post 28
A bientôt
Béatrice

Re,
je viens de refaire le post 17, voici le nouveau rapport

wahozyh.exee IS deleting
quequouvypoqu.exe IS deleting

Je fais le post 18 et vous tiens au courant

Désolée, une fois de plus, je ne comprends pas ???? Les premières instructions du post 18 :

Ouvrez l'Invité de commande : Démarrer -> "Tout les programmes" -> Accessoires ..
Après, je vais où ? Dans le bloc note ?

<ital>- Copier /coller(par un clic-droit) "unes après l'autre" les lignes suivantes et valider pour chacune :
sc stop oi6u7aimx
sc delete oi6u7aimx
Je dois copier chacune de ces notes dans le bloc note ?
Et je les sauvegarde sous quel nom ?

Vraiment désolée de vous ennuyer autant mais je ne vous suis pas bien par contre, si je m'en sors, auriez vous un bon anti virus à me conseiller ? Merci

J'ai refait Malwarebytes, mise à jour et annalyse
Voici le rapport mais je n'ai pas fait l'opération précedente que je ne comprends pas

Malwarebytes' Anti-Malware 1.41
Version de la base de données: 2805
Windows 5.1.2600 Service Pack 3

15/09/2009 23:51:13
mbam-log-2009-09-15 (23-51-13).txt

Type de recherche: Examen rapide
Eléments examinés: 91829
Temps écoulé: 4 minute(s), 58 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\asc3550p (Rootkit.Agent) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

re,
Je ne m'en sors vraiment pas, aujourd'hui en allumant mon PC, nouveau virus, je vous envoie le rapport de AVAST

16/09/2009 14:23:34 SYSTEM 2024 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\TEMP\tofouhowo.exe" file.
16/09/2009 14:23:31 SYSTEM 2024 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\Documents and Settings\LocalService\Application Data\Microsoft\typamuze.exe" file.
16/09/2009 14:23:20 SYSTEM 2024 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\TEMP\gyje.exe" file.
16/09/2009 14:23:17 SYSTEM 2024 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\Documents and Settings\LocalService\Application Data\Microsoft\typamuze.exe" file.
16/09/2009 14:23:06 SYSTEM 2024 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\TEMP\houtto.exe" file.
16/09/2009 14:23:02 SYSTEM 2024 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\Documents and Settings\LocalService\Application Data\Microsoft\typamuze.exe" file.
16/09/2009 14:22:51 SYSTEM 2024 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\TEMP\cabovydoon.exe" file.
16/09/2009 14:22:44 SYSTEM 2024 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\Documents and Settings\LocalService\Application Data\Microsoft\typamuze.exe" file.
16/09/2009 14:22:23 SYSTEM 2024 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\TEMP\noudikasat.exe" file.
16/09/2009 14:22:12 SYSTEM 2024 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\Documents and Settings\LocalService\Application Data\Microsoft\typamuze.exe" file.
15/09/2009 16:27:18 bea 2024 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\WINDOWS\system32\vatoos.exe" file.
13/09/2009 19:35:47 bea 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\boze.exe" file.
13/09/2009 19:33:46 bea 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\typamuze.exe" file.
12/09/2009 20:00:06 SYSTEM 2032 Sign of "Win32:Adware-gen [Adw]" has been found in "D:\logiciel\MessengerSkinner_setup.exe" file.
11/09/2009 19:24:22 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\vepeh.exe" file.
11/09/2009 19:24:09 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
11/09/2009 19:23:24 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\cuttyssez.exe" file.
11/09/2009 19:23:13 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
11/09/2009 19:23:00 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\toommijozo.exe" file.
11/09/2009 19:22:48 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
11/09/2009 19:22:05 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\tozojywo.exe" file.
11/09/2009 19:21:57 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
11/09/2009 19:21:47 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\bynnuzabyk.exe" file.
11/09/2009 19:21:38 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
11/09/2009 19:20:14 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\hofog.exe" file.
11/09/2009 19:20:07 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
11/09/2009 19:17:48 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\kyhohouwiv.exe" file.
11/09/2009 19:17:41 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
11/09/2009 19:17:14 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\poukupoubot.exe" file.
11/09/2009 19:17:04 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
11/09/2009 19:16:53 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\micolajoun.exe" file.
11/09/2009 19:16:35 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
11/09/2009 19:16:08 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\luheboovyt.exe" file.
11/09/2009 19:15:57 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
11/09/2009 19:14:54 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\nebuqu.exe" file.
11/09/2009 19:14:45 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
11/09/2009 19:14:01 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\sewivek.exe" file.
11/09/2009 19:13:52 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
11/09/2009 19:13:41 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\woquefygud.exe" file.
11/09/2009 19:13:27 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
11/09/2009 19:11:08 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\wahoo.exe" file.
11/09/2009 19:10:58 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
11/09/2009 19:09:28 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\nozyjij.exe" file.
11/09/2009 19:09:19 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
11/09/2009 19:07:43 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\wahaloosood.exe" file.
11/09/2009 19:07:35 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
11/09/2009 19:07:26 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\dookozou.exe" file.
11/09/2009 19:07:02 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
11/09/2009 19:06:46 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
11/09/2009 19:06:46 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
11/09/2009 19:06:06 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\dyttaby.exe" file.
11/09/2009 19:05:55 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
11/09/2009 19:02:57 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\quubiquul.exe" file.
11/09/2009 19:02:48 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
11/09/2009 19:01:45 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\dikecoloor.exe" file.
11/09/2009 19:01:36 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
11/09/2009 18:58:53 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\zidevu.exe" file.
11/09/2009 18:58:45 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
11/09/2009 18:58:09 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\jofucoon.exe" file.
11/09/2009 18:58:01 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
11/09/2009 18:57:35 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\poulo.exe" file.
11/09/2009 18:57:28 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
11/09/2009 18:57:19 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\jyjoucif.exe" file.
11/09/2009 18:57:11 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
11/09/2009 18:52:44 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\dousou.exe" file.
11/09/2009 18:52:29 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
11/09/2009 18:52:02 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\foomoufodaf.exe" file.
11/09/2009 18:51:54 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
11/09/2009 18:51:44 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\hooka.exe" file.
11/09/2009 18:51:34 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
11/09/2009 18:50:33 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\tuge.exe" file.
11/09/2009 18:50:25 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
11/09/2009 18:50:17 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\metola.exe" file.
11/09/2009 18:50:09 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
11/09/2009 18:50:02 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\jajicuzev.exe" file.
11/09/2009 18:47:18 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
11/09/2009 18:45:08 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\nequoonnacou.exe" file.
11/09/2009 18:45:00 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
11/09/2009 18:44:50 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\duttelyki.exe" file.
11/09/2009 18:44:39 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
11/09/2009 18:44:13 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\roojyh.exe" file.
11/09/2009 18:44:04 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
11/09/2009 18:43:54 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\kougozugo.exe" file.
11/09/2009 18:43:46 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
11/09/2009 18:43:21 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\patim.exe" file.
11/09/2009 18:20:10 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
11/09/2009 18:18:17 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\hoowa.exe" file.
11/09/2009 18:18:08 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
11/09/2009 18:17:28 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\gybelih.exe" file.
11/09/2009 18:17:20 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
11/09/2009 18:16:54 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\wozos.exe" file.
11/09/2009 18:16:44 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
11/09/2009 18:16:16 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\cisyh.exe" file.
11/09/2009 17:48:35 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
11/09/2009 17:45:17 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\gouralo.exe" file.
11/09/2009 17:45:08 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
11/09/2009 17:36:40 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\gicoujec.exe" file.
11/09/2009 17:32:04 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
11/09/2009 17:24:00 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\sujou.exe" file.
11/09/2009 17:23:52 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
11/09/2009 17:23:44 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\poulevous.exe" file.
11/09/2009 17:07:56 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
11/09/2009 17:05:03 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\roupoonnoom.exe" file.
10/09/2009 20:44:33 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
10/09/2009 18:29:02 bea 2036 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\zapoquosoog.exe" file.
10/09/2009 18:28:58 bea 2036 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
10/09/2009 18:28:46 bea 2036 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\zuduwoosou.exe" file.
10/09/2009 18:28:45 bea 2036 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
10/09/2009 18:28:38 bea 2036 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\quari.exe" file.
10/09/2009 18:28:37 bea 2036 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\quari.exe" file.
10/09/2009 18:28:29 bea 2036 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
10/09/2009 18:28:21 bea 2036 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\souzyzafi.exe" file.
10/09/2009 18:28:11 bea 2036 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
10/09/2009 18:27:11 bea 2036 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\kuvadu.exe" file.
10/09/2009 18:27:04 bea 2036 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
10/09/2009 18:26:53 bea 2036 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\joummegyzud.exe" file.
10/09/2009 18:26:46 bea 2036 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
10/09/2009 18:26:39 bea 2036 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\fijan.exe" file.
10/09/2009 18:26:37 bea 2036 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
10/09/2009 18:26:31 bea 2036 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\fytoo.exe" file.
10/09/2009 18:26:21 bea 2036 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
10/09/2009 18:26:13 bea 2036 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\borejezu.exe" file.
10/09/2009 18:26:11 bea 2036 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
10/09/2009 18:26:04 bea 2036 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\kudaj.exe" file.
10/09/2009 18:25:57 bea 2036 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
10/09/2009 18:25:48 bea 2036 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\zoupi.exe" file.
10/09/2009 18:25:39 bea 2036 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
10/09/2009 18:25:30 bea 2036 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\touzytooquoc.exe" file.
10/09/2009 18:25:23 bea 2036 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
10/09/2009 18:25:17 bea 2036 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\vypezo.exe" file.
10/09/2009 18:25:15 bea 2036 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
10/09/2009 18:25:07 bea 2036 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\soulequi.exe" file.
10/09/2009 18:25:00 bea 2036 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
10/09/2009 18:24:51 bea 2036 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\dekisurouj.exe" file.
10/09/2009 18:22:39 bea 2036 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
10/09/2009 18:08:56 bea 2036 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\souwuqu.exe" file.
10/09/2009 16:44:30 bea 2036 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
10/09/2009 16:40:51 bea 3936 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\jewovir.exe" file.
10/09/2009 16:32:16 bea 2036 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\webiquoute.exe" file.
10/09/2009 16:22:02 bea 2036 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
10/09/2009 16:20:45 bea 2036 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\kouwakov.exe" file.
10/09/2009 16:20:18 bea 2036 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
10/09/2009 16:09:43 bea 2036 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\hyki.exe" file.
10/09/2009 16:09:36 bea 2036 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
10/09/2009 16:09:27 bea 3936 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\Documents and Settings\LocalService\Application Data\Microsoft\quoucezoozyp.exe" file.
10/09/2009 16:09:23 bea 3936 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\Documents and Settings\LocalService\Application Data\Microsoft\nalam.exe" file.
10/09/2009 16:09:22 bea 2036 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\hodi.exe" file.
10/09/2009 16:02:49 bea 2036 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
10/09/2009 15:31:01 bea 3936 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\Documents and Settings\LocalService\Application Data\Microsoft\coumad.exe" file.
10/09/2009 15:19:58 bea 3936 Sign of "Win32:SkiMorph [Cryp]" has been found in "C:\Documents and Settings\bea\Local Settings\Application Data\cscomwk.exe" file.
10/09/2009 15:17:32 bea 3936 Sign of "Other:Malware-gen" has been found in "C:\Documents and Settings\bea\Application Data\Sun\Java\Deployment\cache\6.0\51\25d09bb3-2e5efa84" file.
10/09/2009 15:17:00 bea 2036 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\muboof.exe" file.
10/09/2009 15:16:06 bea 2036 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
10/09/2009 15:06:35 bea 2036 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\wosoosso.exe" file.
10/09/2009 12:45:23 bea 2036 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
10/09/2009 12:28:06 bea 2036 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\roohoopu.exe" file.
10/09/2009 12:27:35 bea 2036 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
10/09/2009 12:15:34 bea 2036 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\tatti.exe" file.
10/09/2009 12:15:34 bea 2036 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\tatti.exe" file.
10/09/2009 12:10:22 bea 2036 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
10/09/2009 12:02:28 bea 2036 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\gaquofa.exe" file.
10/09/2009 12:00:10 bea 2036 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
10/09/2009 11:44:52 SYSTEM 2028 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\boolougoos.exe" file.
10/09/2009 11:44:43 SYSTEM 2028 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
10/09/2009 11:44:33 SYSTEM 2028 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\pydooli.exe" file.
10/09/2009 11:43:47 SYSTEM 2028 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
10/09/2009 11:41:35 SYSTEM 2028 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\hoojoopiqu.exe" file.
10/09/2009 11:41:22 SYSTEM 2028 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
10/09/2009 11:37:01 SYSTEM 2028 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\fouquijypuw.exe" file.
10/09/2009 11:36:40 SYSTEM 2028 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
10/09/2009 11:33:06 SYSTEM 2028 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\futta.exe" file.
10/09/2009 11:32:36 SYSTEM 2028 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
10/09/2009 11:32:11 SYSTEM 2028 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\nufenousej.exe" file.
10/09/2009 11:31:34 SYSTEM 2028 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
10/09/2009 11:26:55 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\pequapywou.exe" file.
10/09/2009 11:26:42 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
10/09/2009 11:26:10 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\cehoup.exe" file.
10/09/2009 11:25:52 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
10/09/2009 11:16:38 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\cumouj.exe" file.
10/09/2009 08:54:44 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
10/09/2009 08:52:46 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\DOCUME~1\bea\LOCALS~1\Temp\ciwufoowu.exe" file.
10/09/2009 03:15:07 SYSTEM 2032 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
10/09/2009 03:11:18 SYSTEM 196 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
09/09/2009 17:56:54 SYSTEM 196 Sign of "Win32:Kryptik-BE [Trj]" has been found in "C:\WINDOWS\system32\wydoujook.exe" file.
09/09/2009 17:13:55 SYSTEM 196 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\Documents and Settings\LocalService\Application Data\Microsoft\sunuroma.exe" file.
05/09/2009 16:17:43 SYSTEM 232 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\Documents and Settings\LocalService\Application Data\Microsoft\sunuroma.exe" file.

Re,

VOici le nouveau rapport, impoosible de le faire avant car neuf box déconnectée en permanence. Est-ce que cela a un rapport avec les virus ????
Merci

wahozyh.exe not deleting
quequouvypoqu.exe IS deleting

BOnjour MIke,
Voici le 1er rapport fait par Navilog 1 (d'Il Mafioso)
Je vous précise que lorsque le bloc note s'est affiché sur l'écran après redémarrage automatique du système, une fenêtre Microsoft ne faisait que s'ouvrir en me disant qu'un sérieux problème a été réparé par .... envoyer le rapport d'erreurJ'ai eu beau l'envoyer la fenêtre continue en s'ouvrir avec le même discours.
Je vous poste un peu plus tard, le rapport de CCLEANER
Merci

Fix Navipromo version 4.0.2 commencé le 15/09/2009 15:43:52,31

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!

Outil exécuté depuis C:\Program Files\navilog1

Mise à jour le 27.08.2009 à 11h00 par IL-MAFIOSO

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : AMD Sempron(tm) Processor 3200+ )
BIOS : BIOS Date: 08/10/07 10:04:22 Ver: 08.00.12
USER : bea ( Administrator )
BOOT : Normal boot

Antivirus : avast! antivirus 4.8.1351 [VPS 090914-0] 4.8.1351 (Not Activated)

A:\ (USB)
C:\ (Local Disk) - NTFS - Total:18 Go (Free:4 Go)
D:\ (Local Disk) - NTFS - Total:96 Go (Free:17 Go)
E:\ (CD or DVD)

Recherche executée en mode normal

Nettoyage exécuté au redémarrage de l'ordinateur

C:\Program Files\MessengerSkinner supprimé !
C:\Documents and Settings\All Users\menudm~1\progra~1\MessengerSkinner supprimé !
C:\Documents and Settings\bea\applic~1\MessengerSkinner supprimé !
C:\WINDOWS\system32\nvs2.inf supprimé !
c:\docume~1\bea\locals~1\applic~1\gmseykfxl.dat supprimé !
c:\docume~1\bea\locals~1\applic~1\gmseykfxl_nav.dat supprimé !
c:\docume~1\bea\locals~1\applic~1\gmseykfxl_navps.dat supprimé !
c:\docume~1\bea\locals~1\applic~1\ywssoqs.dat supprimé !
c:\docume~1\bea\locals~1\applic~1\ywssoqs_nav.dat supprimé !
c:\docume~1\bea\locals~1\applic~1\ywssoqs_navps.dat supprimé !

Nettoyage contenu C:\WINDOWS\Temp effectué !
Nettoyage contenu C:\Documents and Settings\bea\locals~1\Temp effectué !

*** Sauvegarde du Registre vers dossier Safebackup ***

sauvegarde du Registre réalisée avec succès !

*** Nettoyage Registre ***

Nettoyage Registre Ok

Certificat Egroup supprimé !
Certificat Electronic-Group supprimé !
Certificat OOO-Favorit supprimé !

*** Scan terminé 15/09/2009 15:52:46,67 ***

Re,

Voici de second rapport, je vous précise que depuis que j'ai fait ces 3 opérations
- Navilog 1
- CCleaner et
- malwarebytes
ma connection internet ne tient plus du tout, je suis obligée sans arrêt
- d'éteindre mon PC,
- de couper l'alimentation de ma neuf box
- attendre que les voyants de la neuf box se rallument (ça ne marche pas à chaque fois)
et espèrer que la connexion se fasse
D'où peut venir ce problème, depuis des années, ce n'est jamais arrivé. C'est la cata !!!!

BOn voici le rapport :

Malwarebytes' Anti-Malware 1.41
Version de la base de données: 2803
Windows 5.1.2600 Service Pack 3

15/09/2009 17:30:27
mbam-log-2009-09-15 (17-30-27).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 174965
Temps écoulé: 1 hour(s), 9 minute(s), 39 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 2
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1a93c934-025b-4c3a-b38e-9654a7003239} (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6f282b65-56bf-4bd1-a8b2-a4449a05863d} (Adware.Gamesbar) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ctfxmon.exe (Trojan.Agent) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\WINDOWS\ctfxmon.dll (Trojan.Agent) -> Quarantined and deleted successfully.

Je vous tiens au courant de la suite

Encore merci
Béatrice

Re,
voici le 3° rapport de RSIT

Logfile of random's system information tool 1.06 (written by random/random)
Run by bea at 2009-09-15 19:19:13
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 6 GB (30%) free of 19 GB
Total RAM: 895 MB (57% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:19:24, on 15/09/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16876)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb06.exe
C:\WINDOWS\Philips\SPC220NC\Monitor.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\wahozyh.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\GEARSec.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Symantec\Norton Ghost\Agent\PQV2iSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\bea\Bureau\RSIT.exe
C:\Program Files\trend micro\bea.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfree.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: IEPlugin Class - {11222041-111B-46E3-BD29-EFB2449479B1} - C:\PROGRA~1\ArcSoft\MEDIAC~1.5FO\STREAM~1\ARCURL~1.DLL
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfree.dll
O3 - Toolbar: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfree.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb06.exe
O4 - HKLM\..\Run: [Monitor] C:\WINDOWS\Philips\SPC220NC\Monitor.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [wodecy] C:\WINDOWS\system32\quequouvypoqu.exe
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Yahoo! Widgets.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Créer un Favori de l'appareil mobile - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Register/Branding/olr3313/OCX/v1018/flashax.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://plugin.driveragent.com/files/driveragent.cab
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Symantec\Norton Ghost\Agent\PQV2iSvc.exe
O23 - Service: Asset Management Daemon (oi6u7aimx) - Unknown owner - C:\WINDOWS\system32\wahozyh.exe
O23 - Service: TomTomHOMEService - TomTom - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe

BOnsoir,
je viens de faire la première opération RELANCER HIJACKTHISj'ai coché les cases comme indiqué puis fait FIX CHECKEDmais là une fenêtre m'a demandée voulez vous enlever ou/et réparer ces 9 élementsj'ai répondu ouiet là, rien ne suis quand je vais dans le gestionnaire de tâches (seconde opération à faire), les fichiers QUEQUOUVYPOQU.EXEet tous les autres indiquées, n'existent plus, j'ai du faire une erreur en répondant oui
Je ne sais plus quoi faire maintenant

avant de faire une bétise car les explications sont très longues pour une presque novice, pouvez-vous me dire ce qu'est Relancez HijackThis car je ne connais pas ce programme ou application. dois-je le télécharger ?
Merci
J'attends de vos nouvelles car aujourd'hui, c'est exactement pareil, toutes les 10 secondes, AVAST me dit que mon PC est infcté
Merci beaucoup

Mike,
Je suis vraiment désolée mais je n'y arrive pas, je suis allée jusqu'à cette partie de la procédure (post6)

Ouvrer le Bloc-note dans le Menu Démarrer --> Tout les programmes --> Accessoire,
• Copier/ coller le contenu de la Citation suivante dans le Bloc-Note,
• Dans le bloc-note sélectionner -> Fichier -> Enregistrer sous..
• Sauvegarder le Bloc-Note sous SupVir.Bat (sur le bureau)
• Double-cliquer sur le fichier SupVir.Bat

mais quand je double clic sur le fichier SupVir.Bat qui se trouve sur mon bureau, la page s'ouvre à la vitesse de l'éclair puis se referme aussitôt. Je ne peux rien lire

Ensuite vous me demandez d'aller vérifier si les fichiers de la citation ont été supprimés mais je ne sais pas où aller les chercher pour contrôler (j'ai au préalable affiché les fichiers et répertoires cachés)
POuvez-vous me guider.
D'avance merci
Béatrice

Désolée, je ne comprend pas tout. Là, toute les les 1s secondes AVAST me dit que j'ai un virus, je peux tout juste écrire le message. Qu'est-ce que je fais ?????????? au secours, ça bippe de partout

Je crois avoir compris ton explication, voici le rapport :

Logfile of random's system information tool 1.06 (written by random/random)
Run by bea at 2009-09-10 18:33:12
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 5 GB (24%) free of 19 GB
Total RAM: 895 MB (44% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:33:29, on 10/09/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16876)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
C:\WINDOWS\Philips\SPC220NC\Monitor.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\WINDOWS\system32\foommul.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe
C:\Program Files\Philips\Philips SPC220NC Webcam\TrayMin220.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\GEARSec.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Symantec\Norton Ghost\Agent\PQV2iSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Java\jre6\bin\jucheck.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Apple Software Update\SoftwareUpdate.exe
C:\Program Files\Fichiers communs\Adobe\Updater5\AdobeUpdater.exe
C:\Documents and Settings\bea\Local Settings\Temporary Internet Files\Content.IE5\D6GWYHVK\RSIT[1].exe
C:\Program Files\trend micro\bea.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfree.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: IEPlugin Class - {11222041-111B-46E3-BD29-EFB2449479B1} - C:\PROGRA~1\ArcSoft\MEDIAC~1.5FO\STREAM~1\ARCURL~1.DLL
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfree.dll
O3 - Toolbar: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfree.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb06.exe
O4 - HKLM\..\Run: [Monitor] C:\WINDOWS\Philips\SPC220NC\Monitor.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM\..\Run: [wodecy] C:\WINDOWS\system32\quequouvypoqu.exe
O4 - HKLM\..\Run: [soubedooj] C:\WINDOWS\system32\foommul.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [nyryboor] C:\WINDOWS\system32\quoucezoozyp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [gmseykfxl] c:\documents and settings\bea\local settings\application data\gmseykfxl.exe gmseykfxl
O4 - HKCU\..\Run: [messengerskinner] C:\Program Files\MessengerSkinner\MessengerSkinner.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [ywssoqs] "c:\documents and settings\bea\local settings\application data\ywssoqs.exe" ywssoqs
O4 - HKCU\..\Run: [ctfxmon.exe] C:\WINDOWS\ctfxmon.exe
O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Yahoo! Widgets.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
O4 - Global Startup: TrayMin220.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Créer un Favori de l'appareil mobile - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} (Creative Toolbox Plug-in) - http://kiw.imgag.com/imgag/cp/install/crusher-kiwen.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Register/Branding/olr3313/OCX/v1018/flashax.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://plugin.driveragent.com/files/driveragent.cab
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Fichiers communs\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Symantec\Norton Ghost\Agent\PQV2iSvc.exe
O23 - Service: Asset Management Daemon (oi6u7aimx) - Unknown owner - C:\WINDOWS\system32\wahozyh.exe
O23 - Service: TomTomHOMEService - TomTom - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe

mike, est-ce que vous êtes là ??????????????????