Virus startdrv.exe

raph1992 -  
Bonjour,à tous!! J'ai un gros problème, depuis quelque temps j'ai un virus nommé "startdrv.exe" et celui-ci est situé dans le dossier C:\Windows\temp mais mon antivirus n'arrive pas à le supprimer, ni à le mettre en quarantaine!! on m'a déjà dit de faire un démarrage en mode sans échec et d'activer spybot et adaware et mon antivirus mais cela n'a rien changé!! S.v.p j'ai vraiment besoin d'aide car mon pc n'avance plus très vite et c'est vraiment énervant!!
Je vous remercie d'avance ;) a+
Configuration: Windows XP
Internet Explorer 7.0

10 réponses

  • Votes
  • Date
  • Date décroissante
  1. Lyonnais92 Contributeur sécurité
    Bonjour

    redémarre l'ordi

    Télécharge ceci: (by Moe) :

    http://sosvirus.changelog.fr/Green_day/Lopxpsetup.exe

    Double clic sur Lopxpsetup.exe pour lancer l'installation
    Au menu, choisir l'option 1
    Patienter jusqu'à que l'on demande d'appuyer sur une touche, appuyer !
    Une rapport sera alors crée, à copie/colle en entier sur le forum

    Remets aussi un rapport Hijackthis

    pas de problème avec des pubs CID ?
    1. raph1992
      ComboFix 07-12-15.5 - HP_Administrateur 2007-12-20 10:14:38.2 - NTFSx86
      Microsoft Windows XP Professionnel 5.1.2600.2.1252.32.1036.18.434 [GMT 1:00]
      Running from: C:\Documents and Settings\HP_Administrateur\Bureau\ComboFix.exe
      .

      ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-11-20 to 2007-12-20 ))))))))))))))))))))))))))))))))))))
      .

      2007-12-16 19:46 . 2007-12-16 19:58 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe
      2007-12-16 19:46 . 2007-12-17 17:28 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
      2007-12-16 19:45 . 2007-12-17 17:27 103,736 --a------ C:\WINDOWS\system32\PnkBstrB.exe
      2007-12-16 11:19 . 2007-12-16 11:19 <REP> d-------- C:\WINDOWS\ERUNT
      2007-12-15 15:34 . 2007-12-15 15:34 <REP> d-------- C:\Program Files\Trend Micro
      2007-12-15 15:08 . 2007-05-16 16:45 3,497,832 --a------ C:\WINDOWS\system32\d3dx9_34.dll
      2007-12-15 15:08 . 2007-05-16 16:45 1,124,720 --a------ C:\WINDOWS\system32\D3DCompiler_34.dll
      2007-12-15 15:08 . 2007-05-16 16:45 443,752 --a------ C:\WINDOWS\system32\d3dx10_34.dll
      2007-12-15 15:08 . 2007-06-20 20:46 266,088 --a------ C:\WINDOWS\system32\xactengine2_8.dll
      2007-12-15 15:08 . 2007-06-20 20:45 18,280 --a------ C:\WINDOWS\system32\x3daudio1_2.dll
      2007-12-13 06:19 . 2007-12-13 06:19 <REP> d-------- C:\Program Files\iPod
      2007-12-13 06:19 . 2007-12-20 10:10 54,156 --ah----- C:\WINDOWS\QTFont.qfn
      2007-12-13 06:19 . 2007-12-13 06:19 1,409 --a------ C:\WINDOWS\QTFont.for
      2007-12-13 06:18 . 2007-12-13 06:19 <REP> d-------- C:\Program Files\iTunes
      2007-12-13 06:16 . 2007-12-13 06:17 <REP> d-------- C:\Program Files\QuickTime
      2007-12-12 16:27 . 2007-12-12 16:31 1,393 --a------ C:\WINDOWS\imsins.BAK
      2007-12-02 21:56 . 2007-12-02 21:56 <REP> d-------- C:\Program Files\DVD Decrypter
      2007-11-30 22:19 . 2007-11-30 22:19 <REP> d-------- C:\Program Files\Windows Live Favorites
      2007-11-22 21:03 . 2007-11-22 21:03 <REP> d-------- C:\Documents and Settings\HP_Administrateur\Application Data\Grisoft
      2007-11-22 21:02 . 2007-11-22 21:02 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
      2007-11-22 21:02 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
      2007-11-20 15:06 . 2007-11-20 15:06 <REP> d-------- C:\Documents and Settings\All Users\SonicStage
      2007-11-20 14:49 . 2001-09-13 02:15 90,112 --------- C:\WINDOWS\snymsico.dll
      2007-11-20 14:49 . 2002-08-08 15:51 38,951 --------- C:\WINDOWS\system32\drivers\NETMDUSB.sys
      2007-11-20 14:49 . 2005-10-31 10:46 36,679 --------- C:\WINDOWS\system32\drivers\NETMD052.sys
      2007-11-20 14:49 . 2003-11-10 12:31 36,232 --------- C:\WINDOWS\system32\drivers\NETMD033.sys
      2007-11-20 14:49 . 2003-04-01 18:55 35,319 --------- C:\WINDOWS\system32\drivers\NETMD031.sys
      2007-11-20 14:48 . 2007-11-20 14:48 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Sony Corporation
      2007-11-20 14:48 . 2007-01-13 08:24 770,048 --a------ C:\WINDOWS\system32\CDDBUISony.dll
      2007-11-20 14:48 . 2007-01-13 08:22 655,360 --a------ C:\WINDOWS\system32\CDDBControlSony.dll
      2007-11-20 14:48 . 2007-01-13 08:22 589,824 --a------ C:\WINDOWS\system32\CddbMusicIDSony.dll
      2007-11-20 14:48 . 2007-01-13 08:25 532,480 --a------ C:\WINDOWS\system32\CddbPlaylist2Sony.dll
      2007-11-20 14:48 . 2006-10-18 16:30 129,784 --------- C:\WINDOWS\system32\pxafs.dll
      2007-11-20 14:48 . 2007-01-13 08:27 98,304 --a------ C:\WINDOWS\system32\CddbLangFRSony.dll
      2007-11-20 14:48 . 2007-01-13 08:24 73,728 --a------ C:\WINDOWS\system32\CddbLinkSony.dll
      2007-11-20 14:47 . 2007-11-20 14:49 <REP> d-------- C:\Program Files\Sony
      2007-11-20 14:46 . 2007-11-20 14:47 <REP> d-------- C:\Program Files\Fichiers communs\Sony Shared
      2007-11-20 14:46 . 2007-11-20 15:06 <REP> d-------- C:\Documents and Settings\HP_Administrateur\Application Data\Sony Corporation

      .
      (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
      .
      2007-12-20 09:10 --------- d-----w C:\Program Files\SP2 Connection Patcher
      2007-12-19 09:21 --------- d-----w C:\Program Files\eMule
      2007-12-15 14:08 --------- d-----w C:\Program Files\Electronic Arts
      2007-12-01 02:10 --------- d-----w C:\Program Files\Windows Live Toolbar
      2007-11-23 13:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
      2007-11-20 13:49 --------- d--h--w C:\Program Files\InstallShield Installation Information
      2007-11-17 10:33 --------- d-----w C:\Program Files\PartyGaming
      2007-11-16 14:40 --------- d-----w C:\Program Files\DivX
      2007-11-16 14:39 --------- d-----w C:\Program Files\ANI
      2007-11-16 14:37 --------- d-----w C:\Program Files\Fichiers communs\Adobe
      2007-11-15 20:45 --------- d-----w C:\Program Files\Fichiers communs\BitDefender
      2007-11-13 13:41 --------- d-----w C:\Program Files\Red Kawa
      2007-11-13 13:41 --------- d-----w C:\Program Files\AviSynth 2.5
      2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
      2007-11-12 05:35 --------- d-----w C:\Program Files\Adverts
      2007-10-31 13:09 30,464 ----a-w C:\WINDOWS\system32\drivers\usbaapl.sys
      2007-10-28 12:34 --------- d-----w C:\Program Files\BitDefender
      2007-10-26 21:32 --------- d-----w C:\Program Files\MSN Messenger
      2007-10-26 21:32 --------- d-----w C:\Program Files\Messenger Plus! Live
      2007-10-25 13:15 --------- d-----w C:\Documents and Settings\HP_Administrateur\Application Data\temp
      2007-10-23 13:47 --------- d-----w C:\Program Files\Ubisoft
      2007-10-22 13:07 --------- d-----w C:\Program Files\DAEMON Tools
      2007-10-22 12:14 --------- d-----w C:\Program Files\Macrogaming
      2007-10-22 12:10 --------- d-----w C:\Program Files\Jasc Software Inc
      2007-10-22 12:05 --------- d-----w C:\Program Files\BoontyGames
      2007-10-22 12:04 --------- d-----w C:\Program Files\Boonty
      2007-10-22 11:53 --------- d-----w C:\Program Files\Ashampoo
      2007-09-11 16:56 0 ----a-w C:\Documents and Settings\HP_Administrateur\Application Data\wklnhst.dat
      2007-03-10 09:32 384 ----a-w C:\Documents and Settings\HP_Administrateur\Application Data\internaldb6334.dat
      2007-03-10 09:31 194 ----a-w C:\Documents and Settings\HP_Administrateur\Application Data\internaldb8467.dat
      2007-03-10 09:31 18,432 ----a-w C:\Documents and Settings\HP_Administrateur\Application Data\internaldb41.dat
      2007-03-01 21:09 22 --sha-w C:\WINDOWS\SMINST\HPCD.sys
      2007-01-31 17:50 8 --sh--r C:\WINDOWS\system32\CD41767FEB.sys
      2007-01-31 17:50 2,514 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
      .

      ((((((((((((((((((((((((((((( snapshot@2007-12-15_16.23.21.32 )))))))))))))))))))))))))))))))))))))))))
      .
      + 2007-12-13 12:23:35 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
      + 2007-12-16 10:19:17 6,086,656 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT
      + 2007-12-16 10:19:17 192,512 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat
      + 2007-12-13 12:23:35 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE
      + 2007-12-16 10:19:15 6,086,656 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT
      + 2007-12-16 10:19:16 192,512 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat
      - 2007-08-11 14:59:28 108,144 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
      + 2007-12-15 16:10:15 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
      .
      ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
      .
      .
      REGEDIT4
      *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 05:00]
      "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-31 19:11]
      "msnmsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 11:55]
      "SP2 Connection Patcher"="C:\Program Files\SP2 Connection Patcher\SP2ConnPatcher.exe" [2005-07-11 12:51]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-05 12:34]
      "ftutil2"="ftutil2.dll" [2004-06-07 06:05 C:\WINDOWS\system32\ftutil2.dll]
      "RTHDCPL"="RTHDCPL.EXE" [2006-07-21 17:56 C:\WINDOWS\RTHDCPL.EXE]
      "IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2006-02-21 18:59]
      "NvCplDaemon"="RUNDLL32.exe" [2004-08-10 05:00 C:\WINDOWS\system32\rundll32.exe]
      "nwiz"="nwiz.exe" [2006-06-20 18:06 C:\WINDOWS\system32\nwiz.exe]
      "Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2005-07-22 14:14]
      "HPBootOp"="C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2006-02-15 14:34]
      "HP Software Update"="C:\Program Files\HP\HP Software Update\HPwuSchd2.exe" [2005-02-16 22:11]
      "HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe" [2001-11-15 18:05]
      "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-11-12 11:48]
      "McAfeeUpdaterUI"="C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" [2004-08-06 03:50]
      "ISUSPM Startup"="C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 15:50]
      "ShStatEXE"="C:\Program Files\Network Associates\VirusScan\SHSTAT.exe" [2004-08-25 08:00]
      "Network Associates Error Reporting Service"="C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe" [2003-10-07 09:48]
      "Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-06-16 00:15]
      "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50]
      "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 03:00]
      "IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\point32.exe" [2003-05-16 00:41]
      "Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 15:17]
      "ANIWZCS2Service"="C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [2004-04-14 11:54]
      "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25]
      "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-11-14 23:43]
      "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-11-15 13:11]

      [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
      "InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
      "InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
      "DisableRegistryTools"= 0 (0x0)

      [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
      Authentication Packages REG_MULTI_SZ msv1_0 nwprovau

      R1 NaiAvTdi1;NaiAvTdi1;C:\WINDOWS\system32\drivers\mvstdi5x.sys
      R2 Asapi;Asapi;C:\WINDOWS\system32\drivers\Asapi.sys
      R3 usbstor;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
      S3 Boonty Games;Boonty Games;"C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe"
      S3 PRISM;D-Link Air Wireless Prism3 Adapter Driver;C:\WINDOWS\system32\DRIVERS\PRISMNDS.sys
      S3 PRISM_USB;D-Link Air Wireless USB Adapter Driver;C:\WINDOWS\system32\DRIVERS\PRISMUSB.sys
      S3 USBAAPL;Apple Mobile USB Driver;C:\WINDOWS\system32\Drivers\usbaapl.sys
      S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys
      S3 w550bus;Sony Ericsson W550 driver (WDM);C:\WINDOWS\system32\DRIVERS\w550bus.sys
      S3 w550mdfl;Sony Ericsson W550 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\w550mdfl.sys
      S3 w550mdm;Sony Ericsson W550 USB WMC Modem Drivers;C:\WINDOWS\system32\DRIVERS\w550mdm.sys

      *Newly Created Service* - ENTDRV51
      .
      Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
      "2007-12-20 10:00:00 C:\WINDOWS\Tasks\ABB364439185156B.job"
      - c:\docume~1\hp_adm~1\applic~1\joybir~1\vcmaildent.exe
      "2007-12-19 22:38:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
      - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
      "2007-12-20 09:51:01 C:\WINDOWS\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job"
      .
      **************************************************************************

      catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
      Rootkit scan 2007-12-20 11:02:32
      Windows 5.1.2600 Service Pack 2 NTFS

      scanning hidden processes ...

      scanning hidden autostart entries ...

      scanning hidden files ...

      scan completed successfully
      hidden files: 0

      **************************************************************************
      .
      Completion time: 2007-12-20 11:05:33 - machine was rebooted
      C:\ComboFix2.txt ... 2007-12-15 16:23
      .
      2007-12-12 15:36:45 --- E O F ---
      1. Lyonnais92 Contributeur sécurité
        Bonjour,

        tu peux refaire tourner Combofix et poster le rapport, merci.
        1. raph1992
          Logfile of Trend Micro HijackThis v2.0.2
          Scan saved at 12:05:21, on 16/12/2007
          Platform: Windows XP SP2 (WinNT 5.01.2600)
          MSIE: Internet Explorer v7.00 (7.00.6000.16574)
          Boot mode: Normal

          Running processes:
          C:\WINDOWS\System32\smss.exe
          C:\WINDOWS\system32\winlogon.exe
          C:\WINDOWS\system32\services.exe
          C:\WINDOWS\system32\lsass.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\System32\svchost.exe
          C:\WINDOWS\system32\spoolsv.exe
          C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
          C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
          C:\WINDOWS\eHome\ehRecvr.exe
          C:\WINDOWS\eHome\ehSched.exe
          C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
          C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
          C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
          C:\Program Files\Network Associates\VirusScan\Mcshield.exe
          C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
          C:\WINDOWS\system32\nvsvc32.exe
          C:\WINDOWS\system32\HPZipm12.exe
          C:\Program Files\Electronic Arts\Need for Speed ProStreet\PB\PnkBstrA.exe
          C:\WINDOWS\system32\svchost.exe
          C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology Drivers\Elservice.exe
          C:\WINDOWS\Explorer.EXE
          C:\WINDOWS\system32\dllhost.exe
          C:\WINDOWS\ehome\ehtray.exe
          C:\WINDOWS\eHome\ehmsas.exe
          C:\WINDOWS\RTHDCPL.EXE
          C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
          C:\WINDOWS\system32\rundll32.exe
          C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
          C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
          C:\Program Files\DAEMON Tools\daemon.exe
          C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
          C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
          C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe
          C:\Program Files\Picasa2\PicasaMediaDetector.exe
          C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
          C:\Program Files\Microsoft IntelliPoint\point32.exe
          C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
          C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
          C:\Program Files\Fichiers communs\Teleca Shared\CapabilityManager.exe
          C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
          C:\Program Files\QuickTime\QTTask.exe
          C:\Program Files\iTunes\iTunesHelper.exe
          C:\WINDOWS\system32\ctfmon.exe
          C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
          C:\Program Files\MSN Messenger\MsnMsgr.Exe
          C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
          C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
          C:\Program Files\iPod\bin\iPodService.exe
          C:\HP\KBD\KBD.EXE
          c:\windows\system\hpsysdrv.exe
          C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
          C:\Program Files\MSN Messenger\usnsvc.exe
          C:\Program Files\Internet Explorer\IEXPLORE.EXE
          C:\Program Files\Windows Live Toolbar\msn_sl.exe
          C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
          R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
          R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
          R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
          O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
          O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
          O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
          O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
          O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
          O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
          O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
          O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
          O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
          O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode
          O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
          O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
          O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
          O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
          O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
          O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
          O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
          O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
          O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
          O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
          O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
          O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
          O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe"
          O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
          O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
          O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
          O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
          O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
          O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
          O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
          O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
          O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
          O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
          O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
          O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
          O4 - HKCU\..\Run: [SP2 Connection Patcher] "C:\Program Files\SP2 Connection Patcher\SP2ConnPatcher.exe" -n=200
          O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
          O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
          O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
          O4 - .DEFAULT User Startup: PinMcLnk.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
          O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
          O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
          O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
          O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
          O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
          O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
          O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
          O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
          O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
          O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
          O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
          O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
          O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
          O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
          O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
          O16 - DPF: {4CCA4E6B-9259-11D9-AC6E-444553544200} (FixController Control) - http://h30155.www3.hp.com/ediags/dd/install/HPInstallMgr_v01.cab
          O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
          O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
          O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
          O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
          O23 - Service: Intel(R) Quick Resume technology (ELService) - Intel Corporation - C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology Drivers\Elservice.exe
          O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
          O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
          O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
          O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
          O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
          O23 - Service: Service Framework McAfee (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
          O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
          O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
          O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
          O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
          O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
          O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
          O23 - Service: PunkBuster (PnkBstrA) - Unknown owner - C:\Program Files\Electronic Arts\Need for Speed ProStreet\PB\PnkBstrA.exe
          O23 - Service: SonicStage Back-End Service - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SsBeSvc.exe
          O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
          O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe
          O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe
          2. raph1992
            Voici un truc que je viens de trouver sur mon bureau au nom de "catchme" je vous en envoie une copie
            catchme 0.3.1262.1 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
            Rootkit scan 2007-12-16 11:36:49
            Windows 5.1.2600 Service Pack 2 NTFS

            scanning hidden processes ...

            scanning hidden services & system hive ...

            [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
            "s1"=dword:873930cc
            "s2"=dword:d89c76af
            "h0"=dword:00000001

            [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
            "p0"="C:\Program Files\DAEMON Tools\"
            "h0"=dword:00000000
            "khjeh"=hex:5f,4c,b1,8e,0f,c8,a5,d0,fd,9c,a6,d6,d9,db,6d,4a,3f,02,73,d2,22,..

            [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
            "a0"=hex:20,01,00,00,f8,50,a9,58,39,c9,67,f3,f0,d6,80,c0,3c,7f,63,a1,de,..
            "khjeh"=hex:23,09,07,a1,04,38,6f,48,71,38,35,5b,95,bf,7e,6f,54,30,f1,d4,3a,..

            [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
            "khjeh"=hex:31,3d,c7,55,1b,92,45,3c,a8,d0,07,ba,e0,10,50,c5,79,ed,8e,bc,89,..
            [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
            "p0"="C:\Program Files\DAEMON Tools\"
            "h0"=dword:00000000
            "khjeh"=hex:5f,4c,b1,8e,0f,c8,a5,d0,fd,9c,a6,d6,d9,db,6d,4a,3f,02,73,d2,22,..

            [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
            "a0"=hex:20,01,00,00,f8,50,a9,58,39,c9,67,f3,f0,d6,80,c0,3c,7f,63,a1,de,..
            "khjeh"=hex:23,09,07,a1,04,38,6f,48,71,38,35,5b,95,bf,7e,6f,54,30,f1,d4,3a,..

            [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
            "khjeh"=hex:31,3d,c7,55,1b,92,45,3c,a8,d0,07,ba,e0,10,50,c5,79,ed,8e,bc,89,..

            scanning hidden registry entries ...

            scanning hidden files ...

            C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\Microsoft\Messenger\princess.celia@hotmail.com\SharingMetadata\gangsta-titi@hotmail.com\DFSR\Staging\CS{7A86AE87-B1E1-35FC-7851-CBA158896E62}\01\13-{7A86AE87-B1E1-35FC-7851-CBA158896E62}-v1-{187C90A3-1F5A-43C8-B1D7-F0EEF56D47D5}-v13-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 8 bytes hidden from API
            C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\Microsoft\Messenger\princess.celia@hotmail.com\SharingMetadata\micho@duarte.com\DFSR\Staging\CS{B26A7AE6-B5E3-8842-9032-1A114589FE59}\01\10-{B26A7AE6-B5E3-8842-9032-1A114589FE59}-v1-{187C90A3-1F5A-43C8-B1D7-F0EEF56D47D5}-v10-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 8 bytes hidden from API
            C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\Microsoft\Messenger\princess.celia@hotmail.com\SharingMetadata\princesse_nim@hotmail.com\DFSR\Staging\CS{0848B3B9-C6FE-AEA6-8A9D-BD8F9468968A}\01\12-{0848B3B9-C6FE-AEA6-8A9D-BD8F9468968A}-v1-{187C90A3-1F5A-43C8-B1D7-F0EEF56D47D5}-v12-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 8 bytes hidden from API
            C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\Microsoft\Messenger\princess.celia@hotmail.com\SharingMetadata\yan7_yeah@hotmail.com\DFSR\Staging\CS{99101B32-E71A-1778-E7AB-7BBA811D8295}\01\11-{99101B32-E71A-1778-E7AB-7BBA811D8295}-v1-{187C90A3-1F5A-43C8-B1D7-F0EEF56D47D5}-v11-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 8 bytes hidden from API
            C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\Microsoft\Messenger\raphdulux@hotmail.com\SharingMetadata\tino-berodt@hotmail.com\DFSR\Staging\CS{50689F4E-D4EC-5E9E-064E-BCABF627B89C}\01\11-{50689F4E-D4EC-5E9E-064E-BCABF627B89C}-v1-{D5C161C9-A5DE-464B-89C0-0971FCBAD875}-v11-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 8 bytes hidden from API
            C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\Microsoft\Messenger\tino-berodt@hotmail.com\SharingMetadata\barcalona_amine@hotmail.com\DFSR\Staging\CS{615BF464-8AE6-CEBE-5F68-4E947A96CFE7}\01\10-{615BF464-8AE6-CEBE-5F68-4E947A96CFE7}-v1-{8E83EF6A-3137-41C7-904F-A6A22A3E4904}-v10-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 8 bytes hidden from API
            C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\Microsoft\Messenger\tino-berodt@hotmail.com\SharingMetadata\damelisa@mail.pt\DFSR\Staging\CS{A99B4DA1-C6E5-0857-635B-79705A6E2045}\01\11-{A99B4DA1-C6E5-0857-635B-79705A6E2045}-v1-{8E83EF6A-3137-41C7-904F-A6A22A3E4904}-v11-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 8 bytes hidden from API

            scan completed successfully
            hidden processes: 0
            hidden services: 0
            hidden files: 7
            1. raph1992
              SDFix: Version 1.118

              Run by HP_Administrateur on 16/12/2007 at 11:19

              Microsoft Windows XP [version 5.1.2600]

              Running From: C:\DOCUME~1\HP_ADM~1\Bureau\SDFix

              Safe Mode:
              Checking Services:

              Restoring Windows Registry Values
              Restoring Windows Default Hosts File

              Rebooting...

              Normal Mode:
              Checking Files:

              Trojan Files Found:

              C:\LOG.TMP - Deleted

              Removing Temp Files...

              ADS Check:

              C:\WINDOWS
              No streams found.

              C:\WINDOWS\system32
              No streams found.

              C:\WINDOWS\system32\svchost.exe
              No streams found.

              C:\WINDOWS\system32\ntoskrnl.exe
              No streams found.

              Final Check:

              catchme 0.3.1262.1 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
              Rootkit scan 2007-12-16 11:36:49
              Windows 5.1.2600 Service Pack 2 NTFS

              scanning hidden processes ...

              scanning hidden services & system hive ...

              [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
              "s1"=dword:873930cc
              "s2"=dword:d89c76af
              "h0"=dword:00000001

              [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
              "p0"="C:\Program Files\DAEMON Tools\"
              "h0"=dword:00000000
              "khjeh"=hex:5f,4c,b1,8e,0f,c8,a5,d0,fd,9c,a6,d6,d9,db,6d,4a,3f,02,73,d2,22,..

              [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
              "a0"=hex:20,01,00,00,f8,50,a9,58,39,c9,67,f3,f0,d6,80,c0,3c,7f,63,a1,de,..
              "khjeh"=hex:23,09,07,a1,04,38,6f,48,71,38,35,5b,95,bf,7e,6f,54,30,f1,d4,3a,..

              [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
              "khjeh"=hex:31,3d,c7,55,1b,92,45,3c,a8,d0,07,ba,e0,10,50,c5,79,ed,8e,bc,89,..
              [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
              "p0"="C:\Program Files\DAEMON Tools\"
              "h0"=dword:00000000
              "khjeh"=hex:5f,4c,b1,8e,0f,c8,a5,d0,fd,9c,a6,d6,d9,db,6d,4a,3f,02,73,d2,22,..

              [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
              "a0"=hex:20,01,00,00,f8,50,a9,58,39,c9,67,f3,f0,d6,80,c0,3c,7f,63,a1,de,..
              "khjeh"=hex:23,09,07,a1,04,38,6f,48,71,38,35,5b,95,bf,7e,6f,54,30,f1,d4,3a,..

              [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
              "khjeh"=hex:31,3d,c7,55,1b,92,45,3c,a8,d0,07,ba,e0,10,50,c5,79,ed,8e,bc,89,..

              scanning hidden registry entries ...

              scanning hidden files ...

              C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\Microsoft\Messenger\princess.celia@hotmail.com\SharingMetadata\gangsta-titi@hotmail.com\DFSR\Staging\CS{7A86AE87-B1E1-35FC-7851-CBA158896E62}\01\13-{7A86AE87-B1E1-35FC-7851-CBA158896E62}-v1-{187C90A3-1F5A-43C8-B1D7-F0EEF56D47D5}-v13-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 8 bytes hidden from API
              C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\Microsoft\Messenger\princess.celia@hotmail.com\SharingMetadata\micho@duarte.com\DFSR\Staging\CS{B26A7AE6-B5E3-8842-9032-1A114589FE59}\01\10-{B26A7AE6-B5E3-8842-9032-1A114589FE59}-v1-{187C90A3-1F5A-43C8-B1D7-F0EEF56D47D5}-v10-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 8 bytes hidden from API
              C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\Microsoft\Messenger\princess.celia@hotmail.com\SharingMetadata\princesse_nim@hotmail.com\DFSR\Staging\CS{0848B3B9-C6FE-AEA6-8A9D-BD8F9468968A}\01\12-{0848B3B9-C6FE-AEA6-8A9D-BD8F9468968A}-v1-{187C90A3-1F5A-43C8-B1D7-F0EEF56D47D5}-v12-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 8 bytes hidden from API
              C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\Microsoft\Messenger\princess.celia@hotmail.com\SharingMetadata\yan7_yeah@hotmail.com\DFSR\Staging\CS{99101B32-E71A-1778-E7AB-7BBA811D8295}\01\11-{99101B32-E71A-1778-E7AB-7BBA811D8295}-v1-{187C90A3-1F5A-43C8-B1D7-F0EEF56D47D5}-v11-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 8 bytes hidden from API
              C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\Microsoft\Messenger\raphdulux@hotmail.com\SharingMetadata\tino-berodt@hotmail.com\DFSR\Staging\CS{50689F4E-D4EC-5E9E-064E-BCABF627B89C}\01\11-{50689F4E-D4EC-5E9E-064E-BCABF627B89C}-v1-{D5C161C9-A5DE-464B-89C0-0971FCBAD875}-v11-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 8 bytes hidden from API
              C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\Microsoft\Messenger\tino-berodt@hotmail.com\SharingMetadata\barcalona_amine@hotmail.com\DFSR\Staging\CS{615BF464-8AE6-CEBE-5F68-4E947A96CFE7}\01\10-{615BF464-8AE6-CEBE-5F68-4E947A96CFE7}-v1-{8E83EF6A-3137-41C7-904F-A6A22A3E4904}-v10-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 8 bytes hidden from API
              C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\Microsoft\Messenger\tino-berodt@hotmail.com\SharingMetadata\damelisa@mail.pt\DFSR\Staging\CS{A99B4DA1-C6E5-0857-635B-79705A6E2045}\01\11-{A99B4DA1-C6E5-0857-635B-79705A6E2045}-v1-{8E83EF6A-3137-41C7-904F-A6A22A3E4904}-v11-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 8 bytes hidden from API

              scan completed successfully
              hidden processes: 0
              hidden services: 0
              hidden files: 7

              Remaining Services:
              ------------------

              Authorized Application Key Export:

              [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
              "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Messenger"
              "C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule"

              [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

              Remaining Files:
              ---------------

              File Backups: - C:\DOCUME~1\HP_ADM~1\Bureau\SDFix\backups\backups.zip

              Files with Hidden Attributes:

              Wed 27 Dec 2006 211 A.SHR --- "C:\BOOT.BAK"
              Mon 17 Sep 2007 24 A.SH. --- "C:\WINDOWS\SECFE67C0.tmp"
              Wed 10 Oct 2007 625,152 A.SH. --- "C:\Program Files\Internet Explorer\iexplore.exe"
              Wed 13 Oct 2004 1,694,208 ..SH. --- "C:\Program Files\Messenger\msmsgs.exe"
              Tue 10 Aug 2004 60,416 A.SH. --- "C:\Program Files\Outlook Express\msimn.exe"
              Thu 12 Jul 2007 5,388,088 A..H. --- "C:\Program Files\Picasa2\setup.exe"
              Thu 1 Mar 2007 22 A.SH. --- "C:\WINDOWS\SMINST\HPCD.sys"
              Wed 31 Jan 2007 8 ..SHR --- "C:\WINDOWS\system32\CD41767FEB.sys"
              Wed 31 Jan 2007 2,514 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys"
              Wed 3 Jan 2007 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
              Mon 4 Jun 2007 38,912 ...H. --- "C:\Documents and Settings\HP_Administrateur\Mes documents\~WRL0005.tmp"
              Sat 3 Feb 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
              Sat 29 Sep 2007 17,228,144 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\6658f544763a012c23109e05e811db81\BIT15.tmp"
              Thu 12 Jul 2007 3,518,240 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\7ee602afd918de13cd9376208d4aa041\BIT30F.tmp"
              Sat 29 Sep 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\c728fd35e0fbfbad19770aaa8086c1e4\BIT18.tmp"
              Mon 4 Jun 2007 38,400 ...H. --- "C:\Documents and Settings\HP_Administrateur\Application Data\Microsoft\Word\~WRL2582.tmp"
              Mon 4 Jun 2007 28,160 ...H. --- "C:\Documents and Settings\HP_Administrateur\Application Data\Microsoft\Word\~WRL2944.tmp"
              Sat 15 Dec 2007 2,158 ...HR --- "C:\Documents and Settings\HP_Administrateur\Application Data\SecuROM\UserData\securom_v7_01.bak"
              Wed 27 Dec 2006 9,506 A.SH. --- "C:\Documents and Settings\HP_Administrateur\Mes documents\Ma musique\Sauvegarde de la licence\drmv2key.bak"

              Finished!
              1. Lyonnais92 Contributeur sécurité
                Bonjour,

                Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau.
                http://downloads.andymanchesta.com/RemovalTools/SDFix.exe
                Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici :
                • Redémarre ton ordinateur
                • Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (une pression par seconde).
                • A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.
                • Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".
                • Choisis ton compte.
                Déroule la liste des instructions ci-dessous :
                • Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.cmd pour lancer le scrïpt.
                • Appuie sur Y pour commencer le processus de nettoyage.
                • Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
                • Appuie sur une touche pour redémarrer le PC.
                • Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
                • Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
                • Appuie sur une touche pour finir l'exécution du scrïpt et charger les icônes de ton Bureau.
                • Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
                • Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum, avec un nouveau log Hijackthis !
                1. raph1992
                  ComboFix 07-12-15.5 - HP_Administrateur 2007-12-15 16:10:24.1 - NTFSx86
                  Microsoft Windows XP Professionnel 5.1.2600.2.1252.32.1036.18.435 [GMT 1:00]
                  Running from: C:\Documents and Settings\HP_Administrateur\Bureau\ComboFix.exe
                  * Created a new restore point
                  .

                  (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
                  .

                  C:\Documents and Settings\HP_Administrateur\Application Data\DriveCleaner Free
                  C:\Documents and Settings\HP_Administrateur\Application Data\DriveCleaner Free\Logs\update.log
                  C:\Documents and Settings\HP_Administrateur\err.log
                  C:\WA6P
                  C:\WINDOWS\system32\3_exception.nls
                  C:\WINDOWS\system32\fo-remove.exe
                  C:\WINDOWS\system32\stera.log
                  C:\WINDOWS\system32\UpMedia
                  D:\Autorun.inf
                  C:\WINDOWS\system32\drivers\runtime2.sys . . . . Echec de suppression

                  .
                  ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

                  .
                  -------\LEGACY_FOPN
                  -------\LEGACY_NTMLSVC
                  -------\LEGACY_RUNTIME
                  -------\LEGACY_RUNTIME2
                  -------\LEGACY_VSPF
                  -------\LEGACY_VSPF_HK
                  -------\NtmlSvc

                  ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-11-15 to 2007-12-15 ))))))))))))))))))))))))))))))))))))
                  .

                  2007-12-15 15:34 . 2007-12-15 15:34 <REP> d-------- C:\Program Files\Trend Micro
                  2007-12-15 15:08 . 2007-05-16 16:45 3,497,832 --a------ C:\WINDOWS\system32\d3dx9_34.dll
                  2007-12-15 15:08 . 2007-05-16 16:45 1,124,720 --a------ C:\WINDOWS\system32\D3DCompiler_34.dll
                  2007-12-15 15:08 . 2007-05-16 16:45 443,752 --a------ C:\WINDOWS\system32\d3dx10_34.dll
                  2007-12-15 15:08 . 2007-06-20 20:46 266,088 --a------ C:\WINDOWS\system32\xactengine2_8.dll
                  2007-12-15 15:08 . 2007-06-20 20:45 18,280 --a------ C:\WINDOWS\system32\x3daudio1_2.dll
                  2007-12-13 06:19 . 2007-12-13 06:19 <REP> d-------- C:\Program Files\iPod
                  2007-12-13 06:19 . 2007-12-15 15:42 54,156 --ah----- C:\WINDOWS\QTFont.qfn
                  2007-12-13 06:19 . 2007-12-13 06:19 1,409 --a------ C:\WINDOWS\QTFont.for
                  2007-12-13 06:18 . 2007-12-13 06:19 <REP> d-------- C:\Program Files\iTunes
                  2007-12-13 06:16 . 2007-12-13 06:17 <REP> d-------- C:\Program Files\QuickTime
                  2007-12-12 16:27 . 2007-12-12 16:31 1,393 --a------ C:\WINDOWS\imsins.BAK
                  2007-12-02 21:56 . 2007-12-02 21:56 <REP> d-------- C:\Program Files\DVD Decrypter
                  2007-11-30 22:19 . 2007-11-30 22:19 <REP> d-------- C:\Program Files\Windows Live Favorites
                  2007-11-22 21:03 . 2007-11-22 21:03 <REP> d-------- C:\Documents and Settings\HP_Administrateur\Application Data\Grisoft
                  2007-11-22 21:02 . 2007-11-22 21:02 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
                  2007-11-22 21:02 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
                  2007-11-20 15:06 . 2007-11-20 15:06 <REP> d-------- C:\Documents and Settings\All Users\SonicStage
                  2007-11-20 14:49 . 2001-09-13 02:15 90,112 --------- C:\WINDOWS\snymsico.dll
                  2007-11-20 14:49 . 2002-08-08 15:51 38,951 --------- C:\WINDOWS\system32\drivers\NETMDUSB.sys
                  2007-11-20 14:49 . 2005-10-31 10:46 36,679 --------- C:\WINDOWS\system32\drivers\NETMD052.sys
                  2007-11-20 14:49 . 2003-11-10 12:31 36,232 --------- C:\WINDOWS\system32\drivers\NETMD033.sys
                  2007-11-20 14:49 . 2003-04-01 18:55 35,319 --------- C:\WINDOWS\system32\drivers\NETMD031.sys
                  2007-11-20 14:48 . 2007-11-20 14:48 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Sony Corporation
                  2007-11-20 14:48 . 2007-01-13 08:24 770,048 --a------ C:\WINDOWS\system32\CDDBUISony.dll
                  2007-11-20 14:48 . 2007-01-13 08:22 655,360 --a------ C:\WINDOWS\system32\CDDBControlSony.dll
                  2007-11-20 14:48 . 2007-01-13 08:22 589,824 --a------ C:\WINDOWS\system32\CddbMusicIDSony.dll
                  2007-11-20 14:48 . 2007-01-13 08:25 532,480 --a------ C:\WINDOWS\system32\CddbPlaylist2Sony.dll
                  2007-11-20 14:48 . 2006-10-18 16:30 129,784 --------- C:\WINDOWS\system32\pxafs.dll
                  2007-11-20 14:48 . 2007-01-13 08:27 98,304 --a------ C:\WINDOWS\system32\CddbLangFRSony.dll
                  2007-11-20 14:48 . 2007-01-13 08:24 73,728 --a------ C:\WINDOWS\system32\CddbLinkSony.dll
                  2007-11-20 14:47 . 2007-11-20 14:49 <REP> d-------- C:\Program Files\Sony
                  2007-11-20 14:46 . 2007-11-20 14:47 <REP> d-------- C:\Program Files\Fichiers communs\Sony Shared
                  2007-11-20 14:46 . 2007-11-20 15:06 <REP> d-------- C:\Documents and Settings\HP_Administrateur\Application Data\Sony Corporation
                  2007-11-16 15:39 . 2004-01-27 17:20 36,864 --a------ C:\WINDOWS\system32\ANIOApi.dll
                  2007-11-16 15:39 . 2003-05-05 18:25 28,205 --a------ C:\WINDOWS\system32\ANIO.sys
                  2007-11-16 15:39 . 2004-04-15 11:10 16,997 --a------ C:\WINDOWS\system32\ANIO.VXD
                  2007-11-16 15:39 . 2003-05-05 14:00 11,904 --a------ C:\WINDOWS\system32\anio4.sys
                  2007-11-16 15:38 . 2007-11-16 15:39 <REP> d-------- C:\Program Files\ANI
                  2007-11-16 15:38 . 2003-09-18 19:03 1,163,337 --a------ C:\WINDOWS\system32\odSupp_M.dll
                  2007-11-16 15:38 . 2004-04-19 15:03 557,056 --a------ C:\WINDOWS\system32\ANIWZCS2.dll
                  2007-11-16 15:38 . 2004-05-13 19:50 208,896 --a------ C:\WINDOWS\system32\wlanapi.dll
                  2007-11-16 15:38 . 2004-02-03 17:20 192,512 --a------ C:\WINDOWS\system32\aIPH.dll
                  2007-11-16 15:38 . 2004-03-12 15:33 118,784 --a------ C:\WINDOWS\system32\WlanApp.dll
                  2007-11-16 15:38 . 2003-12-19 17:14 57,407 --a------ C:\WINDOWS\system32\ANICtl.dll
                  2007-11-16 15:38 . 2003-06-03 18:23 49,152 --a------ C:\WINDOWS\system32\AQCKGen.dll

                  .
                  (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                  .
                  2007-12-15 14:42 --------- d-----w C:\Program Files\SP2 Connection Patcher
                  2007-12-15 14:08 --------- d-----w C:\Program Files\Electronic Arts
                  2007-12-15 14:03 --------- d-----w C:\Program Files\eMule
                  2007-12-01 02:10 --------- d-----w C:\Program Files\Windows Live Toolbar
                  2007-11-23 13:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
                  2007-11-20 13:49 --------- d--h--w C:\Program Files\InstallShield Installation Information
                  2007-11-17 10:33 --------- d-----w C:\Program Files\PartyGaming
                  2007-11-16 14:40 --------- d-----w C:\Program Files\DivX
                  2007-11-16 14:37 --------- d-----w C:\Program Files\Fichiers communs\Adobe
                  2007-11-15 20:45 --------- d-----w C:\Program Files\Fichiers communs\BitDefender
                  2007-11-13 13:41 --------- d-----w C:\Program Files\Red Kawa
                  2007-11-13 13:41 --------- d-----w C:\Program Files\AviSynth 2.5
                  2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
                  2007-11-12 05:35 --------- d-----w C:\Program Files\Adverts
                  2007-10-31 13:09 30,464 ----a-w C:\WINDOWS\system32\drivers\usbaapl.sys
                  2007-10-28 12:34 --------- d-----w C:\Program Files\BitDefender
                  2007-10-26 21:32 --------- d-----w C:\Program Files\MSN Messenger
                  2007-10-26 21:32 --------- d-----w C:\Program Files\Messenger Plus! Live
                  2007-10-25 13:15 --------- d-----w C:\Documents and Settings\HP_Administrateur\Application Data\temp
                  2007-10-23 13:47 --------- d-----w C:\Program Files\Ubisoft
                  2007-10-22 13:07 --------- d-----w C:\Program Files\DAEMON Tools
                  2007-10-22 12:14 --------- d-----w C:\Program Files\Macrogaming
                  2007-10-22 12:10 --------- d-----w C:\Program Files\Jasc Software Inc
                  2007-10-22 12:05 --------- d-----w C:\Program Files\BoontyGames
                  2007-10-22 12:04 --------- d-----w C:\Program Files\Boonty
                  2007-10-22 11:53 --------- d-----w C:\Program Files\Ashampoo
                  2007-09-11 16:56 0 ----a-w C:\Documents and Settings\HP_Administrateur\Application Data\wklnhst.dat
                  2007-03-10 09:32 384 ----a-w C:\Documents and Settings\HP_Administrateur\Application Data\internaldb6334.dat
                  2007-03-10 09:31 194 ----a-w C:\Documents and Settings\HP_Administrateur\Application Data\internaldb8467.dat
                  2007-03-10 09:31 18,432 ----a-w C:\Documents and Settings\HP_Administrateur\Application Data\internaldb41.dat
                  2007-03-01 21:09 22 --sha-w C:\WINDOWS\SMINST\HPCD.sys
                  2007-01-31 17:50 8 --sh--r C:\WINDOWS\system32\CD41767FEB.sys
                  2007-01-31 17:50 2,514 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
                  .

                  ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
                  .
                  .
                  REGEDIT4
                  *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

                  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                  "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 05:00]
                  "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-31 19:11]
                  "msnmsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 11:55]
                  "SP2 Connection Patcher"="C:\Program Files\SP2 Connection Patcher\SP2ConnPatcher.exe" [2005-07-11 12:51]

                  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                  "ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-05 12:34]
                  "ftutil2"="ftutil2.dll" [2004-06-07 06:05 C:\WINDOWS\system32\ftutil2.dll]
                  "RTHDCPL"="RTHDCPL.EXE" [2006-07-21 17:56 C:\WINDOWS\RTHDCPL.EXE]
                  "IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2006-02-21 18:59]
                  "NvCplDaemon"="RUNDLL32.exe" [2004-08-10 05:00 C:\WINDOWS\system32\rundll32.exe]
                  "nwiz"="nwiz.exe" [2006-06-20 18:06 C:\WINDOWS\system32\nwiz.exe]
                  "Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2005-07-22 14:14]
                  "HPBootOp"="C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2006-02-15 14:34]
                  "HP Software Update"="C:\Program Files\HP\HP Software Update\HPwuSchd2.exe" [2005-02-16 22:11]
                  "HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe" [2001-11-15 18:05]
                  "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-11-12 11:48]
                  "McAfeeUpdaterUI"="C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" [2004-08-06 03:50]
                  "ISUSPM Startup"="C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 15:50]
                  "ShStatEXE"="C:\Program Files\Network Associates\VirusScan\SHSTAT.exe" [2004-08-25 08:00]
                  "Network Associates Error Reporting Service"="C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe" [2003-10-07 09:48]
                  "Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-06-16 00:15]
                  "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50]
                  "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 03:00]
                  "IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\point32.exe" [2003-05-16 00:41]
                  "Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 15:17]
                  "ANIWZCS2Service"="C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [2004-04-14 11:54]
                  "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25]
                  "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-11-14 23:43]
                  "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-11-15 13:11]

                  [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
                  "InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
                  "InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

                  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
                  "DisableRegistryTools"= 0 (0x0)

                  [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
                  Authentication Packages REG_MULTI_SZ msv1_0 nwprovau

                  R1 NaiAvTdi1;NaiAvTdi1;C:\WINDOWS\system32\drivers\mvstdi5x.sys
                  R2 Asapi;Asapi;C:\WINDOWS\system32\drivers\Asapi.sys
                  R3 usbstor;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
                  S3 Boonty Games;Boonty Games;"C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe"
                  S3 PRISM;D-Link Air Wireless Prism3 Adapter Driver;C:\WINDOWS\system32\DRIVERS\PRISMNDS.sys
                  S3 PRISM_USB;D-Link Air Wireless USB Adapter Driver;C:\WINDOWS\system32\DRIVERS\PRISMUSB.sys
                  S3 USBAAPL;Apple Mobile USB Driver;C:\WINDOWS\system32\Drivers\usbaapl.sys
                  S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys
                  S3 w550bus;Sony Ericsson W550 driver (WDM);C:\WINDOWS\system32\DRIVERS\w550bus.sys
                  S3 w550mdfl;Sony Ericsson W550 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\w550mdfl.sys
                  S3 w550mdm;Sony Ericsson W550 USB WMC Modem Drivers;C:\WINDOWS\system32\DRIVERS\w550mdm.sys

                  *Newly Created Service* - ENTDRV51
                  .
                  Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
                  "2007-12-15 15:00:00 C:\WINDOWS\Tasks\ABB364439185156B.job"
                  - c:\docume~1\hp_adm~1\applic~1\joybir~1\vcmaildent.exe
                  "2007-12-12 22:38:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
                  - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
                  "2007-12-15 14:51:01 C:\WINDOWS\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job"
                  .
                  **************************************************************************

                  catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                  Rootkit scan 2007-12-15 16:21:32
                  Windows 5.1.2600 Service Pack 2 NTFS

                  scanning hidden processes ...

                  scanning hidden autostart entries ...

                  scanning hidden files ...

                  scan completed successfully
                  hidden files: 0

                  **************************************************************************
                  .
                  Completion time: 2007-12-15 16:23:48 - machine was rebooted
                  .
                  2007-12-12 15:36:45 --- E O F ---
                  1. raph1992
                    Logfile of Trend Micro HijackThis v2.0.2
                    Scan saved at 15:46:39, on 15/12/2007
                    Platform: Windows XP SP2 (WinNT 5.01.2600)
                    MSIE: Internet Explorer v7.00 (7.00.6000.16574)
                    Boot mode: Normal

                    Running processes:
                    C:\WINDOWS\System32\smss.exe
                    C:\WINDOWS\system32\winlogon.exe
                    C:\WINDOWS\system32\services.exe
                    C:\WINDOWS\system32\lsass.exe
                    C:\WINDOWS\system32\svchost.exe
                    C:\WINDOWS\System32\svchost.exe
                    C:\WINDOWS\system32\spoolsv.exe
                    C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                    C:\WINDOWS\eHome\ehRecvr.exe
                    C:\WINDOWS\eHome\ehSched.exe
                    C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
                    C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
                    C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
                    C:\Program Files\Network Associates\VirusScan\Mcshield.exe
                    C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
                    C:\WINDOWS\system32\nvsvc32.exe
                    C:\WINDOWS\system32\HPZipm12.exe
                    C:\Program Files\Electronic Arts\Need for Speed ProStreet\PB\PnkBstrA.exe
                    C:\WINDOWS\system32\svchost.exe
                    C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology Drivers\Elservice.exe
                    C:\WINDOWS\system32\dllhost.exe
                    C:\WINDOWS\Explorer.EXE
                    C:\WINDOWS\ehome\ehtray.exe
                    C:\WINDOWS\eHome\ehmsas.exe
                    C:\WINDOWS\RTHDCPL.EXE
                    C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
                    C:\WINDOWS\system32\rundll32.exe
                    C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe
                    C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
                    C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
                    C:\Program Files\DAEMON Tools\daemon.exe
                    C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
                    C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
                    C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe
                    C:\Program Files\Picasa2\PicasaMediaDetector.exe
                    C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
                    C:\Program Files\Microsoft IntelliPoint\point32.exe
                    C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
                    C:\Program Files\Fichiers communs\Teleca Shared\CapabilityManager.exe
                    C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
                    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
                    C:\Program Files\QuickTime\QTTask.exe
                    C:\Program Files\iTunes\iTunesHelper.exe
                    C:\WINDOWS\system32\ctfmon.exe
                    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                    C:\Program Files\MSN Messenger\MsnMsgr.Exe
                    C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
                    C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
                    C:\Program Files\iPod\bin\iPodService.exe
                    C:\Program Files\MSN Messenger\msnmsgr.exe
                    C:\Program Files\MSN Messenger\usnsvc.exe
                    C:\Program Files\Internet Explorer\IEXPLORE.EXE
                    C:\Program Files\Windows Live Toolbar\msn_sl.exe
                    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

                    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
                    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
                    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
                    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
                    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
                    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
                    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                    R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
                    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
                    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
                    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
                    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
                    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
                    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                    O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
                    O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode
                    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
                    O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
                    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
                    O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
                    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
                    O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
                    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
                    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
                    O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
                    O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
                    O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
                    O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
                    O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Fichiers communs\Network Associates\TalkBack\TBMon.exe"
                    O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
                    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
                    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
                    O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
                    O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
                    O4 - HKLM\..\Run: [startdrv] C:\WINDOWS\Temp\startdrv.exe
                    O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
                    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
                    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
                    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
                    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
                    O4 - HKCU\..\Run: [SP2 Connection Patcher] "C:\Program Files\SP2 Connection Patcher\SP2ConnPatcher.exe" -n=200
                    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
                    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                    O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
                    O4 - .DEFAULT User Startup: PinMcLnk.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
                    O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
                    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
                    O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
                    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
                    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
                    O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
                    O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
                    O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
                    O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
                    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                    O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
                    O16 - DPF: {4CCA4E6B-9259-11D9-AC6E-444553544200} (FixController Control) - http://h30155.www3.hp.com/ediags/dd/install/HPInstallMgr_v01.cab
                    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
                    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                    O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
                    O23 - Service: Intel(R) Quick Resume technology (ELService) - Intel Corporation - C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology Drivers\Elservice.exe
                    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                    O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
                    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
                    O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
                    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
                    O23 - Service: Service Framework McAfee (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
                    O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
                    O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
                    O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
                    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
                    O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
                    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
                    O23 - Service: PunkBuster (PnkBstrA) - Unknown owner - C:\Program Files\Electronic Arts\Need for Speed ProStreet\PB\PnkBstrA.exe
                    O23 - Service: SonicStage Back-End Service - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SsBeSvc.exe
                    O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
                    O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe
                    O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe
                    1. Lyonnais92 Contributeur sécurité
                      Bonjour,

                      1) Clique sur ce lien
                      http://www.trendsecure.com/portal/en-US/threat_analytics/HJTInstall.exe
                      pour télécharger le fichier d'installation d'HijackThis.

                      Enregistre HJTInstall.exe sur ton bureau.

                      2) Double-clique sur HJTInstall.exe pour lancer le programme

                      Par défaut, il s'installera là :
                      C:\Program Files\Trend Micro\HijackThis

                      Accepte la license en cliquant sur le bouton "I Accept"

                      Choisis l'option "Do a system scan and save a log file"

                      Clique sur "Save log" pour enregistrer le rapport qui s'ouvrira avec le bloc-note

                      Clique sur "Edition -> Sélectionner tout", puis sur "Edition -> Copier" pour copier tout le contenu du rapport

                      Colle le rapport que tu viens de copier sur ce forum

                      Ne fixe encore AUCUNE ligne, cela pourrait empêcher ton PC de fonctionner correctement

                      Tutoriaux : http://pageperso.aol.fr/balltrap34/demohijack.htm (ne fixe rien pour le moment !!)
                      http://cybersecurite.xooit.com/t138-HijackThis-2-0-2.htm

                      télécharge combofix (par sUBs)ici :

                      http://download.bleepingcomputer.com/sUBs/ComboFix.exe

                      et enregistre le sur le bureau.

                      2 double-clique sur combofix.exe et suis les instructions

                      3 à la fin, il va produire un rapport C:\ComboFix.txt

                      4 copie/colle ce rapport dans ta prochaine réponse.

                      Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi.

                      Discussions similaires

                      Chrome://newtab
                      Nova

                      14 réponses
                      Softonic,est-ce un virus ?
                      techmel1

                      6 réponses
                      Désinstaller Softonic
                      Diguimette

                      5 réponses
                      Supprimer New Tab
                      tysaozon

                      8 réponses
                      Bouton pause/break
                      frans003

                      3 réponses