W32.sillyfdc

Résolu
obama -  
salut,
j'ai scanné mon ordi avec symantec antivirus, et il a trouvé un virus w32.sillyfdc et d'autre fichiers suspects
je l'ai mi en quarantaine mais g l'impression que mon ordi deconne encore
pleazz est ce ke quelqu'un peu m'aider
Configuration: Windows XP
Internet Explorer 7.0

38 réponses

Résumé de la discussion

Un ordinateur Windows XP est touché après une détection d’un virus W32.Sillyfdc par l’antivirus, et malgré la mise en quarantaine, des symptômes de dysfonctionnement persistent. Des intervenants proposent des outils de désinfection avancés comme SmitFraudFix et ComboFix, puis des analyses avec HijackThis pour générer des rapports à examiner et guider la suite du nettoyage. Plusieurs requêtes soulignent l’importance de dépolluer les résultats des outils, de localiser les processus et les entrées de démarrage, et les journaux rapportés par HijackThis montrent une multitude d’éléments à vérifier. En cas de progression lente, des conseils complémentaires évoquent l’utilisation coordonnée d’outils antivirus comme AVG ou BitDefender Online et la sauvegarde des rapports pour évaluer la progression avant une éventuelle réinstallation système.

Bobot (l’IA à votre service)
  1. green day Modérateur
    Salut

    on va continuer ici !

    # Télécharge ceci: (merci a S!RI pour ce petit programme).

    http://siri.urz.free.fr/Fix/SmitfraudFix.zip

    Exécute le, Double click sur Smitfraudfix.cmd choisit l’option 1,
    voila a quoi cela ressemble : http://siri.urz.free.fr/Fix/SmitfraudFix.php
    il va générer un rapport : copie/colle le sur le poste stp.

    ++
    3
    1. DeNisCoOl
      Bonjour Guillaume,

      Bienvenue dans la communauté CCM.

      Votre problème semble proche mais vous ne donnez pas de détails sur votre configuration pour avoir une meilleure aide, on va continuer ici quand même car le problème de obama a été résolu.

      - Comme je ne sais pas ce que vous avez comme protection en plus de Norton suivre les procédures suivantes:

      Exécuter et Télécharger Spybot, CCleaner
      ------------------------
      1a- Cliquer sur Spybot pour télécharger la dernière version 1.5 (septembre 2007)
      Après installation cliquer sur Rechercher les Mises à Jour, cocher les MàJ , télécharger les MàJ.

      La première fois redémarrer en mode sans échec : après le bip et avant le logo windows tapoter sur la touche F8 (ou F5): image menu M.S.E.
      Si problème consulter le Tuto ici

      Redémarrer Spybot, cliquer sur Vérifier tout, Purger les éléments sélectionner, puis ***Vacciner***
      Le tutorial très complet http://www.safer-networking.org/fr/tutorial/index.html

      1b- Cliquer sur Spywareblaster pour le télécharger (incompatible Vista)
      Après l’installation et la configuration, il suffit de faire les mises à jour il s’occupe du reste.
      Le tutorial très complet ICI (merci à 01net.com)

      ------------------------
      2- Cliquer CCleaner (en français) pour nettoyer les fichiers temporaires, cookies... ainsi que les clefs de la base de registre inutile.

      Pendant l'installation si vous avez déjà une barre de recherche, alors décocher l'ajout de la barre yahoo.
      Son tutorial ICI
      Ensuite dans Options / Avancés, décocher : effacer uniquement les fichiers du répertoires temp de Windows de plus vieux que 48h.

      Bouton Nettoyer (s’assurer que dans l’onglet Windows la case Avancé est décoché), cliquer sur Analyse laisser travailler cela peut être très long ensuite cliquer sur Lancer le nettoyage.

      Ensuite sur le bouton Registre (s’assurer que Intégrité du registre est coché) répéter 2 fois les étapes suivantes:
      Chercher les erreurs- Réparer les erreurs sélectionnées
      Ne pas oublier de sauvegarder au cas où il supprimerait une mauvaise clef (peu probable).

      Fichier de sauvegarde à effacer plus tard s’il n’y a pas de problème par la suite.

      Et puis
      ------------------------
      3- Cliquer sur HiJackThis pour télécharger (la dernière version) sur votre bureau :
      - Le tutoriel ici (ancienne version) : https://leblogdeclaude.blogspot.com/2006/10/informatique-section-hijackthis.html

      - Installer le sur un répertoire dédié (pas un dossier temporaire).
      - Renommer Hijackthis, pour contrer une éventuelle infection de Vundo.
      - Renommer le fichier HiJackThis.exe par exemple en CCM (à chercher dans le répertoire d’installation par exemple C:\Program Files\).
      - Pour cela, faire un clic droit sur le fichier HiJackThis.exe et choisir renommer dans la liste.
      - Taper CCM et valider.
      - Double-clic sur CCM.exe.
      - Cliquer sur Do a scan and save log file.
      - Le rapport s'ouvre sur le Bloc-Note , tout sélectionner (Ctrl+A).
      - Copier (Ctrl+C) et Coller (Ctrl+V) le rapport dans le prochain message.
      Aide : N'hésite pas à consulter l'aide HiJackThis –

      Pour faciliter l’archivage des messages, vous pouvez vous identifier avec mot de passe, l’inscription est gratuite (en haut à droite).

      ------------------------
      4- Je vous conseillerais Firefox, plus sure, plus rapide et plus souple que IExplorer : http://www.mozilla-europe.org/fr/products/firefox/

      * Pour les cookies s'assurer de tout est correctement configurer, Outils / Options / Vie privée >
      * Cookies / Les conserver jusqu'à : la fermeture de firefox.
      * Vie privée cocher : Toujours effacer mes informations personnelles à la fermeture de Firefox.

      Voici un lien pour encore mieux optimiser la vitesse de navigation:
      http://www.commentcamarche.net/faq/sujet 852 firefox optimisation ameliorer les performances
      ou automatiquement regarder ici:
      https://www.01net.com/telecharger/windows/Internet/navigateur/fiches/31802.html

      A+

      Denis
      0
      1. Guillaume
        Bonsoir, j'ai un petit problème, norton identifit un virus: w32.SilyFDC mais il ne peut ni le mettre en qurentaine, ni le supprimer. De plus mon PC est trés lent et un message d'erreur s'ouvre sur internet exploreur: http 404 non trouvé. Que faire?
        Merci de votre aide
        0
        1. green day Modérateur
          très bien, pour la lenteur, voir ici :

          http://www.commentcamarche.net/faq/sujet 3446 windows xp mon pc rame que faire

          sinon, fais juste ceci :

          Relance HijackThis : choisis " do a scan only" coche la case devant les lignes ci-dessous et clique en bas sur "fix checked" :

          O21 - SSODL: systemie - {2D091A0A-2F1E-49A3-844A-794B065C2162} - sysie.dll (file missing)
          O21 - SSODL: systemha - 00000409{CB83AEB7-7EE6-434E-B092-13E9D - (no file)

          @+
          0
          2. obama Auteur
            bein ecoute je vois pas reellement de changement il est un peu lent mais bon ca ne me gene pas trop s'il est sain..et toi qu'est ce que tu conclus d'apres les rapports? pas de virus? pas de trojans?de programmes incompatibles?donne moi ton avis
            si non ben ecoute tout va bien alors le prob est resolu:)
            0
            1. green day Modérateur
              Salut

              ok, comment évolue la situation ??

              ++
              0
              1. obama
                tout d'abord merci pour ton aide et ta patience greenday..

                j'ai lu le lien et voila tous les rapports:

                1)AVG Anti-Spyware - Rapport d'analyse
                ---------------------------------------------------------

                + Créé à: 21:05:23 08/02/2008

                + Résultat de l'analyse:

                Rien à signaler.

                Fin du rapport

                2)BitDefender Online Scanner

                Scan report generated at: Fri, Feb 08, 2008 - 23:01:31

                Scan path: A:\;C:\;D:\;E:\;

                Statistics

                Time
                01:32:17

                Files
                268670

                Folders
                13699

                Boot Sectors
                3

                Archives
                4865

                Packed Files
                12421

                Results

                Identified Viruses
                6

                Infected Files
                17

                Suspect Files
                0

                Warnings
                0

                Disinfected
                0

                Deleted Files
                32

                Engines Info

                Virus Definitions
                979830

                Engine build
                AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)

                Scan plugins
                16

                Archive plugins
                41

                Unpack plugins
                7

                E-mail plugins
                6

                System plugins
                5

                Scan Settings

                First Action
                Disinfect

                Second Action
                Delete

                Heuristics
                Yes

                Enable Warnings
                Yes

                Scanned Extensions
                *;

                Exclude Extensions

                Scan Emails
                Yes

                Scan Archives
                Yes

                Scan Packed
                Yes

                Scan Files
                Yes

                Scan Boot
                Yes

                Scanned File
                Status

                C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\08A00000.VBN=>(Quarantine-PE)
                Infected with: Trojan.Downloader.Injecter.E

                C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\08A00000.VBN=>(Quarantine-PE)
                Disinfection failed

                C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\08A00000.VBN=>(Quarantine-PE)
                Deleted

                C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\08A00001.VBN=>(Quarantine-PE)
                Infected with: Trojan.Downloader.Injecter.E

                C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\08A00001.VBN=>(Quarantine-PE)
                Disinfection failed

                C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\08A00001.VBN=>(Quarantine-PE)
                Deleted

                C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\08A00002.VBN=>(Quarantine-PE)
                Infected with: Trojan.Downloader.Injecter.E

                C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\08A00002.VBN=>(Quarantine-PE)
                Disinfection failed

                C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\08A00002.VBN=>(Quarantine-PE)
                Deleted

                C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\08A00003.VBN=>(Quarantine-PE)
                Infected with: Trojan.Downloader.Injecter.E

                C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\08A00003.VBN=>(Quarantine-PE)
                Disinfection failed

                C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\08A00003.VBN=>(Quarantine-PE)
                Deleted

                C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\08A40000.VBN=>(Quarantine-PE)
                Infected with: Trojan.Downloader.Injecter.E

                C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\08A40000.VBN=>(Quarantine-PE)
                Disinfection failed

                C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\08A40000.VBN=>(Quarantine-PE)
                Deleted

                C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\08A40001.VBN=>(Quarantine-PE)
                Infected with: Trojan.Downloader.Injecter.E

                C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\08A40001.VBN=>(Quarantine-PE)
                Disinfection failed

                C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\08A40001.VBN=>(Quarantine-PE)
                Deleted

                C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\08A80000.VBN=>(Quarantine-PE)
                Infected with: Trojan.Downloader.Injecter.E

                C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\08A80000.VBN=>(Quarantine-PE)
                Disinfection failed

                C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\08A80000.VBN=>(Quarantine-PE)
                Deleted

                C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\08AC0000.VBN=>(Quarantine-PE)
                Infected with: Trojan.Downloader.Injecter.E

                C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\08AC0000.VBN=>(Quarantine-PE)
                Disinfection failed

                C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\08AC0000.VBN=>(Quarantine-PE)
                Deleted

                C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\08AC0001.VBN=>(Quarantine-PE)
                Infected with: Trojan.Downloader.Injecter.E

                C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\08AC0001.VBN=>(Quarantine-PE)
                Disinfection failed

                C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\08AC0001.VBN=>(Quarantine-PE)
                Deleted

                C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\08AC0002.VBN=>(Quarantine-PE)
                Infected with: Trojan.Downloader.Injecter.E

                C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\08AC0002.VBN=>(Quarantine-PE)
                Disinfection failed

                C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\08AC0002.VBN=>(Quarantine-PE)
                Deleted

                C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\08AC0003.VBN=>(Quarantine-PE)
                Infected with: Trojan.Downloader.Injecter.E

                C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\08AC0003.VBN=>(Quarantine-PE)
                Disinfection failed

                C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\08AC0003.VBN=>(Quarantine-PE)
                Deleted

                C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\09200000.VBN=>(Quarantine-PE)
                Infected with: Trojan.Autorun.MY

                C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\09200000.VBN=>(Quarantine-PE)
                Deleted

                C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0C700000.VBN=>(Quarantine-PE)
                Infected with: Trojan.Mojit.A

                C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0C700000.VBN=>(Quarantine-PE)
                Deleted

                C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0C700002.VBN=>(Quarantine-PE)
                Infected with: Trojan.Mojit.A

                C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0C700002.VBN=>(Quarantine-PE)
                Deleted

                C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\41200000.VBN=>(Quarantine-PE)
                Infected with: Backdoor.Bifrose.AAV

                C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\41200000.VBN=>(Quarantine-PE)
                Deleted

                C:\Program Files\Yahoo!\YPSR\Quarantine\ppq19.tmp\mysearch.cab
                Detected with: Adware.Toolbar.Myway.G

                C:\Program Files\Yahoo!\YPSR\Quarantine\ppq19.tmp\mysearch.cab
                Deleted

                C:\Program Files\Yahoo!\YPSR\Quarantine\ppq3E.tmp
                Detected with: Application.Flashget.B

                C:\Program Files\Yahoo!\YPSR\Quarantine\ppq3E.tmp
                Deleted

                3)rapport hjt

                Logfile of Trend Micro HijackThis v2.0.2
                Scan saved at 23:33:07, on 08/02/2008
                Platform: Windows XP SP2 (WinNT 5.01.2600)
                MSIE: Internet Explorer v7.00 (7.00.6000.16574)
                Boot mode: Normal

                Running processes:
                C:\WINDOWS\System32\smss.exe
                C:\WINDOWS\system32\winlogon.exe
                C:\WINDOWS\system32\services.exe
                C:\WINDOWS\system32\lsass.exe
                C:\WINDOWS\system32\svchost.exe
                C:\Program Files\Windows Defender\MsMpEng.exe
                C:\WINDOWS\System32\svchost.exe
                C:\WINDOWS\Explorer.EXE
                C:\WINDOWS\system32\spoolsv.exe
                C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                C:\WINDOWS\SYSTEM32\bgsvcgen.exe
                C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
                C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
                C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
                C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
                C:\WINDOWS\system32\nvsvc32.exe
                C:\WINDOWS\System32\svchost.exe
                C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe
                C:\PROGRA~1\MI948F~1\GAMECO~1\Common\SWTrayV4.exe
                C:\WINDOWS\System32\DSentry.exe
                C:\WINDOWS\BCMSMMSG.exe
                C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
                C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
                C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
                C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
                C:\Program Files\Windows Defender\MSASCui.exe
                C:\WINDOWS\VM_STI.EXE
                C:\Program Files\iTunes\iTunesHelper.exe
                C:\WINDOWS\system32\ctfmon.exe
                C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
                C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
                C:\Program Files\iPod\bin\iPodService.exe
                C:\Program Files\internet explorer\iexplore.exe
                C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

                R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://fr.rd.yahoo.com/customize/ie/defaults/sb/ymsgr6/fr/*http://www.yahoo.com/ext/search/search.html
                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
                R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
                R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.dell.com/en-ca
                R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :
                R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                R3 - URLSearchHook: (no name) - _{00D6A7E7-4A97-456f-848A-3B75BF7554D7} - (no file)
                R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
                O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
                O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
                O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
                O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
                O2 - BHO: Barre d'outils MSN Search Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1105\fr-fr\msntb.dll
                O3 - Toolbar: Barre d'outils MSN Search - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1105\fr-fr\msntb.dll
                O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
                O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
                O4 - HKLM\..\Run: [vptray] C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe
                O4 - HKLM\..\Run: [SideWinderTrayV4] C:\PROGRA~1\MI948F~1\GAMECO~1\Common\SWTrayV4.exe
                O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
                O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
                O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
                O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
                O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
                O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
                O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
                O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
                O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
                O4 - HKLM\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\FirstStart.exe
                O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE MINI T-CAM
                O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
                O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                O4 - HKCU\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe -NoStart
                O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
                O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
                O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
                O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
                O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
                O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
                O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
                O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\MSN Toolbar Suite\DS\02.05.0001.1119\fr-fr\bin\WindowsSearch.exe
                O8 - Extra context menu item: &MSN Search - res://C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1105\fr-fr\msntb.dll/search.htm
                O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
                O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll
                O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll
                O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
                O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
                O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
                O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20061205/qtinstall.info.apple.com/qtactivex/qtplugin.cab
                O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
                O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
                O16 - DPF: {34F12AFD-E9B5-492A-85D2-40FA4535BE83} (AxProdInfoCtl Class) - https://support.norton.com/sp/en/us/home/current/info
                O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
                O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20030625/qtinstall.info.apple.com/abarth/fr/win/QuickTimeInstaller.exe
                O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
                O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6u3-windows-i586-jc.cab
                O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
                O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
                O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
                O17 - HKLM\System\CCS\Services\Tcpip\..\{589E5813-7E4A-4626-B647-C7BE582621EC}: NameServer = 193.95.122.40 193.95.93.77
                O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
                O21 - SSODL: systemie - {2D091A0A-2F1E-49A3-844A-794B065C2162} - sysie.dll (file missing)
                O21 - SSODL: systemha - 00000409{CB83AEB7-7EE6-434E-B092-13E9D - (no file)
                O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\SYSTEM32\bgsvcgen.exe
                O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
                O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
                O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
                O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
                O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
                O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
                O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
                O24 - Desktop Component 0: (no name) - http://www.mtv.fr/mtv.fr/img/hme/hp/GeneralBackgroundLong.gif
                0
                1. green day Modérateur
                  ok, fais ce qui est indiqué ici stp :

                  http://www.commentcamarche.net/faq/sujet 3174 virus methode preliminaire de desinfection version fr

                  ++
                  0
                  1. obama Auteur
                    salut salut,

                    SDFix: Version 1.138

                    Run by on 08/02/2008 at 18:07

                    Microsoft Windows XP [version 5.1.2600]

                    Running From: C:\DOCUME~1\~1\Bureau\SDFix

                    Safe Mode:
                    Checking Services:

                    Restoring Windows Registry Values
                    Restoring Windows Default Hosts File

                    Rebooting...

                    Normal Mode:
                    Checking Files:

                    Trojan Files Found:

                    Could Not Remove C:\autorun.inf

                    Removing Temp Files...

                    ADS Check:

                    Final Check:

                    catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                    Rootkit scan 2008-02-08 18:26:02
                    Windows 5.1.2600 Service Pack 2 NTFS

                    scanning hidden processes ...

                    scanning hidden services & system hive ...

                    scanning hidden registry entries ...

                    scanning hidden files ...

                    scan completed successfully
                    hidden processes: 0
                    hidden services: 0
                    hidden files: 1427

                    Remaining Services:
                    ------------------

                    Authorized Application Key Export:

                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
                    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Messenger"
                    "C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
                    "C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule"

                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

                    Remaining Files:
                    ---------------
                    C:\autorun.inf Found

                    File Backups: - C:\DOCUME~1\~1\Bureau\SDFix\backups\backups.zip

                    Files with Hidden Attributes:

                    Thu 15 Apr 2004 4,348 ...H. --- "C:\mp3s\Sauvegarde de la licence\drmv1key.bak"
                    Sun 23 Jul 2006 20 A..H. --- "C:\mp3s\Sauvegarde de la licence\drmv1lic.bak"
                    Fri 11 Mar 2005 576 A.SH. --- "C:\mp3s\Sauvegarde de la licence\drmv2key.bak"
                    Thu 15 Apr 2004 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
                    Wed 8 Dec 2004 400 ..SH. --- "C:\Documents and Settings\All Users\DRM\v2ks.bla.bak"
                    Wed 8 Dec 2004 48 ..SH. --- "C:\Documents and Settings\All Users\DRM\v2ks.sec.bak"
                    Wed 8 Dec 2004 400 A.SH. --- "C:\Documents and Settings\All Users\DRM\v3ks.bla.bak"
                    Sat 13 Nov 2004 37,376 A..H. --- "C:\System Volume Information\_restore{2D081E92-40B0-4D11-86A6-AF667022EB05}\RP1741\A0184246.exe"
                    Thu 7 Feb 2008 6,656 A..H. --- "C:\System Volume Information\_restore{2D081E92-40B0-4D11-86A6-AF667022EB05}\RP1795\A0190024.exe"
                    Thu 7 Feb 2008 1,024 A..H. --- "C:\System Volume Information\_restore{2D081E92-40B0-4D11-86A6-AF667022EB05}\RP1795\A0190025.sys"
                    Sun 26 Aug 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp"
                    Tue 26 Aug 2003 1,206 A..HR --- "C:\Program Files\Fichiers communs\Symantec Shared\Registry Backup\ccReg.reg"
                    Mon 7 Jul 2003 1,206 A..HR --- "C:\Program Files\Fichiers communs\Symantec Shared\Registry Backup\ccReg_old.reg"
                    Mon 7 Jul 2003 12,368 A..HR --- "C:\Program Files\Fichiers communs\Symantec Shared\Registry Backup\CommonClient_old.reg"
                    Tue 26 Aug 2003 12,368 A..HR --- "C:\Program Files\Fichiers communs\Symantec Shared\Registry Backup\CommonClient.reg"

                    Finished!

                    Logfile of Trend Micro HijackThis v2.0.2
                    Scan saved at 18:43:41, on 08/02/2008
                    Platform: Windows XP SP2 (WinNT 5.01.2600)
                    MSIE: Internet Explorer v7.00 (7.00.6000.16574)
                    Boot mode: Normal

                    Running processes:
                    C:\WINDOWS\System32\smss.exe
                    C:\WINDOWS\system32\winlogon.exe
                    C:\WINDOWS\system32\services.exe
                    C:\WINDOWS\system32\lsass.exe
                    C:\WINDOWS\system32\svchost.exe
                    C:\Program Files\Windows Defender\MsMpEng.exe
                    C:\WINDOWS\System32\svchost.exe
                    C:\WINDOWS\Explorer.EXE
                    C:\WINDOWS\system32\spoolsv.exe
                    C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                    C:\WINDOWS\SYSTEM32\bgsvcgen.exe
                    C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
                    C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
                    C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
                    C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
                    C:\WINDOWS\system32\nvsvc32.exe
                    C:\WINDOWS\System32\svchost.exe
                    C:\WINDOWS\system32\wscntfy.exe
                    C:\WINDOWS\system32\notepad.exe
                    C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe
                    C:\PROGRA~1\MI948F~1\GAMECO~1\Common\SWTrayV4.exe
                    C:\WINDOWS\System32\DSentry.exe
                    C:\WINDOWS\BCMSMMSG.exe
                    C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
                    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
                    C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
                    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
                    C:\Program Files\Windows Defender\MSASCui.exe
                    C:\WINDOWS\VM_STI.EXE
                    C:\Program Files\iTunes\iTunesHelper.exe
                    C:\WINDOWS\system32\ctfmon.exe
                    C:\Program Files\MSN Messenger\msnmsgr.exe
                    C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                    C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
                    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
                    C:\Program Files\iPod\bin\iPodService.exe
                    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

                    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
                    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
                    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://fr.rd.yahoo.com/customize/ie/defaults/sb/ymsgr6/fr/*http://www.yahoo.com/ext/search/search.html
                    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
                    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
                    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.dell.com/en-ca
                    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :
                    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                    R3 - URLSearchHook: (no name) - _{00D6A7E7-4A97-456f-848A-3B75BF7554D7} - (no file)
                    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
                    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
                    O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
                    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
                    O2 - BHO: Barre d'outils MSN Search Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1105\fr-fr\msntb.dll
                    O3 - Toolbar: Barre d'outils MSN Search - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1105\fr-fr\msntb.dll
                    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
                    O4 - HKLM\..\Run: [vptray] C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe
                    O4 - HKLM\..\Run: [SideWinderTrayV4] C:\PROGRA~1\MI948F~1\GAMECO~1\Common\SWTrayV4.exe
                    O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
                    O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
                    O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
                    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
                    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
                    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
                    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
                    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
                    O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
                    O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
                    O4 - HKLM\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\FirstStart.exe
                    O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE MINI T-CAM
                    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
                    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                    O4 - HKCU\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe -NoStart
                    O4 - HKCU\..\Run: [ThePrivacyGuard] "C:\PROGRA~1\THEPRI~1\THEPRI~1.EXE" /startup
                    O4 - HKCU\..\Run: [Vidalia] "C:\Program Files\Vidalia Bundle\Vidalia\vidalia.exe"
                    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
                    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
                    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
                    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
                    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
                    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                    O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
                    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
                    O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\MSN Toolbar Suite\DS\02.05.0001.1119\fr-fr\bin\WindowsSearch.exe
                    O8 - Extra context menu item: &MSN Search - res://C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1105\fr-fr\msntb.dll/search.htm
                    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
                    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                    O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll
                    O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll
                    O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
                    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                    O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20061205/qtinstall.info.apple.com/qtactivex/qtplugin.cab
                    O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
                    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
                    O16 - DPF: {34F12AFD-E9B5-492A-85D2-40FA4535BE83} (AxProdInfoCtl Class) - https://support.norton.com/sp/en/us/home/current/info
                    O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20030625/qtinstall.info.apple.com/abarth/fr/win/QuickTimeInstaller.exe
                    O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
                    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6u3-windows-i586-jc.cab
                    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
                    O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
                    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
                    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
                    O21 - SSODL: systemie - {2D091A0A-2F1E-49A3-844A-794B065C2162} - sysie.dll (file missing)
                    O21 - SSODL: systemha - 00000409{CB83AEB7-7EE6-434E-B092-13E9D - (no file)
                    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                    O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\SYSTEM32\bgsvcgen.exe
                    O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
                    O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
                    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
                    O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
                    O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
                    O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
                    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
                    O24 - Desktop Component 0: (no name) - http://www.mtv.fr/mtv.fr/img/hme/hp/GeneralBackgroundLong.gif
                    0
                    1. green day Modérateur
                      Salut

                      ok,

                      Télécharge SDFix sur ton bureau

                      http://downloads.andymanchesta.com/RemovalTools/SDFix.exe

                      Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau.
                      Redémarre ton ordinateur en mode sans échec
                      Ouvre le dossier SDFix qui vient d'être créé sur le Bureau et double clique sur RunThis.cmd pour lancer le script.
                      Appuie sur Y pour commencer le processus de nettoyage.
                      Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
                      Appuie sur une touche pour redémarrer le PC.
                      Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
                      Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
                      Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
                      Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
                      Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum, avec un nouveau log Hijackthis !

                      ++
                      0
                      1. obama Auteur
                        ComboFix 08-02.05.3 - 2008-02-06 22:40:21.2 - NTFSx86
                        Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.225 [GMT 1:00]Endroit: C:\ComboFix.exe

                        [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
                        .

                        ((((((((((((((((((((((((((((( Fichiers créés 2008-01-06 to 2008-02-06 ))))))))))))))))))))))))))))))))))))
                        .

                        2008-02-06 22:18 . 2008-02-06 22:18 252,928 --a------ C:\RHosts.exe
                        2008-02-05 17:40 . 2008-02-05 17:40 817,429 --a------ C:\rav.zip
                        2008-02-04 23:38 . 2008-02-04 23:39 1,593,889 --a------ C:\ComboFix.exe
                        2008-02-04 23:19 . 2008-02-04 23:19 3,422 --a------ C:\WINDOWS\SYSTEM32\tmp.reg
                        2008-02-04 23:17 . 2008-02-04 23:18 <REP> d-------- C:\SmitfraudFix
                        2008-02-04 22:45 . 2008-02-04 22:45 1,146,369 --a------ C:\SmitfraudFix.zip
                        2008-02-03 23:54 . 2008-02-03 23:54 <REP> d-------- C:\Program Files\Trend Micro
                        2008-02-03 23:54 . 2008-02-03 23:54 812,344 --a------ C:\HJTInstall.exe
                        2008-01-16 22:03 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\SYSTEM32\javacpl.cpl

                        .
                        (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                        .
                        2008-02-05 18:16 --------- d-----w C:\Program Files\eMule
                        2008-02-04 13:33 --------- d-----w C:\Program Files\SPSS
                        2008-02-04 12:51 --------- d-----w C:\Program Files\Microids
                        2008-02-04 12:50 --------- d--h--w C:\Program Files\InstallShield Installation Information
                        2008-02-04 12:48 --------- d-----w C:\Program Files\Microsoft Games
                        2008-02-04 12:43 --------- d-----w C:\Program Files\Google
                        2008-01-16 21:03 --------- d-----w C:\Program Files\Java
                        2008-01-02 12:50 --------- d-----w C:\Program Files\Spybot - Search & Destroy
                        2008-01-02 12:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
                        2007-12-21 00:34 --------- d-----w C:\Program Files\Fichiers communs\Adobe
                        2007-12-21 00:34 --------- d-----w C:\Documents and Settings\Application Data\AdobeUM
                        2007-11-14 13:03 6,625,976 ----a-w C:\Program Files\FirefoxGoogleToolbarSetup.exe
                        2007-11-07 09:28 728,576 ----a-w C:\WINDOWS\SYSTEM32\lsasrv.dll
                        2007-11-07 09:28 728,576 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\lsasrv.dll
                        2007-05-15 08:57 45,576 ----a-w C:\Documents and Settings\Application Data\GDIPFONTCACHEV1.DAT
                        2006-01-22 15:23 290,807 ----a-w C:\Program Files\dictionnaire_setup.exe
                        2005-12-09 10:39 774,144 ----a-w C:\Program Files\RngInterstitial.dll
                        .

                        ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
                        .
                        .
                        REGEDIT4
                        *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

                        [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                        "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 16:09 15360]
                        "msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:55 5674352]
                        "OM_Monitor"="C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe" [2006-05-16 17:51 57344]
                        "ThePrivacyGuard"="C:\PROGRA~1\THEPRI~1\THEPRI~1.exe" [ ]
                        "Vidalia"="C:\Program Files\Vidalia Bundle\Vidalia\vidalia.exe" [ ]

                        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                        "vptray"="C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe" [2003-12-17 22:00 90112]
                        "SideWinderTrayV4"="C:\PROGRA~1\MI948F~1\GAMECO~1\Common\SWTrayV4.exe" [2000-06-02 19:07 24650]
                        "DVDSentry"="C:\WINDOWS\System32\DSentry.exe" [2002-08-14 18:22 28672]
                        "BCMSMMSG"="BCMSMMSG.exe" [2002-12-17 19:03 90112 C:\WINDOWS\BCMSMMSG.exe]
                        "AdaptecDirectCD"="C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" [2002-12-17 12:28 684032]
                        "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
                        "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-04-01 16:16 5562368]
                        "nwiz"="nwiz.exe" [2005-04-01 16:16 1495040 C:\WINDOWS\SYSTEM32\nwiz.exe]
                        "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-04-01 16:16 86016]
                        "TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2005-10-19 18:43 180269]
                        "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 23:12 49152]
                        "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 18:20 866584]
                        "snpstd"="C:\WINDOWS\vsnpstd.exe" [ ]
                        "OM_Monitor"="C:\Program Files\OLYMPUS\OLYMPUS Master\FirstStart.exe" [2006-05-16 17:50 40960]
                        "BigDogPath"="C:\WINDOWS\VM_STI.exe" [2004-06-09 07:37 40960]
                        "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-10-19 20:16 286720]
                        "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-11-02 18:36 267048]

                        [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                        "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-19 16:09 15360]
                        "DWQueuedReporting"="C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [2005-04-25 12:45 36040]

                        C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
                        Adobe Gamma Loader.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2003-10-20 13:08:15 110592]
                        Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 21:05:26 29696]
                        DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2004-12-17 18:08:59 962663]
                        HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-11 23:23:26 282624]
                        Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 09:01:04 83360]
                        Windows Desktop Search.lnk - C:\Program Files\MSN Toolbar Suite\DS\[u]0[/u]2.05.0001.1119\fr-fr\bin\WindowsSearch.exe [2005-09-20 18:10:04 238080]

                        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
                        "systemie"= {2D091A0A-2F1E-49A3-844A-794B065C2162} - sysie.dll [ ]

                        R1 ATMhelpr;ATMhelpr;C:\WINDOWS\system32\drivers\ATMhelpr.sys [1997-06-17 05:00]
                        S3 C-Dilla;C-Dilla;C:\WINDOWS\system32\drivers\CDANT.SYS [2003-04-01 10:23]
                        S3 NmpdrvN;Audio Player USB Controller;C:\WINDOWS\system32\Drivers\NmpdrvN.sys [2003-06-09 18:58]
                        S3 NMSCFG;NIC Management Service Configuration Driver;C:\WINDOWS\System32\drivers\NMSCFG.SYS [2002-10-10 04:18]
                        S3 NMSSvc;Intel(R) NMS;C:\WINDOWS\System32\NMSSvc.exe [2002-10-10 04:18]

                        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3785a1ed-8b60-11db-a765-4d6564696130}]
                        \Shell\AutoRun\command - a.exe

                        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{72a5c395-6a47-11db-a6dc-4d6564696130}]
                        \Shell\AutoRun\command - a.exe

                        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7fefa42a-c762-11dc-ab34-4d6564696130}]
                        \Shell\??\command - F:\taipingtianguov1.1.exe
                        \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL taipingtianguov1.1.exe

                        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{83b50b34-ba2b-11dc-ab1d-4d6564696130}]
                        \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL antihost.exe

                        .
                        Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
                        "2008-02-01 13:10:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
                        - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
                        "2008-02-06 19:22:53 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
                        - C:\Program Files\Windows Defender\MpCmdRun.exe
                        "2008-02-06 21:46:00 C:\WINDOWS\Tasks\Symantec NetDetect.job"
                        - C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE
                        .
                        **************************************************************************

                        catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                        Rootkit scan 2008-02-06 22:47:47
                        Windows 5.1.2600 Service Pack 2 NTFS

                        Balayage processus cachés ...

                        Balayage caché autostart entries ...

                        Balayage des fichiers cachés ...

                        Scan terminé avec succès
                        Les fichiers cachés: 0

                        **************************************************************************
                        .
                        --------------------- DLLs a chargé sous des processus courants ---------------------

                        PROCESS: C:\WINDOWS\system32\winlogon.exe
                        -> C:\WINDOWS\System32\NavLogon.dll
                        .
                        Temps d'accomplissement: 2008-02-06 22:49:06
                        ComboFix-quarantined-files.txt 2008-02-06 21:48:44
                        ComboFix2.txt 2008-02-04 22:53:33
                        .
                        2008-02-06 13:21:11 --- E O F ---
                        0
                        1. obama Auteur
                          lol je me disais aussi..tout de suite ca arrice chef
                          0
                          1. green day Modérateur
                            oups ! je me suis trompé, je voulais dire un nouveau combo stp ! :)

                            ++
                            0
                            1. obama Auteur
                              Logfile of Trend Micro HijackThis v2.0.2
                              Scan saved at 22:32:25, on 06/02/2008
                              Platform: Windows XP SP2 (WinNT 5.01.2600)
                              MSIE: Internet Explorer v7.00 (7.00.6000.16574)
                              Boot mode: Normal

                              Running processes:
                              C:\WINDOWS\System32\smss.exe
                              C:\WINDOWS\system32\winlogon.exe
                              C:\WINDOWS\system32\services.exe
                              C:\WINDOWS\system32\lsass.exe
                              C:\WINDOWS\system32\svchost.exe
                              C:\Program Files\Windows Defender\MsMpEng.exe
                              C:\WINDOWS\System32\svchost.exe
                              C:\WINDOWS\Explorer.EXE
                              C:\WINDOWS\system32\spoolsv.exe
                              C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                              C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                              C:\WINDOWS\SYSTEM32\bgsvcgen.exe
                              C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
                              C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
                              C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
                              C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
                              C:\WINDOWS\system32\nvsvc32.exe
                              C:\WINDOWS\System32\svchost.exe
                              C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe
                              C:\PROGRA~1\MI948F~1\GAMECO~1\Common\SWTrayV4.exe
                              C:\WINDOWS\System32\DSentry.exe
                              C:\WINDOWS\BCMSMMSG.exe
                              C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
                              C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
                              C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
                              C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
                              C:\Program Files\Windows Defender\MSASCui.exe
                              C:\WINDOWS\VM_STI.EXE
                              C:\Program Files\iTunes\iTunesHelper.exe
                              C:\WINDOWS\system32\ctfmon.exe
                              C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
                              C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                              C:\Program Files\iPod\bin\iPodService.exe
                              C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
                              C:\Program Files\internet explorer\iexplore.exe
                              C:\Program Files\WinRAR\WinRAR.exe
                              C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

                              R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
                              R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
                              R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                              R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://fr.rd.yahoo.com/customize/ie/defaults/sb/ymsgr6/fr/*http://www.yahoo.com/ext/search/search.html
                              R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                              R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
                              R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
                              R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.dell.com/en-ca
                              R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :
                              R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                              R3 - URLSearchHook: (no name) - _{00D6A7E7-4A97-456f-848A-3B75BF7554D7} - (no file)
                              R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
                              O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
                              O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
                              O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                              O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                              O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
                              O2 - BHO: Barre d'outils MSN Search Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1105\fr-fr\msntb.dll
                              O3 - Toolbar: Barre d'outils MSN Search - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1105\fr-fr\msntb.dll
                              O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
                              O4 - HKLM\..\Run: [vptray] C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe
                              O4 - HKLM\..\Run: [SideWinderTrayV4] C:\PROGRA~1\MI948F~1\GAMECO~1\Common\SWTrayV4.exe
                              O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
                              O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
                              O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
                              O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
                              O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
                              O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
                              O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
                              O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                              O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
                              O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
                              O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
                              O4 - HKLM\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\FirstStart.exe
                              O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE MINI T-CAM
                              O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                              O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
                              O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                              O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
                              O4 - HKCU\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe -NoStart
                              O4 - HKCU\..\Run: [ThePrivacyGuard] "C:\PROGRA~1\THEPRI~1\THEPRI~1.EXE" /startup
                              O4 - HKCU\..\Run: [Vidalia] "C:\Program Files\Vidalia Bundle\Vidalia\vidalia.exe"
                              O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
                              O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                              O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
                              O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
                              O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
                              O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                              O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
                              O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                              O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
                              O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\MSN Toolbar Suite\DS\02.05.0001.1119\fr-fr\bin\WindowsSearch.exe
                              O8 - Extra context menu item: &MSN Search - res://C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1105\fr-fr\msntb.dll/search.htm
                              O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
                              O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                              O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                              O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll
                              O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll
                              O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
                              O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                              O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                              O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                              O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                              O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20061205/qtinstall.info.apple.com/qtactivex/qtplugin.cab
                              O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
                              O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
                              O16 - DPF: {34F12AFD-E9B5-492A-85D2-40FA4535BE83} (AxProdInfoCtl Class) - https://support.norton.com/sp/en/us/home/current/info
                              O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20030625/qtinstall.info.apple.com/abarth/fr/win/QuickTimeInstaller.exe
                              O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
                              O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6u3-windows-i586-jc.cab
                              O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
                              O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
                              O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
                              O17 - HKLM\System\CCS\Services\Tcpip\..\{589E5813-7E4A-4626-B647-C7BE582621EC}: NameServer = 193.95.93.77 193.95.122.40
                              O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
                              O21 - SSODL: systemie - {2D091A0A-2F1E-49A3-844A-794B065C2162} - sysie.dll (file missing)
                              O21 - SSODL: systemha - 00000409{CB83AEB7-7EE6-434E-B092-13E9D - (no file)
                              O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                              O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                              O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\SYSTEM32\bgsvcgen.exe
                              O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
                              O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
                              O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                              O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
                              O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
                              O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
                              O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
                              O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
                              O24 - Desktop Component 0: (no name) - http://www.mtv.fr/mtv.fr/img/hme/hp/GeneralBackgroundLong.gif
                              0
                              1. green day Modérateur
                                ok poste un nouveau hijack stp

                                ++
                                0
                                1. obama Auteur
                                  c'est fait...
                                  voila le rapport hjt :

                                  Logfile of Trend Micro HijackThis v2.0.2
                                  Scan saved at 22:20:22, on 06/02/2008
                                  Platform: Windows XP SP2 (WinNT 5.01.2600)
                                  MSIE: Internet Explorer v7.00 (7.00.6000.16574)
                                  Boot mode: Normal

                                  Running processes:
                                  C:\WINDOWS\System32\smss.exe
                                  C:\WINDOWS\system32\winlogon.exe
                                  C:\WINDOWS\system32\services.exe
                                  C:\WINDOWS\system32\lsass.exe
                                  C:\WINDOWS\system32\svchost.exe
                                  C:\Program Files\Windows Defender\MsMpEng.exe
                                  C:\WINDOWS\System32\svchost.exe
                                  C:\WINDOWS\Explorer.EXE
                                  C:\WINDOWS\system32\spoolsv.exe
                                  C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                                  C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                                  C:\WINDOWS\SYSTEM32\bgsvcgen.exe
                                  C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
                                  C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
                                  C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
                                  C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
                                  C:\WINDOWS\system32\nvsvc32.exe
                                  C:\WINDOWS\System32\svchost.exe
                                  C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe
                                  C:\PROGRA~1\MI948F~1\GAMECO~1\Common\SWTrayV4.exe
                                  C:\WINDOWS\System32\DSentry.exe
                                  C:\WINDOWS\BCMSMMSG.exe
                                  C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
                                  C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
                                  C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
                                  C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
                                  C:\Program Files\Windows Defender\MSASCui.exe
                                  C:\WINDOWS\VM_STI.EXE
                                  C:\Program Files\iTunes\iTunesHelper.exe
                                  C:\WINDOWS\system32\ctfmon.exe
                                  C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
                                  C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                                  C:\Program Files\iPod\bin\iPodService.exe
                                  C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
                                  C:\Program Files\internet explorer\iexplore.exe
                                  C:\Program Files\WinRAR\WinRAR.exe
                                  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

                                  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
                                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
                                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://fr.rd.yahoo.com/customize/ie/defaults/sb/ymsgr6/fr/*http://www.yahoo.com/ext/search/search.html
                                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                                  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
                                  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
                                  R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.dell.com/en-ca
                                  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :
                                  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                                  R3 - URLSearchHook: (no name) - _{00D6A7E7-4A97-456f-848A-3B75BF7554D7} - (no file)
                                  R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
                                  O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
                                  O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
                                  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                                  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                                  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
                                  O2 - BHO: Barre d'outils MSN Search Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1105\fr-fr\msntb.dll
                                  O3 - Toolbar: Barre d'outils MSN Search - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1105\fr-fr\msntb.dll
                                  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
                                  O4 - HKLM\..\Run: [vptray] C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe
                                  O4 - HKLM\..\Run: [SideWinderTrayV4] C:\PROGRA~1\MI948F~1\GAMECO~1\Common\SWTrayV4.exe
                                  O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
                                  O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
                                  O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
                                  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
                                  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
                                  O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
                                  O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
                                  O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                                  O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
                                  O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
                                  O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
                                  O4 - HKLM\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\FirstStart.exe
                                  O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE MINI T-CAM
                                  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                                  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
                                  O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                                  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
                                  O4 - HKCU\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe -NoStart
                                  O4 - HKCU\..\Run: [ThePrivacyGuard] "C:\PROGRA~1\THEPRI~1\THEPRI~1.EXE" /startup
                                  O4 - HKCU\..\Run: [Vidalia] "C:\Program Files\Vidalia Bundle\Vidalia\vidalia.exe"
                                  O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
                                  O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                                  O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
                                  O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
                                  O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
                                  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                                  O4 - Global Startup: DSLMON.lnk = C:\Program Files\--SAGEM\--SAGEM F@st 800-840\dslmon.exe
                                  O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                                  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
                                  O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\MSN Toolbar Suite\DS\02.05.0001.1119\fr-fr\bin\WindowsSearch.exe
                                  O8 - Extra context menu item: &MSN Search - res://C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1105\fr-fr\msntb.dll/search.htm
                                  O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
                                  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                                  O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                                  O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll
                                  O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll
                                  O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
                                  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                                  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                                  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                                  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                                  O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20061205/qtinstall.info.apple.com/qtactivex/qtplugin.cab
                                  O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
                                  O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
                                  O16 - DPF: {34F12AFD-E9B5-492A-85D2-40FA4535BE83} (AxProdInfoCtl Class) - https://support.norton.com/sp/en/us/home/current/info
                                  O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20030625/qtinstall.info.apple.com/abarth/fr/win/QuickTimeInstaller.exe
                                  O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
                                  O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6u3-windows-i586-jc.cab
                                  O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
                                  O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
                                  O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
                                  O17 - HKLM\System\CCS\Services\Tcpip\..\{589E5813-7E4A-4626-B647-C7BE582621EC}: NameServer = 193.95.93.77 193.95.122.40
                                  O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
                                  O21 - SSODL: systemie - {2D091A0A-2F1E-49A3-844A-794B065C2162} - sysie.dll (file missing)
                                  O21 - SSODL: systemha - 00000409{CB83AEB7-7EE6-434E-B092-13E9D - (no file)
                                  O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                                  O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                                  O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\SYSTEM32\bgsvcgen.exe
                                  O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
                                  O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
                                  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                                  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
                                  O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
                                  O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
                                  O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
                                  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
                                  O24 - Desktop Component 0: (no name) - http://www.mtv.fr/mtv.fr/img/hme/hp/GeneralBackgroundLong.gif
                                  0
                                  1. green day Modérateur
                                    ok, essaye avec ceci :

                                    http://siri.urz.free.fr/RHosts.php

                                    ++
                                    0
                                    1. obama Auteur
                                      je l'ai retelechargé une autre fois et unzipped proprement sur le bureau et rien toujour le meme msg d'erreur quand je clique sur retore ms files..:(
                                      0
                                      2. green day Modérateur
                                        tu as bien décompressé l'archive ??

                                        ++
                                        0
                                        • 1
                                        • 2

                                        Discussions similaires

                                        W32 L32: correspondance entre taille US et taille française
                                        efg

                                        6 réponses
                                        Win32:Malware-gen
                                        botte36

                                        15 réponses
                                        W32.jeefo
                                        Vador

                                        3 réponses
                                        win32:malware-gen bloqué par avast
                                        ikkual

                                        69 réponses
                                        C'est quoi "Win32:Trojan-gen {Other}"
                                        Uzumaki

                                        5 réponses