Infections multiples

oui oui, tout avait marché correctement

Et le script a-t-il été bien fusionné cette fois ?

Bonjour,

le scan AVG n'a rien trouvé (le rapport ne s'est pas crée).
Voici le rapport de filelopjob :
Le volume dans le lecteur C s'appelle Disque local
Le numéro de série du volume est B430-5DE3

Répertoire de C:\WINDOWS\tasks

16/02/2008 23:06 <REP> .
16/02/2008 23:06 <REP> ..
24/04/2003 13:00 65 desktop.ini
18/02/2008 17:50 6 SA.DAT
18/02/2008 09:17 588 Scheduled scanning task.job
3 fichier(s) 659 octets

Répertoire de C:\Documents and Settings\Nicolas\Bureau

Bonjour.
Le script a bien été exécuté cette fois ?
Mets à jour AVG antispyware.
Redémarre le pc en mode sans échec et refais un scan.
Un fois revenu en mode normal, exécute ceci:
Fais un copier/coller de la ligne ci-dessous dans le Bloc-notes.
Vérifie dans le menu Format que l'option "Retour automatique à la ligne" n'est pas cochée.
Enregistre le fichier sur le Bureau sous le nom de findlopjob.bat
Choisis "Tous les fichiers" dans la liste déroulante de "Type" lors du "Enregistrer sous.."
Si l'extension est .bat.txt, renommer le fichier en .bat

dir %Windir%\tasks /a h > c:\filelopjob.txt

Double-clique sur findlopjob.bat (une petite fenêtre à fond noir va apparaître puis disparaître très rapidement).
Poste le contenu du fichier obtenu à la racine du système : c:\filelopjob.txt ainsi que le rapport AVG.

Bonjour

il em le trouve toujours avec spybot

Bonjour.
Je crois que je viens de comprendre ton problème.
Il faut copier ceci:

REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\optimizer.adssite2]
[-HKEY_USERS\S-1-5-21-2978962730-846406536-2535896878-1006\Software\Microsoft\adssite]
[-HKEY_CLASSES_ROOT\CLSID\{9C8A568E-4201-478a-8536-526CF371D2E2}]
[-HKEY_CLASSES_ROOT\Interface\{48DC6FFB-64D7-42E8-949D-8EF2641EB73A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\optimizer.adssite2.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9C8A568E-4201-478a-8536-526CF371D2E2}]
[-HKEY_CLASSES_ROOT\TypeLib\{B4094603-DDA9-4CAF-9B13-0AD1034C9C53}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\adssite]

Recommence et informe-moi.

oui oui j'ai bien la meme

Tu as bien l'icône indiquée ?

Salut

je n'ai pas réussi à faire al manip, il me dit que le fichier spécifié n'est pas un script du registre

Bonsoir

Autre solution.
Dans un blocnote ( Tous les programmes-Accessoires) tu copies-colles ce qui suit dans l'encadré.
Dans Format, veille à bien retirer la coche devant Retour à la ligne automatique.
Fais un retour chariot ( Entrée) après la dernière ligne.

[quote]REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\optimizer.adssite2]
[-HKEY_USERS\S-1-5-21-2978962730-846406536-2535896878-1006\Software\Microsoft\adssite]
[-HKEY_CLASSES_ROOT\CLSID\{9C8A568E-4201-478a-8536-526CF371D2E2}]
[-HKEY_CLASSES_ROOT\Interface\{48DC6FFB-64D7-42E8-949D-8EF2641EB73A}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\optimizer.adssite2.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9C8A568E-4201-478a-8536-526CF371D2E2}]
[-HKEY_CLASSES_ROOT\TypeLib\{B4094603-DDA9-4CAF-9B13-0AD1034C9C53}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\adssite]
[/quote]

Dans Fichier, Enregistrer sous, Tous les fichiers, sur le bureau tu enregistres sous le nom fix.reg
Si le fichier obtenu est appelé fix.reg.txt, tu le renommes en supprimant .txt à la fin

Ensuite tu cliques droit sur ce fichier, tu choisis Fusionner et tu acceptes.
Un message t'avertira de la bonne exécution du fix.
L'icône du fichier : https://i28.servimg.com/u/f28/11/05/93/83/iconer10.jpg

voici le rapport

File/Folder HKEY_LOCAL_MACHINE\SOFTWARE\Classes\optimizer.adssite2 not found.
File/Folder not found.
File/Folder HKEY_USERS\S-1-5-21-2978962730-846406536-2535896878-1006\Software\Microsoft\adssite not found.
File/Folder HKEY_CLASSES_ROOT\CLSID\{9C8A568E-4201-478a-8536-526CF371D2E2} not found.
File/Folder HKEY_CLASSES_ROOT\Interface\{48DC6FFB-64D7-42E8-949D-8EF2641EB73A} not found.
File/Folder HKEY_LOCAL_MACHINE\SOFTWARE\Classes\optimizer.adssite2.1 not found.
File/Folder not found.
File/Folder HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9C8A568E-4201-478a-8536-526CF371D2E2} not found.
File/Folder HKEY_CLASSES_ROOT\TypeLib\{B4094603-DDA9-4CAF-9B13-0AD1034C9C53} not found.
File/Folder not found.
File/Folder HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\adssite not found.

OTMoveIt2 v1.0.20 log created on 02162008_191403

Bonjour.

Lance OtMoveIt et colle

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\optimizer.adssite2
HKEY_USERS\S-1-5-21-2978962730-846406536-2535896878-1006\Software\Microsoft\adssite
HKEY_CLASSES_ROOT\CLSID\{9C8A568E-4201-478a-8536-526CF371D2E2}
HKEY_CLASSES_ROOT\Interface\{48DC6FFB-64D7-42E8-949D-8EF2641EB73A}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\optimizer.adssite2.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9C8A568E-4201-478a-8536-526CF371D2E2}
HKEY_CLASSES_ROOT\TypeLib\{B4094603-DDA9-4CAF-9B13-0AD1034C9C53}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\adssite

Clique sur MoveIt ! et poste le rapport.

Bonjour
Il me trouve toujours Cooltoolbar. je te joins également le rapport de spybot, si ca peut t'aider

CoolToolBar: [SBI $0D4E5BF6] Réglages (Clé du registre, nothing done)
HKEY_USERS\S-1-5-21-2978962730-846406536-2535896878-1006\Software\Microsoft\adssite

CoolToolBar: [SBI $EEDF3998] Class ID (Clé du registre, nothing done)
HKEY_CLASSES_ROOT\CLSID\{9C8A568E-4201-478a-8536-526CF371D2E2}

CoolToolBar: [SBI $7BE793F8] Interface (Clé du registre, nothing done)
HKEY_CLASSES_ROOT\Interface\{48DC6FFB-64D7-42E8-949D-8EF2641EB73A}

CoolToolBar: [SBI $ABD6C6B6] Root class (Clé du registre, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\optimizer.adssite2

CoolToolBar: [SBI $ABD6C6B6] Root class (Clé du registre, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\optimizer.adssite2.1

CoolToolBar: [SBI $ABD6C6B6] Class ID (Clé du registre, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9C8A568E-4201-478a-8536-526CF371D2E2}

CoolToolBar: [SBI $7A1D65BD] Type library (Clé du registre, nothing done)
HKEY_CLASSES_ROOT\TypeLib\{B4094603-DDA9-4CAF-9B13-0AD1034C9C53}

CoolToolBar: [SBI $5E037FEF] Réglages désinstallation (Clé du registre, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\adssite

--- Spybot - Search & Destroy version: 1.5.2 (build: 20080128) ---

2008-01-28 blindman.exe (1.0.0.7)
2008-01-28 SDDelFile.exe (1.0.2.4)
2008-01-28 SDMain.exe (1.0.0.5)
2007-10-07 SDShred.exe (1.0.1.2)
2008-01-28 SDUpdate.exe (1.0.8.8)
2008-01-28 SDWinSec.exe (1.0.0.11)
2008-01-28 SpybotSD.exe (1.5.2.20)
2008-01-28 TeaTimer.exe (1.5.2.16)
2006-08-27 unins000.exe (51.41.0.0)
2008-02-09 unins001.exe (51.49.0.0)
2008-01-28 Update.exe (1.4.0.6)
2008-01-28 advcheck.dll (1.5.4.5)
2007-04-02 aports.dll (2.1.0.0)
2005-05-31 borlndmm.dll (7.0.4.453)
2005-05-31 delphimm.dll (7.0.4.453)
2007-11-17 DelZip179.dll (1.79.7.4)
2008-01-28 SDFiles.dll (1.5.1.19)
2008-01-28 SDHelper.dll (1.5.0.11)
2008-01-28 Tools.dll (2.1.3.3)
2005-05-31 UnzDll.dll (1.73.1.1)
2005-05-31 ZipDll.dll (1.73.2.0)
2008-02-13 Includes\Cookies.sbi (*)
2007-12-26 Includes\Dialer.sbi (*)
2008-02-13 Includes\DialerC.sbi (*)
2008-02-13 Includes\HeavyDuty.sbi (*)
2008-02-13 Includes\Hijackers.sbi (*)
2008-02-13 Includes\HijackersC.sbi (*)
2008-02-13 Includes\Keyloggers.sbi (*)
2008-02-13 Includes\KeyloggersC.sbi (*)
2004-11-29 Includes\LSP.sbi (*)
2008-02-13 Includes\Malware.sbi (*)
2008-02-13 Includes\MalwareC.sbi (*)
2007-10-24 Includes\PUPS.sbi (*)
2008-02-13 Includes\PUPSC.sbi (*)
2008-02-13 Includes\Revision.sbi (*)
2008-01-09 Includes\Security.sbi (*)
2008-02-13 Includes\SecurityC.sbi (*)
2008-02-13 Includes\Spybots.sbi (*)
2008-02-13 Includes\SpybotsC.sbi (*)
2007-11-06 Includes\Tracks.uti
2008-02-13 Includes\Trojans.sbi (*)
2008-02-13 Includes\TrojansC.sbi (*)
2007-12-24 Plugins\TCPIPAddress.dll

16/02/2008 ---- 11:23:18,25

----------------------------------
§§§§§§ [cooltoolbar] §§§§§§
----------------------------------
[X] Registre

-------------- [ ] rapide
-- Fichier --- [ ] disque systeme
------------- [X] complete

********************
[Registre]
********************

Aucune entrée détectée

*******************
[Fichier]
*******************

c:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolToolBar.zip

*********************
[Même date]
*********************

[15/02/2008 ] ---> C:\ComboFix.txt

Outil Aide Diagnostic By !aur3n7 Version 1.1
----------------------------------
§§§§§ Fin Rapport §§§§§
----------------------------------

Bonjour,
Lance OAD fais une recherche avec cooltoolbar
Poste les résultats.

J'ai toujours ce Cooltoolbar. De plus, j'ai toujours cet écran bleu du bureau que je ne peux pas changer

C:\WINDOWS\system32\VCCLSID.exe moved successfully.
C:\WINDOWS\system32\SrchSTS.exe moved successfully.
C:\WINDOWS\system32\VACFix.exe moved successfully.
C:\WINDOWS\system32\IEDFix.exe moved successfully.
C:\WINDOWS\system32\dumphive.exe moved successfully.
C:\WINDOWS\system32\WS2Fix.exe moved successfully.
C:\sqmdata06.sqm moved successfully.
C:\sqmnoopt06.sqm moved successfully.
C:\WINDOWS\system32\iebrowserc.dll NOT unregistered.
C:\WINDOWS\system32\iebrowserc.dll moved successfully.
File/Folder C:\Documents and Settings\Nicolas\Application not found.
File/Folder Data\Deskbar_{69A0CA2B-1F26-44e7-BB41-4251336B4D7A} not found.
C:\Documents and Settings\Nicolas\Application Data\wklnhst.dat moved successfully.

OTMoveIt2 v1.0.20 log created on 02162008_004556

Bonsoir.
Lance OtMoveIt
Tu inscris (ou tu colles) le chemin du fichier/dossier à supprimer (C'est à dire ce qui suit)dans la fenêtre de gauche, cadre du haut , en-tête bleu
(Paste Standard List of Files/Folders to Move) et tu cliques sur MoveIt! (en rouge).
(La case Unregister Dll's and OCX's doit être cochée.)

C:\WINDOWS\system32\VCCLSID.exe
C:\WINDOWS\system32\SrchSTS.exe
C:\WINDOWS\system32\VACFix.exe
C:\WINDOWS\system32\IEDFix.exe
C:\WINDOWS\system32\dumphive.exe
C:\WINDOWS\system32\WS2Fix.exe
C:\sqmdata06.sqm
C:\sqmnoopt06.sqm
C:\WINDOWS\system32\iebrowserc.dll
C:\Documents and Settings\Nicolas\Application Data\Deskbar_{69A0CA2B-1F26-44e7-BB41-4251336B4D7A}
C:\Documents and Settings\Nicolas\Application Data\wklnhst.dat

Le résultat apparaitra dans le cadre Results à droite.
Clique sur Exit pour fermer.
Un rapport sera enregistré dans C:\\_OTMoveIt\MovedFiles.(xxxxxxxx_xxxxxx.log)
Les x sont des chiffres qui correspondent à la date et l'heure du scan.
Redémarre le pc et poste le rapport en donnant des informations sur l'évolution de la situation.

Il me trouve aussi toujours EverestPoker

Mon ordi n'a pas été redémarré à al fin de Combofix. Spybot me trouve toujours cooltoolbar.
voici les 2 logs :

ComboFix 08-02-15.1 - Nicolas 2008-02-14 23:02:44.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.353 [GMT 1:00]
Endroit: C:\Documents and Settings\Nicolas\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\Nicolas\Bureau\CFScript.txt
* Création d'un nouveau point de restauration

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\_000008_.tmp.dll
C:\WINDOWS\system32\_000009_.tmp.dll
C:\WINDOWS\system32\nsd790.dll

.
((((((((((((((((((((((((((((( Fichiers créés 2008-01-15 to 2008-02-15 ))))))))))))))))))))))))))))))))))))
.

2008-02-13 18:01 . 2008-02-13 18:02 1,374 --a------ C:\WINDOWS\imsins.BAK
2008-02-09 11:54 . 2008-02-09 11:54 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-02-08 23:22 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-02-08 23:22 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-02-08 23:22 . 2008-02-02 00:55 83,456 --a------ C:\WINDOWS\system32\VACFix.exe
2008-02-08 23:22 . 2008-01-27 14:37 81,920 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-02-08 23:22 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-02-08 23:22 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-02-07 23:28 . 2008-02-07 23:28 <REP> d-------- C:\_OTMoveIt
2008-02-07 23:06 . 2007-12-14 01:59 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-02-07 23:05 . 2008-02-07 23:06 <REP> d-------- C:\Program Files\CCleaner
2008-02-07 15:44 . 2008-02-08 09:20 <REP> d-------- C:\Program Files\AVG Anti-Spyware 7.5
2008-02-07 15:44 . 2008-02-07 15:44 <REP> d-------- C:\Documents and Settings\Nicolas\Application Data\Grisoft
2008-02-07 15:44 . 2008-02-07 15:44 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-02-07 15:44 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-02-05 17:33 . 2008-02-09 19:15 <REP> d-------- C:\Program Files\Navilog1
2008-02-02 23:36 . 2008-02-02 23:39 <REP> d-------- C:\Program Files\a-squared Free
2008-02-02 23:26 . 2008-02-02 23:28 <REP> d-------- C:\Program Files\SpywareBlaster
2008-01-26 15:37 . 2008-01-26 15:37 268 --ah----- C:\sqmdata06.sqm
2008-01-26 15:37 . 2008-01-26 15:37 244 --ah----- C:\sqmnoopt06.sqm
2008-01-26 15:19 . 2008-01-26 15:19 <REP> d-------- C:\Documents and Settings\Nicolas\Application Data\Deskbar_{69A0CA2B-1F26-44e7-BB41-4251336B4D7A}
2008-01-18 11:06 . 2008-01-18 11:06 294,912 --a------ C:\WINDOWS\system32\iebrowserc.dll
2008-01-18 07:16 . 2008-01-18 07:16 <REP> dr-h----- C:\Documents and Settings\Nicolas\Application Data\SecuROM
2008-01-16 18:31 . 2008-01-18 07:29 <REP> d-------- C:\Program Files\eMule

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-14 16:08 --------- d-----w C:\Program Files\Wanadoo
2008-02-11 15:49 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-11 09:35 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-02-09 08:26 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-02-08 22:23 4,796 ----a-w C:\WINDOWS\system32\tmp.reg
2008-02-08 08:22 --------- d-----w C:\Program Files\Microsoft IntelliPoint
2008-02-07 22:27 --------- d-----w C:\Program Files\Hijack This
2008-02-07 22:06 --------- d-----w C:\Program Files\Java
2008-02-07 14:41 --------- d-----w C:\Program Files\Utilitaires
2008-02-03 09:16 --------- d-----w C:\Program Files\Steam
2008-01-26 22:49 --------- d-----w C:\Program Files\Jeux
2008-01-25 22:39 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-01-25 16:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-01-25 16:00 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe
2008-01-20 16:04 --------- d-----w C:\Documents and Settings\Nicolas\Application Data\Sports Interactive
2008-01-20 15:57 --------- d-----w C:\Program Files\Sports Interactive
2008-01-18 06:16 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-01-11 14:05 --------- d-----w C:\Documents and Settings\Nicolas\Application Data\uTorrent
2008-01-09 22:41 360,580 ----a-w C:\WINDOWS\eSellerateEngine.dll
2008-01-09 22:40 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-09 22:40 --------- d-----w C:\Program Files\MSN Content Plus Inc
2008-01-09 22:33 --------- d-----w C:\Program Files\MSN Messenger
2008-01-09 14:59 --------- d-----w C:\Program Files\Warcraft III
2008-01-02 10:54 --------- d-----w C:\Program Files\KONAMI
2008-01-02 09:29 --------- d-----w C:\Program Files\Championship Manager 5 Demo
2008-01-01 11:37 --------- d-----w C:\Program Files\Artefacts Studio
2008-01-01 11:35 --------- d-----w C:\Program Files\Activision
2008-01-01 11:16 --------- d-----w C:\Program Files\Championship Manager 2006 BETA Demo
2008-01-01 10:42 --------- d-----w C:\Program Files\Poker3d
2008-01-01 00:22 --------- d-----w C:\Program Files\Cryo
2008-01-01 00:16 --------- d-----w C:\Program Files\Cryo Interactive
2007-12-31 10:05 --------- d-----w C:\Program Files\MP3 Player Utilities 4.00
2007-12-31 10:03 --------- d-----w C:\Program Files\MP3 Player Utilities 4.13
2007-12-29 22:56 --------- d-----w C:\Program Files\Fake Webcam
2007-12-29 21:54 --------- d-----w C:\Program Files\PC Camera
2007-12-28 21:39 --------- d-----w C:\Documents and Settings\Nicolas\Application Data\gtk-2.0
2007-12-27 22:43 --------- d-----w C:\Program Files\Messenger Plus! Live
2007-12-22 06:51 --------- d-----w C:\Program Files\Free Audio Pack
2007-12-21 21:11 --------- d-----w C:\Program Files\QuickTime
2007-12-21 21:07 --------- d-----w C:\Program Files\Apple Software Update
2007-12-21 21:06 --------- d-----w C:\Program Files\Fichiers communs\Apple
2007-12-21 21:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2007-12-21 14:39 10,752 ----a-w C:\WINDOWS\system32\WhoisCL.exe
2007-12-18 09:51 179,584 ----a-w C:\WINDOWS\system32\drivers\mrxdav.sys
2007-12-17 22:20 --------- d-----w C:\Program Files\Legacy Interactive
2007-12-17 10:34 --------- d-----w C:\Program Files\Lavasoft
2007-12-17 10:33 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard
2007-12-07 02:08 824,832 ----a-w C:\WINDOWS\system32\wininet.dll
2007-12-04 18:41 550,912 ------w C:\WINDOWS\system32\oleaut32.dll
2007-08-31 21:42 241,664 ----a-w C:\Program Files\Uninstall Ask Toolbar.dll
2005-06-20 15:12 0 -c--a-w C:\Documents and Settings\Nicolas\Application Data\wklnhst.dat
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Copernic Desktop Search"="C:\Program Files\Utilitaires\CopernicdesktopSearch\Copernic Desktop Search\CopernicDesktopSearch.exe" [2006-04-12 19:20 5251880]
"WOOKIT"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 16:55 32768]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe" [2006-06-01 12:32 94208]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-20 00:09 15360]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-03 09:59 204288]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PinnacleDriverCheck"="C:\WINDOWS\System32\PSDrvCheck.exe" [2003-11-10 15:06 406016]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2004-04-23 05:24 3756032]
"nwiz"="nwiz.exe" [2004-04-23 05:24 831488 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2004-04-23 05:24 46080]
"AGRSMMSG"="AGRSMMSG.exe" [2005-03-04 11:01 88209 C:\WINDOWS\AGRSMMSG.exe]
"WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 14:49 20480]
"WOOTASKBARICON"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 16:55 32768]
"SoundMan"="SOUNDMAN.EXE" [2004-02-26 15:53 65024 C:\WINDOWS\SOUNDMAN.EXE]
"Tweak UI"="TWEAKUI.CPL" [2000-09-21 00:24 81408 C:\WINDOWS\system32\TWEAKUI.CPL]
"WinPatrol"="C:\PROGRA~1\UTILIT~1\WINPAT~1\winpatrol.exe" [2005-10-05 14:23 222784]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2006-01-27 20:29 180269]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\point32.exe" [2004-06-03 09:50 204800]
"RestoreIT!"="C:\Program Files\Phoenix Technologies Ltd\RecoverPro_XP\VBPTASK.exe" [2004-02-06 15:00 114688]
"F-Secure Manager"="C:\Program Files\Securitoo\av_fw\Common\FSM32.exe" [2005-10-26 02:51 122929]
"F-Secure TNB"="C:\Program Files\Securitoo\av_fw\TNB\TNBUtil.exe" [2005-07-18 15:51 700416]
"F-Secure Startup Wizard"="C:\Program Files\Securitoo\av_fw\FSGUI\FSSW.exe" [2005-10-18 09:29 372736]
"News Service"="C:\Program Files\Securitoo\av_fw\FSGUI\ispnews.exe" [2005-05-31 13:45 356352]
"SSBkgdUpdate"="C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 09:22 155648]
"IndexSearch"="C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe" [2005-03-17 18:30 40960]
"BrMfcWnd"="C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe" [2006-03-28 14:48 622592]
"SetDefPrt"="C:\Program Files\Brother\Brmfl06a\BrStDvPt.exe" [2005-01-26 17:02 49152]
"ControlCenter3"="C:\Program Files\Brother\ControlCenter3\brctrcen.exe" [2006-04-10 13:58 61440]
"!AVG Anti-Spyware"="C:\Program Files\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe" [2007-12-14 03:42 144784]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-20 00:09 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"AllowLegacyWebView"= 1 (0x1)
"AllowUnhashedWebView"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMBalloonTip"= 0 (0x0)

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^DSLMON.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\DSLMON.lnk
backup=C:\WINDOWS\pss\DSLMON.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Acrobat.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Lancement rapide d'Adobe Acrobat.lnk
backup=C:\WINDOWS\pss\Lancement rapide d'Adobe Acrobat.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Reader.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Lancement rapide d'Adobe Reader.lnk
backup=C:\WINDOWS\pss\Lancement rapide d'Adobe Reader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Winter Fun Wallpaper Changer.lnk]
path=C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Winter Fun Wallpaper Changer.lnk
backup=C:\WINDOWS\pss\Winter Fun Wallpaper Changer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Nicolas^Menu Démarrer^Programmes^Démarrage^BitTorrent.lnk]
path=C:\Documents and Settings\Nicolas\Menu Démarrer\Programmes\Démarrage\BitTorrent.lnk
backup=C:\WINDOWS\pss\BitTorrent.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Nicolas^Menu Démarrer^Programmes^Démarrage^MSN Pictures Displayer.lnk]
path=C:\Documents and Settings\Nicolas\Menu Démarrer\Programmes\Démarrage\MSN Pictures Displayer.lnk
backup=C:\WINDOWS\pss\MSN Pictures Displayer.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Nicolas^Menu Démarrer^Programmes^Démarrage^Stardock ObjectDock.lnk]
path=C:\Documents and Settings\Nicolas\Menu Démarrer\Programmes\Démarrage\Stardock ObjectDock.lnk
backup=C:\WINDOWS\pss\Stardock ObjectDock.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Nicolas^Menu Démarrer^Programmes^Démarrage^UltimateZip Quick Start.lnk]
path=C:\Documents and Settings\Nicolas\Menu Démarrer\Programmes\Démarrage\UltimateZip Quick Start.lnk
backup=C:\WINDOWS\pss\UltimateZip Quick Start.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Nicolas^Menu Démarrer^Programmes^Démarrage^VOYANCE.lnk]
path=C:\Documents and Settings\Nicolas\Menu Démarrer\Programmes\Démarrage\VOYANCE.lnk
backup=C:\WINDOWS\pss\VOYANCE.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Nicolas^Menu Démarrer^Programmes^Démarrage^Y'z ToolBar.lnk]
path=C:\Documents and Settings\Nicolas\Menu Démarrer\Programmes\Démarrage\Y'z ToolBar.lnk
backup=C:\WINDOWS\pss\Y'z ToolBar.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AAWTray]
--a------ 2007-12-17 12:07 87392 C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 7.0]
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 22:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative Detector]
--------- 2004-12-02 18:23 102400 C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DownloadAccelerator]
C:\PROGRA~1\Internet\DAP\DAP.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EoEngine]
--a------ 2005-11-25 11:05 475136 C:\Program Files\Utilitaires\eoRezo\EoEngine.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Eraser]
--a------ 2003-07-25 11:15 536576 C:\Program Files\Eraser\eraser.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\fenaffiche]
--a------ 2004-07-21 16:11 180224 C:\Program Files\FenAffiche\FenPCTEK.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HbTools]
C:\Program Files\HbTools\Bin\4.7.1.0\HbtOEAddOn.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
C:\Program Files\Utilitaires\Nero\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InstantTray]
--a------ 2004-05-06 14:14 772096 C:\Program Files\Pinnacle\Shared Files\InstantCDDVD\PCLETray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2005-12-20 20:54 278528 C:\Program Files\Utilitaires\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IW_Drop_Icon]
--a------ 2004-04-20 15:17 1122816 C:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MessengerPlus3]
C:\Program Files\MessengerPlus! 3\MsgPlus.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\messengerskinner]
C:\Program Files\MessengerSkinner\MessengerSkinner.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
--a------ 2003-06-10 17:49 50688 C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2006-01-12 15:40 155648 C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NetPumper]
C:\Program Files\Internet\NetPumper\NetPumper\NetPumperIEProxy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PinnacleRemote]
--a------ 2002-01-28 18:12 61440 C:\Program Files\Pinnacle\Shared Files\remoterm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--a------ 2004-11-02 19:24 32768 C:\Program Files\Utilitaires\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoboForm]
--a------ 2007-12-15 10:11 160592 C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StatusDP]
C:\Documents and Settings\Nicolas\Mes documents\Dossier Installation\dpstatus(www.mess.be)\dpstatus.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
--a------ 2007-11-30 22:41 1266936 C:\Program Files\Steam\Steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2004-12-06 20:31 36975 C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Tiscali]
C:\Kit Tiscali\Jumbo Tiscali.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Voyance]
C:\Program Files\Allocam Multi Visio\voyance.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WeatherOnTray]
C:\Program Files\HbTools\Bin\4.8.7.0\HbtWeatherOnTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
--------- 2006-11-03 09:59 204288 C:\Program Files\Windows Media Player\WMPNSCFG.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Xanadu]
--a------ 2002-08-14 16:26 819200 C:\Program Files\Utilitaires\Xanadu\Xanadu.exe

R0 d346bus;d346bus;C:\WINDOWS\system32\DRIVERS\d346bus.sys [2004-03-12 22:41]
R0 d346prt;d346prt;C:\WINDOWS\system32\Drivers\d346prt.sys [2004-03-12 22:41]
R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2005-11-18 16:04]
R0 RITCPT;RITCPT;C:\WINDOWS\system32\drivers\RITCPT.sys [2002-02-01 19:31]
R0 viasraid;viasraid;C:\WINDOWS\system32\DRIVERS\viasraid.sys [2003-10-31 10:22]
R0 VOBID;VOBID;C:\WINDOWS\system32\DRIVERS\vobid.sys [2003-08-01 13:47]
R0 VVBackd5;VVBackd5;C:\WINDOWS\system32\drivers\VVBackd5.sys [2004-03-07 14:34]
R1 vobiw;vobiw;C:\WINDOWS\system32\drivers\vobiw.sys [2004-06-01 15:48]
R2 BackWeb Plug-in - 6588780;Antivirus Firewall;C:\PROGRA~1\SECURI~1\av_fw\backweb\6588780\Program\SERVIC~1.EXE [2007-09-04 09:42]
R2 F-Secure Filter;F-Secure File System Filter;C:\Program Files\Securitoo\av_fw\Anti-Virus\Win2K\FSfilter.sys [2004-09-10 16:14]
R2 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\Securitoo\av_fw\Anti-Virus\Win2K\FSgk.sys [2008-02-14 15:08]
R2 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\Securitoo\av_fw\Anti-Virus\Win2K\FSrec.sys [2004-06-01 10:03]
R2 FBAPI;FBAPI;C:\WINDOWS\System32\drivers\FBAPI.sys [2004-02-06 12:29]
R3 3xHybrid;Pinnacle PCTV Stereo service;C:\WINDOWS\system32\DRIVERS\3xHybrid.sys [2003-12-05 11:56]
R3 CAM1210;USB Video Camera;C:\WINDOWS\system32\Drivers\cam1210.sys [2007-01-09 11:35]
R3 cdrdrv;Cdrdrv;C:\WINDOWS\system32\Drivers\Cdrdrv.sys [2004-06-01 11:41]
R3 FET5X86V;VIA Rhine-Family Fast-Ethernet Adapter Driver Service;C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys [2007-07-05 05:33]
R3 M2400;IEEE 802.11b Wireless Network Driver;C:\WINDOWS\system32\DRIVERS\M2400.sys [2003-10-13 08:22]
S1 hidfltr;HID Filter Driver;C:\WINDOWS\system32\drivers\MWhid.sys [2004-11-03 12:20]
S2 BackWeb Client - 1044199;Securitoo AntiVirus Firewall;C:\PROGRA~1\SECURI~1\av_fw\backweb\1044199\Program\SERVIC~1.EXE []
S3 BrScnUsb;Brother USB Still Image driver;C:\WINDOWS\system32\DRIVERS\BrScnUsb.sys [2004-10-15 11:50]
S3 papycpu;papycpu;C:\WINDOWS\system32\drivers\papycpu.sys [1998-10-06 14:36]
S3 PCASp50;PCASp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\PCASp50.sys []
S3 StMp3Rec;Player Recovery Device Control Driver;C:\WINDOWS\system32\Drivers\StMp3Rec.sys [2004-01-19 13:37]
S3 TICalc;TICalc;C:\WINDOWS\system32\drivers\TICalc.sys [1999-08-30 14:51]
S4 Boonty Games;Boonty Games;"C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe" []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\Shell\AutoRun\command - D:\AUTORUN.EXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0ee2ad8d-db61-11d9-ac74-4d6564696130}]
\Shell\AutoRun\command - PortableRoboForm.exe
\Shell\RoboForm2Go\command - PortableRoboForm.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{257b7adf-d726-11d9-ac5e-806d6172696f}]
\Shell\AutoRun\command - D:\AUTORUN.EXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{257b7ae0-d726-11d9-ac5e-806d6172696f}]
\Shell\AutoRun\command - E:\autorun.exe

.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-02-15 22:07:44 C:\WINDOWS\Tasks\Scheduled scanning task.job"
- C:\PROGRA~1\SECURI~1\av_fw\ANTI-V~1\fsav.exe` /HARD /ARCHIVE /DISINF /SCHED /NOBREAK /REPORT=C:\PROGRA~1\SECURI~1\av_fw\ANTI-V~1\report.txt $C:\PROGRA~1\SECURI~1\av_fw\ANTI-V~1.SYSTEM'Tâche ajoutée par F-Secure Anti-Virus.
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-15 23:11:46
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-02-15 23:13:56
ComboFix-quarantined-files.txt 2008-02-15 22:13:31
.
2008-02-13 17:05:08 --- E O F ---

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 23:18:04, on 15/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\SECURI~1\av_fw\backweb\6588780\Program\SERVIC~1.EXE
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Securitoo\av_fw\Anti-Virus\fsgk32st.exe
C:\Program Files\Securitoo\av_fw\backweb\6588780\program\fsbwsys.exe
C:\Program Files\Securitoo\av_fw\Anti-Virus\FSGK32.EXE
C:\Program Files\Securitoo\av_fw\Common\FSMA32.EXE
C:\Program Files\Securitoo\av_fw\Anti-Virus\fssm32.exe
C:\Program Files\Securitoo\av_fw\Common\FSMB32.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Securitoo\av_fw\backweb\6588780\Program\fspex.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Securitoo\av_fw\Common\FCH32.EXE
C:\Program Files\Securitoo\av_fw\Common\FAMEH32.EXE
C:\Program Files\Securitoo\av_fw\Anti-Virus\fsqh.exe
C:\Program Files\Securitoo\av_fw\Anti-Virus\fsrw.exe
C:\Program Files\Securitoo\av_fw\FWES\Program\fsdfwd.exe
C:\Program Files\Securitoo\av_fw\Anti-Virus\fsav32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\AGRSMMSG.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\UTILIT~1\WINPAT~1\winpatrol.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Phoenix Technologies Ltd\RecoverPro_XP\VBPTASK.EXE
C:\Program Files\Securitoo\av_fw\Common\FSM32.EXE
C:\PROGRA~1\SECURI~1\av_fw\ANTI-S~1\fsaw.exe
C:\Program Files\Securitoo\av_fw\FSGUI\ispnews.exe
C:\Program Files\Securitoo\av_fw\FSGUI\fsguidll.exe
C:\Program Files\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
C:\Program Files\Utilitaires\CopernicdesktopSearch\Copernic Desktop Search\CopernicDesktopSearch.exe
C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Nicolas\Bureau\CCM.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: EoBho Class - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\PROGRA~1\UTILIT~1\eoRezo\EoAdv\EOREZO~1.DLL
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O2 - BHO: (no name) - {9C8A568E-4201-478a-8536-526CF371D2E2} - (no file)
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: Copernic Desktop Search - {C5F7A735-70F1-477F-8C36-6FF3C736017B} - C:\Program Files\Utilitaires\CopernicdesktopSearch\Copernic Desktop Search\CopernicDesktopSearchIntegration974.dll
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\PSDrvCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [WinPatrol] C:\PROGRA~1\UTILIT~1\WINPAT~1\winpatrol.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [RestoreIT!] "C:\Program Files\Phoenix Technologies Ltd\RecoverPro_XP\VBPTASK.EXE" VBStart
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Securitoo\av_fw\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Securitoo\av_fw\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\Securitoo\av_fw\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [News Service] "C:\Program Files\Securitoo\av_fw\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl06a\BrStDvPt.exe
O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
O4 - HKCU\..\Run: [Copernic Desktop Search] "C:\Program Files\Utilitaires\CopernicdesktopSearch\Copernic Desktop Search\CopernicDesktopSearch.exe" /tray
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\GestMaj.exe EspaceWanadoo.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Antivirus Firewall.lnk = C:\Program Files\Securitoo\av_fw\backweb\6588780\Program\fspex.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: &Bloquer cette fenêtre publicitaire - C:\Program Files\Securitoo\av_fw\Anti-Spyware\blockpopups.htm
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\Internet\DAP\dapextie.htm
O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 4.00\AMVConverter\grab.html
O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.13\AMVConverter\grab.html
O8 - Extra context menu item: Barre RoboForm - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Browster Prefetch On/Off - res://C:\Program Files\Browster\Browster.dll/CustomPrefetchMenu.htm
O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\Internet\DAP\dapextie2.htm
O8 - Extra context menu item: Enregistrer le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.00\MediaManager\grab.html
O8 - Extra context menu item: Personnaliser le menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Remplir le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: Télécharger avec &BitSpirit - C:\Program Files\Internet\BitSpirit\bsurl.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra button: Protection Internet Explorer - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Securitoo\av_fw\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: Protection Internet Explorer... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Securitoo\av_fw\Anti-Spyware\ieshield.dll
O9 - Extra button: Remplir - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Remplir le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Enregistrer - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Enregistrer le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Xanadu - {5CC384BB-1326-11D5-F4AE-00C04923F885} - C:\Program Files\Utilitaires\Xanadu\XanaduLaunch.exe
O9 - Extra button: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSAG~1\Messager Wanadoo.exe
O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSAG~1\Messager Wanadoo.exe
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15015/CTSUEng.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by105fd.bay105.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {8EB3FF4E-86A1-4717-884D-7BA2D38272CB} (F-Secure Online Scanner) - https://www.nordnet.com/securite
O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/PhtPkMSN.cab
O16 - DPF: {97E71027-0BA2-44F2-97DB-F84D808ED0B6} - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab55762.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15027/CTPID.cab
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Securitoo AntiVirus Firewall (BackWeb Client - 1044199) - Unknown owner - C:\PROGRA~1\SECURI~1\av_fw\backweb\1044199\Program\SERVIC~1.EXE (file missing)
O23 - Service: Antivirus Firewall (BackWeb Plug-in - 6588780) - Securitoo Portal - C:\PROGRA~1\SECURI~1\av_fw\backweb\6588780\Program\SERVIC~1.EXE
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - Unknown owner - C:\Program Files\Securitoo\av_fw\Anti-Virus\fsgk32st.exe
O23 - Service: Fax - Unknown owner - C:\WINDOWS\system32\fxssvc.exe
O23 - Service: fsbwsys - Unknown owner - C:\Program Files\Securitoo\av_fw\backweb\6588780\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\Common\FSMA32.EXE
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\System32\imapi.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe

Re,
Dis-moi si tu vois un programme dans Tous les programmes comme Adssite Games Collection
Si oui désinstalles-le.

j'ai fait exactement comme tu m'as dit de le faire précédemment avec le fichier reg.
je vais essayer ta nouvelle manip