Win 32 : BHO-KD

ninouche85 -  
Bonsoir, je voudrais de l'aide pour me débarasser de ce fameux trojan, Win32: BHO-KD.
Avast l'a detecté il y a deja un moment mais ne veut pas le supprimer. J'ai essayé avec plusieurs antivirus : AVG, ad-Aware, a-squared, mais rien ne marche.
Quelqu'un pourrait-il m'aider s'il vous plait?!!
Configuration: Windows XP
Firefox 2.0.0.12

37 réponses

Résumé de la discussion

Il s'agit de la tentative de suppression du cheval de Troie Win32: BHO-KD sur Windows XP avec Firefox, Avast détectant mais incapable de le supprimer et des essais avec AVG et Ad-Aware. Des solutions proposées incluent VundoFix, des analyses avec HijackThis et des scans en ligne BitDefender, ainsi que des conseils d'utilisation Spybot en mode avancé et de désactivation temporaire de la restauration. Des rapports via HijackThis détaillent les processus et règles de registre, et listent des programmes à vérifier ou supprimer avec des références à des outils antivirus et des instructions de nettoyage. D'autres éléments signalent que certains composants persistent au démarrage et nécessitent une désactivation préalable ou une remise à zéro des paramètres système pour permettre l'élimination effective.

Bobot (l’IA à votre service)
  3. ep44 Contributeur
    pour spybot

    tu ouvres spybot et tu va dans mode et tu choisis le mode avancés
    ensuite ==>outils==>résident==>et tu décoche la case tea timer

    ensuite si plus de soucis
    Tu peux supprimer tous les logiciels que nous avons utilisés
    va dans ajout/suppression de programes et dans programmes files
    pour vérifier

    ensuite fait ceci (IMPORTANT)

    =démarrer
    =panneau de configuration
    =système
    =onglet Restauration système
    =coche la case (Désactiver la restauration système)
    =redémarre l'ordinateur
    =réactive la ensuite
    @-+
    1. ninouche85
      bonsoir,

      j'ai juste des messages de spybot pour autoriser ou non certaines modifications mais je ne sais pas quoi répondre.

      Le scan de bitdefender montre encore des virus?! Dois-je faire quelque chose d'autre?
      3. ninouche85
        Rapport bitdefender

        BitDefender Online Scanner

        Rapport d'analyse généré à: Mon, Feb 25, 2008 - 12:46:03

        Voie d'analyse: A:\;C:\;D:\;E:\;G:\;H:\;I:\;J:\;K:\;

        Statistiques

        Temps

        01:13:31

        Fichiers

        87080

        Directoires

        12404

        Secteurs de boot

        4

        Archives

        2489

        Paquets programmes

        6570

        Résultats

        Virus identifiés

        2

        Fichiers infectés

        2

        Fichiers suspects

        0

        Avertissements

        0

        Désinfectés

        0

        Fichiers effacés

        2

        Info sur les moteurs

        Définition virus

        899742

        Version des moteurs

        AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)

        Analyse des plugins

        14

        Archive des plugins

        38

        Unpack des plugins

        7

        E-mail plugins

        6

        Système plugins

        1

        Paramètres d'analyse

        Première action

        Désinfecté

        Seconde Action

        Supprimé

        Heuristique

        Oui

        Acceptez les avertissements

        Oui

        Extensions analysées

        exe;com;dll;ocx;scr;bin;dat;386;vxd;sys;wdm;cla;class;ovl;ole;hlp;doc;dot;xls;ppt;wbk;wiz;pot;ppa;xla;xlt;vbs;vbe;mdb;rtf;htm;hta;html;xml;xtp;php;asp;js;shs;chm;lnk;pif;prc;url;smm;pfd;msi;ini;csc;cmd;bas;

        Excludez les extensions

        Analyse d'emails

        Oui

        Analyse des Archives

        Oui

        Analyser paquets programmes

        Oui

        Analyse des fichiers

        Oui

        Analyse de boot

        Oui

        Fichier analysé

        Statut

        C:\Documents and Settings\Nomii 2\Bureau\Nouveau dossier\PATCHER.EXE=>wise0013

        Infecté par: Trojan.Downloader.Small.BTF

        C:\Documents and Settings\Nomii 2\Bureau\Nouveau dossier\PATCHER.EXE=>wise0013

        Echec de la désinfection

        C:\Documents and Settings\Nomii 2\Bureau\Nouveau dossier\PATCHER.EXE=>wise0013

        Supprimé

        C:\Documents and Settings\Nomii 2\Bureau\Nouveau dossier\PATCHER.EXE

        Echec de la mise à jour

        C:\Documents and Settings\Nomii 2\Shared\BitDownload Setup.exe=>(NSIS o)=>lzma_solid_nsis0005

        Infecté par: Trojan.Obfus.6.Gen

        C:\Documents and Settings\Nomii 2\Shared\BitDownload Setup.exe=>(NSIS o)=>lzma_solid_nsis0005

        Echec de la désinfection

        C:\Documents and Settings\Nomii 2\Shared\BitDownload Setup.exe=>(NSIS o)=>lzma_solid_nsis0005

        Supprimé

        C:\Documents and Settings\Nomii 2\Shared\BitDownload Setup.exe=>(NSIS o)

        Echec de la mise à jour
        2. sebbissy
          bonjour j'ai le virus win32:bho-kdo et je n'arrive pas a le supprimer avec avast

          voici le rapport. merci

          Logfile of Trend Micro HijackThis v2.0.2
          Scan saved at 22:29:21, on 18/02/2008
          Platform: Windows XP SP2 (WinNT 5.01.2600)
          MSIE: Internet Explorer v7.00 (7.00.6000.16608)
          Boot mode: Safe mode

          Running processes:
          C:\WINDOWS\System32\smss.exe
          C:\WINDOWS\system32\winlogon.exe
          C:\WINDOWS\system32\services.exe
          C:\WINDOWS\system32\lsass.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\Explorer.EXE
          C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
          R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://192.168.1.1/
          R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
          R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
          O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
          O2 - BHO: Shareaza Web Download Hook - {0EEDB912-C5FA-486F-8334-57288578C627} - C:\Program Files\Shareaza\Plugins\RazaWebHook.dll
          O2 - BHO: ShoppingReport - {100EB1FD-D03E-47FD-81F3-EE91287F9465} - C:\Program Files\ShoppingReport\Bin\2.0.26\ShoppingReport.dll
          O2 - BHO: Adssite Search Assistant - {1648E328-3E5A-4EA5-A9C6-E5F09EE272DA} - C:\WINDOWS\system32\adssite_sidebar.dll
          O2 - BHO: (no name) - {18818BD4-DA1B-4669-8031-35F145CBC776} - C:\WINDOWS\system32\pmnnm.dll (file missing)
          O2 - BHO: BrowserCmp - {1D8282E6-BC4F-469B-AAED-7E4FF077AD93} - C:\WINDOWS\system32\iebrowserc.dll
          O2 - BHO: (no name) - {2D767C9A-534B-4419-92F9-CA3FF43585EF} - C:\WINDOWS\system32\dbghel.dll
          O2 - BHO: dsWebAllowBHO Class - {2F85D76C-0569-466F-A488-493E6BD0E955} - C:\Program Files\Windows Desktop Search\dsWebAllow.dll
          O2 - BHO: Online_TV Toolbar - {40d1c3a7-4ffb-4443-b3a0-a64b2df7fc3b} - C:\Program Files\Online_TV\tbOnl0.dll
          O2 - BHO: {c3fb72ac-dc59-df98-8624-6dc79386e674} - {476e6839-7cd6-4268-89fd-95cdca27bf3c} - C:\WINDOWS\system32\xweapjiu.dll (file missing)
          O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - C:\WINDOWS\system32\urqrrsr.dll (file missing)
          O2 - BHO: dcads - {6FC3C36D-7635-4D43-BA62-0D9D2F2CD06E} - C:\WINDOWS\system32\nsrB15.dll
          O2 - BHO: Multi_Media_France Toolbar - {7009fcd4-05be-44f4-9583-93fe419ab7b0} - C:\Program Files\Multi_Media_France\tbMul0.dll
          O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
          O2 - BHO: superiorads - {79F562E5-768C-4494-8E6C-824ADA4A9C2C} - C:\WINDOWS\system32\sprt_ads.dll (file missing)
          O2 - BHO: ads_optimizer - {9C8A568E-4201-478a-8536-526CF371D2E2} - C:\WINDOWS\system32\nsgB37.dll
          O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
          O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
          O2 - BHO: Multi_Media Toolbar - {b5146c40-189a-4311-bda9-fbae3e023187} - C:\Program Files\Multi_Media\tbMul1.dll
          O2 - BHO: (no name) - {C04FB9D4-AD8A-4BC0-9BE3-28406402C09C} - C:\WINDOWS\system32\ssqrq.dll (file missing)
          O2 - BHO: WhIeHelperObj Class - {c900b400-cdfe-11d3-976a-00e02913a9e0} - C:\Program Files\webHancer\programs\whiehlpr.dll (file missing)
          O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
          O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
          O3 - Toolbar: Online_TV Toolbar - {40d1c3a7-4ffb-4443-b3a0-a64b2df7fc3b} - C:\Program Files\Online_TV\tbOnl0.dll
          O3 - Toolbar: Multi_Media_France Toolbar - {7009fcd4-05be-44f4-9583-93fe419ab7b0} - C:\Program Files\Multi_Media_France\tbMul0.dll
          O3 - Toolbar: Multi_Media Toolbar - {b5146c40-189a-4311-bda9-fbae3e023187} - C:\Program Files\Multi_Media\tbMul1.dll
          O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
          O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
          O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
          O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
          O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
          O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
          O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
          O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
          O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
          O4 - HKLM\..\Run: [TVPService] "C:\Program Files\HP\TVPlay\TVPService.exe"
          O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
          O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
          O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
          O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
          O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
          O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
          O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
          O4 - HKLM\..\Run: [trioService] "C:\PROGRA~1\Freeze.com\Living 3D Dolphins\trioService.exe "
          O4 - HKLM\..\Run: [DisableIPC] C:\Program Files\Cable & ADSL Optimizer\DisableIPC.exe
          O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
          O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
          O4 - HKLM\..\Run: [845d713a] rundll32.exe "C:\WINDOWS\system32\dvcwhqat.dll",sitypnow
          O4 - HKLM\..\Run: [spa_start] C:\WINDOWS\System32\Rundll32.exe "C:\WINDOWS\system32\sprt_ads.dll" DllStart
          O4 - HKLM\..\Run: [webHancer Agent] C:\Program Files\webHancer\Programs\whagent.exe
          O4 - HKLM\..\Run: [ptask] C:\Program Files\ProtectionConue\ptask.exe
          O4 - HKLM\..\Run: [Salestart] "C:\Program Files\Fichiers communs\ReparateurDeSysteme\strpmon.exe" dm=http://reparateurdesysteme.com ad=http://reparateurdesysteme.com sd=http://repay.reparateurdesysteme.com
          O4 - HKLM\..\Run: [bm] "C:\Program Files\Fichiers communs\ProtectionConue\bm.exe" dm=http://protectionconue.com ad=http://protectionconue.com sd=http://gregistre.protectionconue.com
          O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
          O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
          O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
          O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
          O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
          O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
          O4 - HKCU\..\Run: [Internet Download Accelerator] C:\Program Files\IDA\ida.exe -autorun
          O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
          O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
          O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
          O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
          O4 - Startup: SmartCenter 2.0.lnk = C:\LOTSUITE\SMARTCTR\SMARTCTR.EXE
          O4 - Startup: Vente Flash.lnk = C:\Program Files\Vente Flash\vente_flash.exe
          O4 - Global Startup: Démarrage rapide de HP Photosmart Premier.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
          O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
          O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
          O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
          O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
          O8 - Extra context menu item: Download with &Shareaza - res://C:\Program Files\Shareaza\Plugins\RazaWebHook.dll/3000
          O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
          O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
          O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
          O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
          O9 - Extra button: (no name) - {9819CC0E-9669-4D01-9CD7-2C66DA43AC6C} - (no file)
          O9 - Extra button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} - C:\Program Files\ShoppingReport\Bin\2.0.26\ShoppingReport.dll
          O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\Program Files\ShoppingReport\Bin\2.0.26\ShoppingReport.dll
          O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
          O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
          O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
          O10 - Hijacked Internet access by WebHancer
          O10 - Hijacked Internet access by WebHancer
          O10 - Hijacked Internet access by WebHancer
          O14 - IERESET.INF: START_PAGE_URL=https://www8.hp.com/fr/fr/home.html
          O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
          O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
          O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
          O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
          O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
          O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://jeuxmultijoueurs.orange.fr/Gameshell/GameHost/1.0/OberonGameHost.cab
          O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
          O20 - Winlogon Notify: awtqo - C:\WINDOWS\system32\awtqo.dll (file missing)
          O20 - Winlogon Notify: awtqppq - awtqppq.dll (file missing)
          O20 - Winlogon Notify: awtqr - C:\WINDOWS\system32\awtqr.dll (file missing)
          O20 - Winlogon Notify: awtsp - C:\WINDOWS\system32\awtsp.dll (file missing)
          O20 - Winlogon Notify: awvtr - C:\WINDOWS\system32\awvtr.dll (file missing)
          O20 - Winlogon Notify: awvvw - C:\WINDOWS\system32\awvvw.dll (file missing)
          O20 - Winlogon Notify: ddayv - C:\WINDOWS\system32\ddayv.dll (file missing)
          O20 - Winlogon Notify: ddccc - C:\WINDOWS\system32\ddccc.dll (file missing)
          O20 - Winlogon Notify: ddcya - C:\WINDOWS\system32\ddcya.dll (file missing)
          O20 - Winlogon Notify: gebcc - C:\WINDOWS\system32\gebcc.dll (file missing)
          O20 - Winlogon Notify: jkhfg - C:\WINDOWS\system32\jkhfg.dll (file missing)
          O20 - Winlogon Notify: jkhhf - C:\WINDOWS\system32\jkhhf.dll (file missing)
          O20 - Winlogon Notify: jkkjg - C:\WINDOWS\system32\jkkjg.dll (file missing)
          O20 - Winlogon Notify: mljge - C:\WINDOWS\system32\mljge.dll (file missing)
          O20 - Winlogon Notify: mljgg - C:\WINDOWS\system32\mljgg.dll (file missing)
          O20 - Winlogon Notify: mljji - C:\WINDOWS\system32\mljji.dll (file missing)
          O20 - Winlogon Notify: mllji - C:\WINDOWS\system32\mllji.dll (file missing)
          O20 - Winlogon Notify: mllml - C:\WINDOWS\system32\mllml.dll (file missing)
          O20 - Winlogon Notify: nnnligf - nnnligf.dll (file missing)
          O20 - Winlogon Notify: pmkhe - C:\WINDOWS\system32\pmkhe.dll (file missing)
          O20 - Winlogon Notify: pmkhf - C:\WINDOWS\system32\pmkhf.dll (file missing)
          O20 - Winlogon Notify: pmnlj - C:\WINDOWS\system32\pmnlj.dll (file missing)
          O20 - Winlogon Notify: pmnll - C:\WINDOWS\system32\pmnll.dll (file missing)
          O20 - Winlogon Notify: pmnlm - C:\WINDOWS\system32\pmnlm.dll (file missing)
          O20 - Winlogon Notify: pmnnm - C:\WINDOWS\system32\pmnnm.dll (file missing)
          O20 - Winlogon Notify: ssqro - C:\WINDOWS\system32\ssqro.dll (file missing)
          O20 - Winlogon Notify: ssqrs - C:\WINDOWS\system32\ssqrs.dll (file missing)
          O20 - Winlogon Notify: sstqn - C:\WINDOWS\system32\sstqn.dll (file missing)
          O20 - Winlogon Notify: ssttt - C:\WINDOWS\system32\ssttt.dll (file missing)
          O20 - Winlogon Notify: urqrrsr - urqrrsr.dll (file missing)
          O20 - Winlogon Notify: vtsqn - C:\WINDOWS\system32\vtsqn.dll (file missing)
          O20 - Winlogon Notify: vtsqo - C:\WINDOWS\system32\vtsqo.dll (file missing)
          O20 - Winlogon Notify: vtuts - C:\WINDOWS\system32\vtuts.dll (file missing)
          O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
          O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
          O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
          O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
          O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
          O23 - Service: CyberLink Media Library Service(HP TVPlay) - Cyberlink - C:\Program Files\HP\TVPlay\Kernel\CLML_NTService\CLMLServer.exe
          O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
          O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
          O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
          O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
          O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
          O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
          O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
          O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
          O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
          O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
          O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
          O23 - Service: CyberLink Background Capture Service (CBCS HP TVPlay) (TVPCapSvc) - Unknown owner - C:\Program Files\HP\TVPlay\Kernel\TV\TVPCapSvc.exe
          O23 - Service: CyberLink Task Scheduler (CTS HP TVPlay) (TVPSched) - Unknown owner - C:\Program Files\HP\TVPlay\Kernel\TV\TVPSched.exe
          2. ninouche85
            rapport avg,

            ---------------------------------------------------------
            AVG Anti-Spyware - Rapport d'analyse
            ---------------------------------------------------------

            + Créé à: 12:35:35 18/02/2008

            + Résultat de l'analyse:

            :mozilla.163:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
            :mozilla.170:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
            :mozilla.43:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
            :mozilla.44:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
            :mozilla.49:C:\Documents and Settings\Michel\Application Data\Mozilla\Firefox\Profiles\9iqps168.default\cookies.txt -> TrackingCookie.Adtech : Nettoyé.
            :mozilla.66:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Adtech : Nettoyé.
            :mozilla.182:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
            :mozilla.183:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
            :mozilla.184:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
            :mozilla.185:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
            :mozilla.69:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Atdmt : Nettoyé.
            C:\Documents and Settings\NiNoUcHe\Cookies\ninouche@atdmt[2].txt -> TrackingCookie.Atdmt : Nettoyé.
            C:\Documents and Settings\Nomii 2\Cookies\nomii_2@atdmt[2].txt -> TrackingCookie.Atdmt : Nettoyé.
            :mozilla.229:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Bluestreak : Nettoyé.
            :mozilla.64:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Comclick : Nettoyé.
            :mozilla.65:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Comclick : Nettoyé.
            :mozilla.67:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Comclick : Nettoyé.
            :mozilla.225:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Doubleclick : Nettoyé.
            :mozilla.29:C:\Documents and Settings\Michel\Application Data\Mozilla\Firefox\Profiles\9iqps168.default\cookies.txt -> TrackingCookie.Doubleclick : Nettoyé.
            :mozilla.41:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Estat : Nettoyé.
            :mozilla.188:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Netflame : Nettoyé.
            C:\Documents and Settings\NiNoUcHe\Cookies\ninouche@ssl-hints.netflame[1].txt -> TrackingCookie.Netflame : Nettoyé.
            :mozilla.36:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Overture : Nettoyé.
            C:\Documents and Settings\NiNoUcHe\Cookies\ninouche@serving-sys[2].txt -> TrackingCookie.Serving-sys : Nettoyé.
            :mozilla.153:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
            :mozilla.154:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
            :mozilla.155:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
            :mozilla.156:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
            C:\Documents and Settings\NiNoUcHe\Cookies\ninouche@smartadserver[1].txt -> TrackingCookie.Smartadserver : Nettoyé.
            :mozilla.231:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Tradedoubler : Nettoyé.
            :mozilla.6:C:\Documents and Settings\Michel\Application Data\Mozilla\Firefox\Profiles\9iqps168.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
            :mozilla.95:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
            C:\Documents and Settings\NiNoUcHe\Cookies\ninouche@weborama[1].txt -> TrackingCookie.Weborama : Nettoyé.
            C:\Documents and Settings\Nomii 2\Cookies\nomii_2@weborama[1].txt -> TrackingCookie.Weborama : Nettoyé.
            :mozilla.256:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Webtrends : Nettoyé.
            C:\Documents and Settings\NiNoUcHe\Cookies\ninouche@statse.webtrendslive[2].txt -> TrackingCookie.Webtrendslive : Nettoyé.

            Fin du rapport
            1. ep44 Contributeur
              Bonjour

              Télécharge:
              http://www.grisoft.cz/filedir/inst/avgas-setup-7.5.1.43.exe AVG-AntiSpyware
              = Installer
              = Le lancer
              = Clic : Mise à jour
              ------
              = Redémarre en mode Sans Échec (le démarrage peut prendre plusieurs minutes)
              Attention, pas d’accès à internet dans ce mode. Enregistre ou imprime les consignes.

              Relance le Pc et tapote la touche F8 ( ou F5 pour certains) , jusqu’à l’apparition des inscriptions avec choix de démarrage
              Avec les touches « flèches », sélectionne Mode sans échec ==> entrée ==>nom utilisateur habituel
              -------
              = Dans ANALYSE ( en forme de loupe )
              ==> Paramètres ==> sous COMMENT REAGIR==>clic sur Actions recommandées ==>Quarantaine
              ==> Clic : Analyse complète du système
              En fin de scan ( qui est assez long)
              ==> Clic Appliquer toutes les actions <== ceci Très important
              ==> Clic Sauvegarder rapport puis Enregistrer sous et choisir bureau
              -------
              En mode normal
              colle le rapport
              1. ninouche85
                Nouveau scan hijack,

                Logfile of Trend Micro HijackThis v2.0.2
                Scan saved at 00:10:26, on 15/02/2008
                Platform: Windows XP SP2 (WinNT 5.01.2600)
                MSIE: Internet Explorer v7.00 (7.00.6000.16608)
                Boot mode: Normal

                Running processes:
                C:\WINDOWS\System32\smss.exe
                C:\WINDOWS\system32\winlogon.exe
                C:\WINDOWS\system32\services.exe
                C:\WINDOWS\system32\lsass.exe
                C:\WINDOWS\System32\Ati2evxx.exe
                C:\WINDOWS\system32\svchost.exe
                C:\WINDOWS\System32\svchost.exe
                C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                C:\Program Files\Alwil Software\Avast4\ashServ.exe
                C:\WINDOWS\system32\spoolsv.exe
                c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
                C:\Program Files\a-squared Free\a2service.exe
                C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                C:\Program Files\Bonjour\mDNSResponder.exe
                C:\WINDOWS\System32\FTRTSVC.exe
                C:\Program Files\Spyware Doctor\svcntaux.exe
                C:\Program Files\Spyware Doctor\swdsvc.exe
                C:\WINDOWS\system32\Ati2evxx.exe
                C:\WINDOWS\Explorer.EXE
                C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
                C:\WINDOWS\System32\svchost.exe
                C:\Program Files\Spyware Doctor\SDTrayApp.exe
                C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
                C:\Program Files\SPYWAREfighter\spfprc.exe
                C:\WINDOWS\system32\ctfmon.exe
                C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                C:\WINDOWS\System32\svchost.exe
                C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                C:\Program Files\HP\Digital Imaging\bin\hpqdirec.exe
                C:\WINDOWS\system32\wuauclt.exe
                C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
                C:\Program Files\Mozilla Firefox\firefox.exe

                R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
                R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://login.live.com/ppsecure/sha1auth.srf?lc=1036
                R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
                O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
                O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
                O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
                O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
                O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
                O4 - HKLM\..\Run: [spywarefighterguard] C:\Program Files\SPYWAREfighter\spftray.exe
                O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
                O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
                O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
                O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
                O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
                O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [{2F9E4904-0A27-1036-1212-030310020021}] "C:\Program Files\Fichiers communs\{2F9E4904-0A27-1036-1212-030310020021}\Update.exe" mc-110-12-0001411 (User 'SYSTEM')
                O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
                O4 - HKUS\.DEFAULT\..\Policies\Explorer\Run: [{2F9E4904-0A27-1036-1212-030310020021}] "C:\Program Files\Fichiers communs\{2F9E4904-0A27-1036-1212-030310020021}\Update.exe" mc-110-12-0001411 (User 'Default user')
                O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
                O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
                O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
                O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
                O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
                O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
                O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
                O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - https://onedrive.live.com/
                O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
                O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
                O16 - DPF: {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class) - http://www.photoways.com/clients/uploader_v2.2.0.6.cab
                O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
                O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://194.7.150.2/bin/msnchat45.cab
                O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
                O17 - HKLM\System\CCS\Services\Tcpip\..\{B0F1DB61-29C5-4134-8934-18ADAFEBBF7F}: NameServer = 80.10.246.1 81.253.149.2
                O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
                O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
                O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
                O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
                O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
                O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
                O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
                O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
                O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
                O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
                O23 - Service: NeroNET - Unknown owner - C:\Program Files\Ahead\NeroNET\NeroNET.exe (file missing)
                O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
                O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
                O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
                O23 - Service: SPYWAREfighterRP - SpamFighter APS - C:\Program Files\SPYWAREfighter\spfprc.exe
                4. ninouche85
                  Nouveau scan hijack,

                  Logfile of Trend Micro HijackThis v2.0.2
                  Scan saved at 21:44:08, on 14/02/2008
                  Platform: Windows XP SP2 (WinNT 5.01.2600)
                  MSIE: Internet Explorer v7.00 (7.00.6000.16608)
                  Boot mode: Normal

                  Running processes:
                  C:\WINDOWS\System32\smss.exe
                  C:\WINDOWS\system32\winlogon.exe
                  C:\WINDOWS\system32\services.exe
                  C:\WINDOWS\system32\lsass.exe
                  C:\WINDOWS\System32\Ati2evxx.exe
                  C:\WINDOWS\system32\svchost.exe
                  C:\WINDOWS\System32\svchost.exe
                  C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
                  C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                  C:\Program Files\Alwil Software\Avast4\ashServ.exe
                  C:\WINDOWS\system32\spoolsv.exe
                  c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
                  C:\Program Files\a-squared Free\a2service.exe
                  C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                  C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                  C:\Program Files\Bonjour\mDNSResponder.exe
                  C:\WINDOWS\System32\FTRTSVC.exe
                  C:\Program Files\Spyware Doctor\svcntaux.exe
                  C:\Program Files\Spyware Doctor\swdsvc.exe
                  C:\WINDOWS\system32\Ati2evxx.exe
                  C:\WINDOWS\Explorer.EXE
                  C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                  C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
                  C:\Program Files\Spyware Doctor\SDTrayApp.exe
                  C:\Program Files\iTunes\iTunesHelper.exe
                  C:\Program Files\SPYWAREfighter\spftray.exe
                  C:\Program Files\Internet Explorer\IEXPLORE.EXE
                  C:\WINDOWS\System32\svchost.exe
                  C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
                  C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                  C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                  C:\Program Files\Windows Live\Messenger\msnmsgr.exe
                  C:\Program Files\SPYWAREfighter\spfprc.exe
                  C:\WINDOWS\system32\ctfmon.exe
                  C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                  C:\Program Files\iPod\bin\iPodService.exe
                  C:\Program Files\Internet Explorer\IEXPLORE.EXE
                  C:\WINDOWS\system32\wuauclt.exe
                  C:\WINDOWS\System32\svchost.exe
                  C:\Program Files\Windows Live\Messenger\usnsvc.exe
                  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
                  C:\Program Files\Mozilla Firefox\firefox.exe

                  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
                  R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://login.live.com/ppsecure/sha1auth.srf?lc=1036
                  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                  O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
                  O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\eoRezo\EoAdv\EoRezoBHO.dll (file missing)
                  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                  O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                  O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
                  O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
                  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
                  O4 - HKLM\..\Run: [stupid creative poll axis] C:\Documents and Settings\All Users\Application Data\Memo save stupid creative\wave body.exe
                  O4 - HKLM\..\Run: [spywarefighterguard] C:\Program Files\SPYWAREfighter\spftray.exe
                  O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
                  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
                  O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
                  O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
                  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                  O4 - HKCU\..\Run: [One Joy] C:\DOCUME~1\NiNoUcHe\APPLIC~1\OKAYTI~1\deleteacid.exe
                  O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
                  O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                  O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
                  O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [{2F9E4904-0A27-1036-1212-030310020021}] "C:\Program Files\Fichiers communs\{2F9E4904-0A27-1036-1212-030310020021}\Update.exe" mc-110-12-0001411 (User 'SYSTEM')
                  O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
                  O4 - HKUS\.DEFAULT\..\Policies\Explorer\Run: [{2F9E4904-0A27-1036-1212-030310020021}] "C:\Program Files\Fichiers communs\{2F9E4904-0A27-1036-1212-030310020021}\Update.exe" mc-110-12-0001411 (User 'Default user')
                  O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
                  O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                  O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
                  O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
                  O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                  O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                  O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                  O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                  O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                  O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
                  O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
                  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                  O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - https://onedrive.live.com/
                  O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
                  O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
                  O16 - DPF: {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class) - http://www.photoways.com/clients/uploader_v2.2.0.6.cab
                  O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
                  O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://194.7.150.2/bin/msnchat45.cab
                  O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
                  O17 - HKLM\System\CCS\Services\Tcpip\..\{B0F1DB61-29C5-4134-8934-18ADAFEBBF7F}: NameServer = 80.10.246.130 81.253.149.10
                  O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
                  O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
                  O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
                  O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                  O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                  O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
                  O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                  O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                  O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                  O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                  O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
                  O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
                  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
                  O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
                  O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
                  O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
                  O23 - Service: NeroNET - Unknown owner - C:\Program Files\Ahead\NeroNET\NeroNET.exe (file missing)
                  O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
                  O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
                  O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
                  O23 - Service: SPYWAREfighterRP - SpamFighter APS - C:\Program Files\SPYWAREfighter\spfprc.exe
                  1. ep44 Contributeur
                    installe ces trois logiciels
                    et utilise les les uns après les autres
                    sert toi des tutos

                    =>CCleaner
                    https://www.clubic.com/telecharger-fiche14492-ccleaner.html
                    tuto:
                    https://forums.cnetfrance.fr

                    => Ad-aware SE (scan passif )
                    https://www.google.com ou http://www.lavasoft.de/support/download/#free
                    Tutos :
                    http://home.tiscali.be/schouppeguy/adawarese/adawase.htm
                    démo
                    http://pageperso.aol.fr/balltrap34/adwseflash.zip
                    http://perso.orange.fr/rginformatique/section%20virus/adawrevid.asf

                    => SpyBot-Search & Destroy 1.5 (scan passif + protection préventive avec ces 2 résidents, ses vaccinations et sa list Hosts )

                    https://www.safer-networking.org/download/

                    démo d utilisation
                    http://perso.orange.fr/rginformatique/section%20virus/demo%20spybot.htm
                    https://www.malekal.com/spybot-search-destroy-proteger-desinfecter-pc-virus/
                    Tuto :
                    http://perso.orange.fr/jesses/Docs/Logiciels/Spybot.htm

                    ensuite refais un nouveau hijack stp
                    @+
                    1. ninouche85
                      Scan Hijack,

                      Logfile of Trend Micro HijackThis v2.0.2
                      Scan saved at 21:05:34, on 14/02/2008
                      Platform: Windows XP SP2 (WinNT 5.01.2600)
                      MSIE: Internet Explorer v7.00 (7.00.6000.16608)
                      Boot mode: Normal

                      Running processes:
                      C:\WINDOWS\System32\smss.exe
                      C:\WINDOWS\system32\winlogon.exe
                      C:\WINDOWS\system32\services.exe
                      C:\WINDOWS\system32\lsass.exe
                      C:\WINDOWS\System32\Ati2evxx.exe
                      C:\WINDOWS\system32\svchost.exe
                      C:\WINDOWS\System32\svchost.exe
                      C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
                      C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                      C:\Program Files\Alwil Software\Avast4\ashServ.exe
                      C:\WINDOWS\system32\spoolsv.exe
                      c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
                      C:\Program Files\a-squared Free\a2service.exe
                      C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                      C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                      C:\Program Files\Bonjour\mDNSResponder.exe
                      C:\WINDOWS\System32\FTRTSVC.exe
                      C:\Program Files\Spyware Doctor\svcntaux.exe
                      C:\Program Files\Spyware Doctor\swdsvc.exe
                      C:\WINDOWS\System32\svchost.exe
                      C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                      C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                      C:\WINDOWS\System32\svchost.exe
                      C:\Program Files\Spyware Doctor\SDTrayApp.exe
                      C:\WINDOWS\system32\Ati2evxx.exe
                      C:\WINDOWS\Explorer.EXE
                      C:\WINDOWS\system32\ctfmon.exe
                      C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                      C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
                      C:\Program Files\iTunes\iTunesHelper.exe
                      C:\Program Files\Internet Explorer\IEXPLORE.EXE
                      C:\Program Files\Internet Explorer\IEXPLORE.EXE
                      C:\Program Files\SPYWAREfighter\spfprc.exe
                      C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
                      C:\Program Files\iPod\bin\iPodService.exe
                      C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                      C:\Program Files\Windows Live\Messenger\usnsvc.exe
                      C:\Program Files\Windows Live\Messenger\msnmsgr.exe
                      C:\Program Files\Mozilla Firefox\firefox.exe
                      C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

                      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
                      R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://login.live.com/ppsecure/sha1auth.srf?lc=1036
                      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                      O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
                      O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\eoRezo\EoAdv\EoRezoBHO.dll (file missing)
                      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                      O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                      O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                      O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
                      O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
                      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                      O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
                      O4 - HKLM\..\Run: [stupid creative poll axis] C:\Documents and Settings\All Users\Application Data\Memo save stupid creative\wave body.exe
                      O4 - HKLM\..\Run: [spywarefighterguard] C:\Program Files\SPYWAREfighter\spftray.exe
                      O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
                      O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
                      O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
                      O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
                      O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                      O4 - HKCU\..\Run: [One Joy] C:\DOCUME~1\NiNoUcHe\APPLIC~1\OKAYTI~1\deleteacid.exe
                      O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
                      O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
                      O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
                      O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [{2F9E4904-0A27-1036-1212-030310020021}] "C:\Program Files\Fichiers communs\{2F9E4904-0A27-1036-1212-030310020021}\Update.exe" mc-110-12-0001411 (User 'SYSTEM')
                      O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
                      O4 - HKUS\.DEFAULT\..\Policies\Explorer\Run: [{2F9E4904-0A27-1036-1212-030310020021}] "C:\Program Files\Fichiers communs\{2F9E4904-0A27-1036-1212-030310020021}\Update.exe" mc-110-12-0001411 (User 'Default user')
                      O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
                      O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                      O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                      O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
                      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
                      O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                      O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                      O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
                      O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                      O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
                      O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
                      O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
                      O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                      O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                      O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - https://onedrive.live.com/
                      O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
                      O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
                      O16 - DPF: {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class) - http://www.photoways.com/clients/uploader_v2.2.0.6.cab
                      O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
                      O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://194.7.150.2/bin/msnchat45.cab
                      O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
                      O17 - HKLM\System\CCS\Services\Tcpip\..\{B0F1DB61-29C5-4134-8934-18ADAFEBBF7F}: NameServer = 81.253.149.1 80.10.246.3
                      O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
                      O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
                      O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
                      O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                      O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                      O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
                      O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                      O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                      O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                      O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                      O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
                      O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
                      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
                      O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
                      O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
                      O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
                      O23 - Service: NeroNET - Unknown owner - C:\Program Files\Ahead\NeroNET\NeroNET.exe (file missing)
                      O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
                      O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
                      O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
                      O23 - Service: SPYWAREfighterRP - SpamFighter APS - C:\Program Files\SPYWAREfighter\spfprc.exe
                      1. ep44 Contributeur
                        fait ceci (IMPORTANT)

                        =démarrer
                        =panneau de configuration
                        =système
                        =onglet Restauration système
                        =coche la case (Désactiver la restauration système)
                        =redémarre l'ordinateur
                        =réactive la ensuite

                        ensuite refais un nouveau hijack stp
                        1. ninouche85
                          Scan bitdefender,

                          BitDefender Online Scanner

                          Rapport d'analyse généré à: Thu, Feb 14, 2008 - 13:39:13

                          Voie d'analyse: A:\;C:\;D:\;E:\;G:\;H:\;I:\;J:\;K:\;

                          Statistiques

                          Temps

                          01:28:37

                          Fichiers

                          451113

                          Directoires

                          12255

                          Secteurs de boot

                          4

                          Archives

                          5077

                          Paquets programmes

                          16498

                          Résultats

                          Virus identifiés

                          3

                          Fichiers infectés

                          3

                          Fichiers suspects

                          0

                          Avertissements

                          0

                          Désinfectés

                          0

                          Fichiers effacés

                          3

                          Info sur les moteurs

                          Définition virus

                          897155

                          Version des moteurs

                          AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)

                          Analyse des plugins

                          14

                          Archive des plugins

                          38

                          Unpack des plugins

                          7

                          E-mail plugins

                          6

                          Système plugins

                          1

                          Paramètres d'analyse

                          Première action

                          Désinfecté

                          Seconde Action

                          Supprimé

                          Heuristique

                          Oui

                          Acceptez les avertissements

                          Oui

                          Extensions analysées

                          *;

                          Excludez les extensions

                          Analyse d'emails

                          Oui

                          Analyse des Archives

                          Oui

                          Analyser paquets programmes

                          Oui

                          Analyse des fichiers

                          Oui

                          Analyse de boot

                          Oui

                          Fichier analysé

                          Statut

                          C:\Documents and Settings\Nomii 2\Bureau\Nouveau dossier\PATCHER.EXE=>wise0013

                          Infecté par: Trojan.Downloader.Small.BTF

                          C:\Documents and Settings\Nomii 2\Bureau\Nouveau dossier\PATCHER.EXE=>wise0013

                          Echec de la désinfection

                          C:\Documents and Settings\Nomii 2\Bureau\Nouveau dossier\PATCHER.EXE=>wise0013

                          Supprimé

                          C:\Documents and Settings\Nomii 2\Bureau\Nouveau dossier\PATCHER.EXE

                          Echec de la mise à jour

                          C:\Documents and Settings\Nomii 2\Shared\BitDownload Setup.exe=>(NSIS o)=>lzma_solid_nsis0005

                          Infecté par: Trojan.Obfus.6.Gen

                          C:\Documents and Settings\Nomii 2\Shared\BitDownload Setup.exe=>(NSIS o)=>lzma_solid_nsis0005

                          Echec de la désinfection

                          C:\Documents and Settings\Nomii 2\Shared\BitDownload Setup.exe=>(NSIS o)=>lzma_solid_nsis0005

                          Supprimé

                          C:\Documents and Settings\Nomii 2\Shared\BitDownload Setup.exe=>(NSIS o)

                          Echec de la mise à jour

                          C:\QooBox\Quarantine\C\WINDOWS\pack.epk.vir=>(NSIS 2g)=>lzma_solid_nsis0008

                          Infecté par: Trojan.Mailskinner.G

                          C:\QooBox\Quarantine\C\WINDOWS\pack.epk.vir=>(NSIS 2g)=>lzma_solid_nsis0008

                          Echec de la désinfection

                          C:\QooBox\Quarantine\C\WINDOWS\pack.epk.vir=>(NSIS 2g)=>lzma_solid_nsis0008

                          Supprimé

                          C:\QooBox\Quarantine\C\WINDOWS\pack.epk.vir=>(NSIS 2g)

                          Echec de la mise à jour
                          • 1
                          • 2

                          Discussions similaires

                          Adobe acrobat fich api-ms-win-core-winrt-l1-1-0.dll manquant
                          crinik2002

                          41 réponses
                          À quoi correspond 32x32 US en taille française pour un jean ?
                          Alison1958

                          1 réponse
                          svp 32Gb est il egal a 32Go??
                          William Fernand

                          3 réponses
                          Quelle est la différence entre les GO et GB ?
                          badour

                          37 réponses